Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/master' into topic/johanna/tls-more-data

Browse source
This commit is contained in:
Johanna Amann 2018-08-24 15:36:34 -07:00
commit 4b40b6ebe4
42 changed files with 500 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

31
testing/btest/scripts/base/protocols/dce-rpc/context.bro Normal file
View file

@ -0,0 +1,31 @@
# @TEST-EXEC: bro -b -C -r $TRACES/dce-rpc/cs_window7-join_stream092.pcap %INPUT >out
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: btest-diff dce_rpc.log
@load base/protocols/dce-rpc
event dce_rpc_bind(c: connection, fid: count, ctx_id: count, uuid: string, ver_major: count, ver_minor: count) &priority=5
{
print fmt("dce_rpc_bind :: fid == %s", fid);
print fmt("dce_rpc_bind :: ctx_id == %s", ctx_id);
print fmt("dce_rpc_bind :: uuid == %s", uuid_to_string(uuid));
}
event dce_rpc_alter_context(c: connection, fid: count, ctx_id: count, uuid: string, ver_major: count, ver_minor: count) &priority=5
{
print fmt("dce_rpc_alter_context :: fid == %s", fid);
print fmt("dce_rpc_alter_context :: ctx_id == %s", ctx_id);
print fmt("dce_rpc_alter_context :: uuid == %s", uuid_to_string(uuid));
}
event dce_rpc_bind_ack(c: connection, fid: count, sec_addr: string) &priority=5
{
print fmt("dce_rpc_bind_ack :: fid == %s", fid);
print fmt("dce_rpc_bind_ack :: sec_addr == %s", sec_addr);
}
event dce_rpc_alter_context_resp(c: connection, fid: count) &priority=5
{
print fmt("dce_rpc_alter_context_resp :: fid == %s", fid);
}