mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
Updating tests for the #start/#end change.
This commit is contained in:
parent
87e10b5f97
commit
5cfb8d65c3
123 changed files with 442 additions and 162 deletions
|
@ -1 +1 @@
|
||||||
Subproject commit b4094cb75e0a7769123f7db1f5d73f3f9f1c3977
|
Subproject commit 4ad8d15b6395925c9875c9d2912a6cc3b4918e0a
|
|
@ -1 +1 @@
|
||||||
Subproject commit 2038e3de042115c3caa706426e16c830c1fd1e9e
|
Subproject commit c691c01e9cefae5a79bcd4b0f84ca387c8c587a7
|
|
@ -1 +1 @@
|
||||||
Subproject commit 07866915a1450ddd25b888917f494b4824b0cc3f
|
Subproject commit 8234b8903cbc775f341bdb6a1c0159981d88d27b
|
|
@ -1 +1 @@
|
||||||
Subproject commit 892b60edb967bb456872638f22ba994e84530137
|
Subproject commit d5ecd1a42c04b0dca332edc31811e5a6d0f7f2fb
|
2
cmake
2
cmake
|
@ -1 +1 @@
|
||||||
Subproject commit 96f3d92acadbe1ae64f410e974c5ff503903394b
|
Subproject commit 2a72c5e08e018cf632033af3920432d5f684e130
|
|
@ -2,6 +2,7 @@
|
||||||
|
|
||||||
#include <string>
|
#include <string>
|
||||||
#include <errno.h>
|
#include <errno.h>
|
||||||
|
#include <fcntl.h>
|
||||||
|
|
||||||
#include "NetVar.h"
|
#include "NetVar.h"
|
||||||
#include "threading/SerialTypes.h"
|
#include "threading/SerialTypes.h"
|
||||||
|
|
|
@ -93,9 +93,11 @@ const char* BasicThread::Fmt(const char* format, ...)
|
||||||
|
|
||||||
const char* BasicThread::Strerror(int err)
|
const char* BasicThread::Strerror(int err)
|
||||||
{
|
{
|
||||||
static char buf[128] = "<not set>";
|
if ( ! strerr_buffer )
|
||||||
strerror_r(err, buf, sizeof(buf));
|
strerr_buffer = new char[256];
|
||||||
return buf;
|
|
||||||
|
strerror_r(err, strerr_buffer, 256);
|
||||||
|
return strerr_buffer;
|
||||||
}
|
}
|
||||||
|
|
||||||
void BasicThread::Start()
|
void BasicThread::Start()
|
||||||
|
|
|
@ -120,8 +120,8 @@ public:
|
||||||
/**
|
/**
|
||||||
* A version of strerror() that the thread can safely use. This is
|
* A version of strerror() that the thread can safely use. This is
|
||||||
* essentially a wrapper around strerror_r(). Note that it keeps a
|
* essentially a wrapper around strerror_r(). Note that it keeps a
|
||||||
* single static buffer internally so the result remains valid only
|
* single buffer per thread internally so the result remains valid
|
||||||
* until the next call.
|
* only until the next call.
|
||||||
*/
|
*/
|
||||||
const char* Strerror(int err);
|
const char* Strerror(int err);
|
||||||
|
|
||||||
|
@ -207,6 +207,9 @@ private:
|
||||||
char* buf;
|
char* buf;
|
||||||
unsigned int buf_len;
|
unsigned int buf_len;
|
||||||
|
|
||||||
|
// For implementating Strerror().
|
||||||
|
char* strerr_buffer;
|
||||||
|
|
||||||
static uint64_t thread_counter;
|
static uint64_t thread_counter;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
@ -5,6 +5,7 @@
|
||||||
#include "Manager.h"
|
#include "Manager.h"
|
||||||
|
|
||||||
#include <unistd.h>
|
#include <unistd.h>
|
||||||
|
#include <signal.h>
|
||||||
|
|
||||||
using namespace threading;
|
using namespace threading;
|
||||||
|
|
||||||
|
|
|
@ -3,4 +3,4 @@
|
||||||
-60.0
|
-60.0
|
||||||
3600.0
|
3600.0
|
||||||
86400.0
|
86400.0
|
||||||
1337982322.762159
|
1342748947.655087
|
||||||
|
|
|
@ -3,81 +3,101 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-03-26-18-03-01
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1332784981.078396 - - - - - bad_IP_checksum - F bro
|
1332784981.078396 - - - - - bad_IP_checksum - F bro
|
||||||
|
#end 2012-03-26-18-03-01
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-03-26-18-01-25
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1332784885.686428 UWkUyAuUGXf 127.0.0.1 30000 127.0.0.1 80 bad_TCP_checksum - F bro
|
1332784885.686428 UWkUyAuUGXf 127.0.0.1 30000 127.0.0.1 80 bad_TCP_checksum - F bro
|
||||||
|
#end 2012-03-26-18-01-25
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-03-26-18-02-13
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1332784933.501023 UWkUyAuUGXf 127.0.0.1 30000 127.0.0.1 13000 bad_UDP_checksum - F bro
|
1332784933.501023 UWkUyAuUGXf 127.0.0.1 30000 127.0.0.1 13000 bad_UDP_checksum - F bro
|
||||||
|
#end 2012-03-26-18-02-13
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-10-16-29-23
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1334075363.536871 UWkUyAuUGXf 192.168.1.100 8 192.168.1.101 0 bad_ICMP_checksum - F bro
|
1334075363.536871 UWkUyAuUGXf 192.168.1.100 8 192.168.1.101 0 bad_ICMP_checksum - F bro
|
||||||
|
#end 2012-04-10-16-29-23
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-03-26-18-06-50
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1332785210.013051 - - - - - routing0_hdr - F bro
|
1332785210.013051 - - - - - routing0_hdr - F bro
|
||||||
1332785210.013051 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:78:1:32::2 80 bad_TCP_checksum - F bro
|
1332785210.013051 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:78:1:32::2 80 bad_TCP_checksum - F bro
|
||||||
|
#end 2012-03-26-18-06-50
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-03-26-17-23-00
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1332782580.798420 - - - - - routing0_hdr - F bro
|
1332782580.798420 - - - - - routing0_hdr - F bro
|
||||||
1332782580.798420 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:78:1:32::2 13000 bad_UDP_checksum - F bro
|
1332782580.798420 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:78:1:32::2 13000 bad_UDP_checksum - F bro
|
||||||
|
#end 2012-03-26-17-23-00
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-10-16-25-11
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1334075111.800086 - - - - - routing0_hdr - F bro
|
1334075111.800086 - - - - - routing0_hdr - F bro
|
||||||
1334075111.800086 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:78:1:32::1 129 bad_ICMP_checksum - F bro
|
1334075111.800086 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:78:1:32::1 129 bad_ICMP_checksum - F bro
|
||||||
|
#end 2012-04-10-16-25-11
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-03-26-18-07-30
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1332785250.469132 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:4f8:4:7:2e0:81ff:fe52:9a6b 80 bad_TCP_checksum - F bro
|
1332785250.469132 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:4f8:4:7:2e0:81ff:fe52:9a6b 80 bad_TCP_checksum - F bro
|
||||||
|
#end 2012-03-26-18-07-30
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-03-26-17-02-22
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1332781342.923813 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:4f8:4:7:2e0:81ff:fe52:9a6b 13000 bad_UDP_checksum - F bro
|
1332781342.923813 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:4f8:4:7:2e0:81ff:fe52:9a6b 13000 bad_UDP_checksum - F bro
|
||||||
|
#end 2012-03-26-17-02-22
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-10-16-22-19
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1334074939.467194 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:4f8:4:7:2e0:81ff:fe52:9a6b 129 bad_ICMP_checksum - F bro
|
1334074939.467194 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:4f8:4:7:2e0:81ff:fe52:9a6b 129 bad_ICMP_checksum - F bro
|
||||||
|
#end 2012-04-10-16-22-19
|
||||||
|
|
|
@ -3,54 +3,68 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-10-16-22-19
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1334074939.467194 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:4f8:4:7:2e0:81ff:fe52:9a6b 129 bad_ICMP_checksum - F bro
|
1334074939.467194 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:4f8:4:7:2e0:81ff:fe52:9a6b 129 bad_ICMP_checksum - F bro
|
||||||
|
#end 2012-04-10-16-22-19
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-03-26-18-05-25
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1332785125.596793 - - - - - routing0_hdr - F bro
|
1332785125.596793 - - - - - routing0_hdr - F bro
|
||||||
|
#end 2012-03-26-18-05-25
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-03-26-17-21-48
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1332782508.592037 - - - - - routing0_hdr - F bro
|
1332782508.592037 - - - - - routing0_hdr - F bro
|
||||||
|
#end 2012-03-26-17-21-48
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-10-16-23-47
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1334075027.053380 - - - - - routing0_hdr - F bro
|
1334075027.053380 - - - - - routing0_hdr - F bro
|
||||||
|
#end 2012-04-10-16-23-47
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-10-16-23-47
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1334075027.053380 - - - - - routing0_hdr - F bro
|
1334075027.053380 - - - - - routing0_hdr - F bro
|
||||||
|
#end 2012-04-10-16-23-47
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-10-16-23-47
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1334075027.053380 - - - - - routing0_hdr - F bro
|
1334075027.053380 - - - - - routing0_hdr - F bro
|
||||||
|
#end 2012-04-10-16-23-47
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-10-16-23-47
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1334075027.053380 - - - - - routing0_hdr - F bro
|
1334075027.053380 - - - - - routing0_hdr - F bro
|
||||||
|
#end 2012-04-10-16-23-47
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-05-21-56-51
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1333663011.602839 - - - - - unknown_protocol_135 - F bro
|
1333663011.602839 - - - - - unknown_protocol_135 - F bro
|
||||||
|
#end 2012-04-05-21-56-51
|
||||||
|
|
|
@ -3,14 +3,16 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path reporter
|
#path reporter
|
||||||
|
#start 2011-03-18-19-06-08
|
||||||
#fields ts level message location
|
#fields ts level message location
|
||||||
#types time enum string string
|
#types time enum string string
|
||||||
1300475168.783842 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
1300475168.783842 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
||||||
1300475168.915940 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
1300475168.915940 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
||||||
1300475168.916118 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
1300475168.916118 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
||||||
1300475168.918295 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
1300475168.918295 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
||||||
1300475168.952193 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
1300475168.952193 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
||||||
1300475168.952228 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
1300475168.952228 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
||||||
1300475168.954761 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
1300475168.954761 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
||||||
1300475168.962628 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
1300475168.962628 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
||||||
1300475169.780331 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
1300475169.780331 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
|
||||||
|
#end 2011-03-18-19-06-13
|
||||||
|
|
|
@ -3,7 +3,9 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path dns
|
#path dns
|
||||||
|
#start 2012-03-07-01-37-58
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs
|
||||||
#types time string addr port addr port enum count string count string count string count string bool bool bool bool count vector[string] vector[interval]
|
#types time string addr port addr port enum count string count string count string count string bool bool bool bool count vector[string] vector[interval]
|
||||||
1331084278.438444 UWkUyAuUGXf 2001:470:1f11:81f:d138:5f55:6d4:1fe2 51850 2607:f740:b::f93 53 udp 3903 txtpadding_323.n1.netalyzr.icsi.berkeley.edu 1 C_INTERNET 16 TXT 0 NOERROR T F T F 0 This TXT record should be ignored 1.000000
|
1331084278.438444 UWkUyAuUGXf 2001:470:1f11:81f:d138:5f55:6d4:1fe2 51850 2607:f740:b::f93 53 udp 3903 txtpadding_323.n1.netalyzr.icsi.berkeley.edu 1 C_INTERNET 16 TXT 0 NOERROR T F T F 0 This TXT record should be ignored 1.000000
|
||||||
1331084293.592245 arKYeMETxOg 2001:470:1f11:81f:d138:5f55:6d4:1fe2 51851 2607:f740:b::f93 53 udp 40849 txtpadding_3230.n1.netalyzr.icsi.berkeley.edu 1 C_INTERNET 16 TXT 0 NOERROR T F T F 0 This TXT record should be ignored 1.000000
|
1331084293.592245 arKYeMETxOg 2001:470:1f11:81f:d138:5f55:6d4:1fe2 51851 2607:f740:b::f93 53 udp 40849 txtpadding_3230.n1.netalyzr.icsi.berkeley.edu 1 C_INTERNET 16 TXT 0 NOERROR T F T F 0 This TXT record should be ignored 1.000000
|
||||||
|
#end 2012-03-07-01-38-18
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path conn
|
#path conn
|
||||||
|
#start 2005-10-07-23-23-57
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||||
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
||||||
1128727435.450898 UWkUyAuUGXf 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - 0 ShADdFaf 12 730 10 9945 (empty)
|
1128727435.450898 UWkUyAuUGXf 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - 0 ShADdFaf 12 730 10 9945 (empty)
|
||||||
|
#end 2005-10-07-23-23-57
|
||||||
|
|
|
@ -3,30 +3,38 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path packet_filter
|
#path packet_filter
|
||||||
|
#start 1970-01-01-00-00-00
|
||||||
#fields ts node filter init success
|
#fields ts node filter init success
|
||||||
#types time string string bool bool
|
#types time string string bool bool
|
||||||
1340229717.179155 - ip or not ip T T
|
1342748953.570646 - ip or not ip T T
|
||||||
|
#end <abnormal termination>
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path packet_filter
|
#path packet_filter
|
||||||
|
#start 1970-01-01-00-00-00
|
||||||
#fields ts node filter init success
|
#fields ts node filter init success
|
||||||
#types time string string bool bool
|
#types time string string bool bool
|
||||||
1340229717.462355 - (((((((((((((((((((((((((port 53) or (tcp port 989)) or (tcp port 443)) or (port 6669)) or (udp and port 5353)) or (port 6668)) or (tcp port 1080)) or (udp and port 5355)) or (tcp port 22)) or (tcp port 995)) or (port 21)) or (tcp port 25 or tcp port 587)) or (port 6667)) or (tcp port 614)) or (tcp port 990)) or (udp port 137)) or (tcp port 993)) or (tcp port 5223)) or (port 514)) or (tcp port 585)) or (tcp port 992)) or (tcp port 563)) or (tcp port 994)) or (tcp port 636)) or (tcp and port (80 or 81 or 631 or 1080 or 3138 or 8000 or 8080 or 8888))) or (port 6666) T T
|
1342748953.898675 - (((((((((((((((((((((((((port 53) or (tcp port 989)) or (tcp port 443)) or (port 6669)) or (udp and port 5353)) or (port 6668)) or (tcp port 1080)) or (udp and port 5355)) or (tcp port 22)) or (tcp port 995)) or (port 21)) or (tcp port 25 or tcp port 587)) or (port 6667)) or (tcp port 614)) or (tcp port 990)) or (udp port 137)) or (tcp port 993)) or (tcp port 5223)) or (port 514)) or (tcp port 585)) or (tcp port 992)) or (tcp port 563)) or (tcp port 994)) or (tcp port 636)) or (tcp and port (80 or 81 or 631 or 1080 or 3138 or 8000 or 8080 or 8888))) or (port 6666) T T
|
||||||
|
#end <abnormal termination>
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path packet_filter
|
#path packet_filter
|
||||||
|
#start 1970-01-01-00-00-00
|
||||||
#fields ts node filter init success
|
#fields ts node filter init success
|
||||||
#types time string string bool bool
|
#types time string string bool bool
|
||||||
1340229717.733007 - port 42 T T
|
1342748954.278211 - port 42 T T
|
||||||
|
#end <abnormal termination>
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path packet_filter
|
#path packet_filter
|
||||||
|
#start 1970-01-01-00-00-00
|
||||||
#fields ts node filter init success
|
#fields ts node filter init success
|
||||||
#types time string string bool bool
|
#types time string string bool bool
|
||||||
1340229718.001009 - port 56730 T T
|
1342748954.883780 - port 56730 T T
|
||||||
|
#end 2005-10-07-23-23-57
|
||||||
|
|
|
@ -1,2 +1,2 @@
|
||||||
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-error-in-handler/reporter-error-in-handler.bro, line 22: no such index (a[2])
|
error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-error-in-handler/reporter-error-in-handler.bro, line 22: no such index (a[2])
|
||||||
1st error printed on script level
|
1st error printed on script level
|
||||||
|
|
|
@ -1 +1 @@
|
||||||
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-fmt-strings/reporter-fmt-strings.bro, line 9: not an event (dont_interpret_this(%s))
|
error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-fmt-strings/reporter-fmt-strings.bro, line 9: not an event (dont_interpret_this(%s))
|
||||||
|
|
|
@ -1 +1 @@
|
||||||
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-parse-error/reporter-parse-error.bro, line 7: unknown identifier TESTFAILURE, at or near "TESTFAILURE"
|
error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-parse-error/reporter-parse-error.bro, line 7: unknown identifier TESTFAILURE, at or near "TESTFAILURE"
|
||||||
|
|
|
@ -1 +1 @@
|
||||||
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-runtime-error/reporter-runtime-error.bro, line 12: no such index (a[1])
|
error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-runtime-error/reporter-runtime-error.bro, line 12: no such index (a[1])
|
||||||
|
|
|
@ -1,3 +1,3 @@
|
||||||
error in string and /Users/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11: arithmetic mixed with non-arithmetic (string and 42)
|
error in string and /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11: arithmetic mixed with non-arithmetic (string and 42)
|
||||||
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11 and string: type mismatch (42 and string)
|
error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11 and string: type mismatch (42 and string)
|
||||||
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11: argument type mismatch in event invocation (foo(42))
|
error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11: argument type mismatch in event invocation (foo(42))
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
reporter_info|init test-info|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 8|0.000000
|
reporter_info|init test-info|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 8|0.000000
|
||||||
reporter_warning|init test-warning|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 9|0.000000
|
reporter_warning|init test-warning|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 9|0.000000
|
||||||
reporter_error|init test-error|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 10|0.000000
|
reporter_error|init test-error|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 10|0.000000
|
||||||
reporter_info|done test-info|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 15|0.000000
|
reporter_info|done test-info|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 15|0.000000
|
||||||
reporter_warning|done test-warning|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 16|0.000000
|
reporter_warning|done test-warning|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 16|0.000000
|
||||||
reporter_error|done test-error|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 17|0.000000
|
reporter_error|done test-error|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 17|0.000000
|
||||||
|
|
|
@ -1,3 +1,3 @@
|
||||||
/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 52: pre test-info
|
/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 52: pre test-info
|
||||||
warning in /Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 53: pre test-warning
|
warning in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 53: pre test-warning
|
||||||
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 54: pre test-error
|
error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 54: pre test-error
|
||||||
|
|
|
@ -3,30 +3,38 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-11-16-01-35
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1334160095.895421 - - - - - truncated_IP - F bro
|
1334160095.895421 - - - - - truncated_IP - F bro
|
||||||
|
#end 2012-04-11-16-01-35
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-11-14-57-21
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1334156241.519125 - - - - - truncated_IP - F bro
|
1334156241.519125 - - - - - truncated_IP - F bro
|
||||||
|
#end 2012-04-11-14-57-21
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-04-10-21-50-48
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1334094648.590126 - - - - - truncated_IP - F bro
|
1334094648.590126 - - - - - truncated_IP - F bro
|
||||||
|
#end 2012-04-10-21-50-48
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-05-29-22-02-34
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1338328954.078361 - - - - - internally_truncated_header - F bro
|
1338328954.078361 - - - - - internally_truncated_header - F bro
|
||||||
|
#end 2012-05-29-22-02-34
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path conn
|
#path conn
|
||||||
|
#start 2009-11-08-04-41-57
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||||
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
||||||
1257655301.595604 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 tcp http 2.101052 2981 4665 S1 - 0 ShADad 10 3605 11 5329 k6kgXLOoSKl
|
1257655301.595604 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 tcp http 2.101052 2981 4665 S1 - 0 ShADad 10 3605 11 5329 k6kgXLOoSKl
|
||||||
|
@ -13,3 +14,4 @@
|
||||||
1257655296.585188 TEfuqmmG4bh fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff00:2 130 icmp - 0.919988 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl
|
1257655296.585188 TEfuqmmG4bh fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff00:2 130 icmp - 0.919988 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl
|
||||||
1257655296.585151 j4u32Pc5bif fe80::216:cbff:fe9a:4cb9 131 ff02::2:f901:d225 130 icmp - 0.719947 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl
|
1257655296.585151 j4u32Pc5bif fe80::216:cbff:fe9a:4cb9 131 ff02::2:f901:d225 130 icmp - 0.719947 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl
|
||||||
1257655296.585034 nQcgTWjvg4c fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff9a:4cb9 130 icmp - 4.922880 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl
|
1257655296.585034 nQcgTWjvg4c fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff9a:4cb9 130 icmp - 4.922880 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl
|
||||||
|
#end 2009-11-08-04-41-57
|
||||||
|
|
|
@ -3,8 +3,10 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path http
|
#path http
|
||||||
|
#start 2009-11-08-04-41-41
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
1257655301.652206 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 10102 200 OK - - - (empty) - - - text/html - -
|
1257655301.652206 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 10102 200 OK - - - (empty) - - - text/html - -
|
||||||
1257655302.514424 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 2 GET ipv6.google.com /csi?v=3&s=webhp&action=&tran=undefined&e=17259,19771,21517,21766,21887,22212&ei=BUz2Su7PMJTglQfz3NzCAw&rt=prt.77,xjs.565,ol.645 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - -
|
1257655302.514424 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 2 GET ipv6.google.com /csi?v=3&s=webhp&action=&tran=undefined&e=17259,19771,21517,21766,21887,22212&ei=BUz2Su7PMJTglQfz3NzCAw&rt=prt.77,xjs.565,ol.645 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - -
|
||||||
1257655303.603569 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 3 GET ipv6.google.com /gen_204?atyp=i&ct=fade&cad=1254&ei=BUz2Su7PMJTglQfz3NzCAw&zx=1257655303600 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - -
|
1257655303.603569 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 3 GET ipv6.google.com /gen_204?atyp=i&ct=fade&cad=1254&ei=BUz2Su7PMJTglQfz3NzCAw&zx=1257655303600 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - -
|
||||||
|
#end 2009-11-08-04-41-57
|
||||||
|
|
|
@ -3,9 +3,11 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path tunnel
|
#path tunnel
|
||||||
|
#start 2009-11-08-04-41-33
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||||
#types time string addr port addr port enum enum
|
#types time string addr port addr port enum enum
|
||||||
1257655293.629048 UWkUyAuUGXf 192.168.3.101 53796 216.14.98.22 5072 Tunnel::AYIYA Tunnel::DISCOVER
|
1257655293.629048 UWkUyAuUGXf 192.168.3.101 53796 216.14.98.22 5072 Tunnel::AYIYA Tunnel::DISCOVER
|
||||||
1257655296.585034 k6kgXLOoSKl 192.168.3.101 53859 216.14.98.22 5072 Tunnel::AYIYA Tunnel::DISCOVER
|
1257655296.585034 k6kgXLOoSKl 192.168.3.101 53859 216.14.98.22 5072 Tunnel::AYIYA Tunnel::DISCOVER
|
||||||
1257655317.464035 k6kgXLOoSKl 192.168.3.101 53859 216.14.98.22 5072 Tunnel::AYIYA Tunnel::CLOSE
|
1257655317.464035 k6kgXLOoSKl 192.168.3.101 53859 216.14.98.22 5072 Tunnel::AYIYA Tunnel::CLOSE
|
||||||
1257655317.464035 UWkUyAuUGXf 192.168.3.101 53796 216.14.98.22 5072 Tunnel::AYIYA Tunnel::CLOSE
|
1257655317.464035 UWkUyAuUGXf 192.168.3.101 53796 216.14.98.22 5072 Tunnel::AYIYA Tunnel::CLOSE
|
||||||
|
#end 2009-11-08-04-41-57
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path dpd
|
#path dpd
|
||||||
|
#start 2009-11-18-17-59-51
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto analyzer failure_reason
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto analyzer failure_reason
|
||||||
#types time string addr port addr port enum string string
|
#types time string addr port addr port enum string string
|
||||||
1258567191.486869 UWkUyAuUGXf 192.168.1.105 57696 192.168.1.1 53 udp TEREDO Teredo payload length [c\x1d\x81\x80\x00\x01\x00\x02\x00\x02\x00\x00\x04amch\x0equestionmarket\x03com\x00\x00\x01\x00...]
|
1258567191.486869 UWkUyAuUGXf 192.168.1.105 57696 192.168.1.1 53 udp TEREDO Teredo payload length [c\x1d\x81\x80\x00\x01\x00\x02\x00\x02\x00\x00\x04amch\x0equestionmarket\x03com\x00\x00\x01\x00...]
|
||||||
|
@ -11,3 +12,4 @@
|
||||||
1258581768.898165 TEfuqmmG4bh 192.168.1.104 50798 192.168.1.1 53 udp TEREDO Teredo payload length [o\xe3\x81\x80\x00\x01\x00\x02\x00\x04\x00\x04\x03www\x0fnashuatelegraph\x03com\x00\x00\x01\x00...]
|
1258581768.898165 TEfuqmmG4bh 192.168.1.104 50798 192.168.1.1 53 udp TEREDO Teredo payload length [o\xe3\x81\x80\x00\x01\x00\x02\x00\x04\x00\x04\x03www\x0fnashuatelegraph\x03com\x00\x00\x01\x00...]
|
||||||
1258584478.989528 FrJExwHcSal 192.168.1.104 64963 192.168.1.1 53 udp TEREDO Teredo payload length [e\xbd\x81\x80\x00\x01\x00\x08\x00\x06\x00\x06\x08wellness\x05blogs\x04time\x03com\x00\x00\x01\x00...]
|
1258584478.989528 FrJExwHcSal 192.168.1.104 64963 192.168.1.1 53 udp TEREDO Teredo payload length [e\xbd\x81\x80\x00\x01\x00\x08\x00\x06\x00\x06\x08wellness\x05blogs\x04time\x03com\x00\x00\x01\x00...]
|
||||||
1258600683.934672 5OKnoww6xl4 192.168.1.103 59838 192.168.1.1 53 udp TEREDO Teredo payload length [h\xf0\x81\x80\x00\x01\x00\x01\x00\x02\x00\x00\x06update\x0csanasecurity\x03com\x00\x00\x01\x00...]
|
1258600683.934672 5OKnoww6xl4 192.168.1.103 59838 192.168.1.1 53 udp TEREDO Teredo payload length [h\xf0\x81\x80\x00\x01\x00\x01\x00\x02\x00\x00\x06update\x0csanasecurity\x03com\x00\x00\x01\x00...]
|
||||||
|
#end 2009-11-19-03-18-03
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2009-11-18-17-59-51
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1258567191.405770 - - - - - truncated_header_in_tunnel - F bro
|
1258567191.405770 - - - - - truncated_header_in_tunnel - F bro
|
||||||
|
@ -11,3 +12,4 @@
|
||||||
1258581768.568451 - - - - - truncated_header_in_tunnel - F bro
|
1258581768.568451 - - - - - truncated_header_in_tunnel - F bro
|
||||||
1258584478.859853 - - - - - truncated_header_in_tunnel - F bro
|
1258584478.859853 - - - - - truncated_header_in_tunnel - F bro
|
||||||
1258600683.934458 - - - - - truncated_header_in_tunnel - F bro
|
1258600683.934458 - - - - - truncated_header_in_tunnel - F bro
|
||||||
|
#end 2009-11-19-03-18-03
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path conn
|
#path conn
|
||||||
|
#start 2008-05-16-15-50-57
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||||
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
||||||
1210953047.736921 arKYeMETxOg 192.168.2.16 1576 75.126.130.163 80 tcp - 0.000357 0 0 SHR - 0 fA 1 40 1 40 (empty)
|
1210953047.736921 arKYeMETxOg 192.168.2.16 1576 75.126.130.163 80 tcp - 0.000357 0 0 SHR - 0 fA 1 40 1 40 (empty)
|
||||||
|
@ -26,3 +27,4 @@
|
||||||
1210953052.324629 FrJExwHcSal fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - 0 - 1 88 0 0 TEfuqmmG4bh
|
1210953052.324629 FrJExwHcSal fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - 0 - 1 88 0 0 TEfuqmmG4bh
|
||||||
1210953060.829303 qCaWGmzFtM5 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.463615 4 4 OTH - 0 - 1 52 1 52 GSxOnSLghOa,nQcgTWjvg4c
|
1210953060.829303 qCaWGmzFtM5 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.463615 4 4 OTH - 0 - 1 52 1 52 GSxOnSLghOa,nQcgTWjvg4c
|
||||||
1210953052.202579 j4u32Pc5bif fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - 0 - 1 64 0 0 nQcgTWjvg4c
|
1210953052.202579 j4u32Pc5bif fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - 0 - 1 64 0 0 nQcgTWjvg4c
|
||||||
|
#end 2008-05-16-15-51-16
|
||||||
|
|
|
@ -3,9 +3,11 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path http
|
#path http
|
||||||
|
#start 2008-05-16-15-50-58
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
1210953057.917183 3PKsZ2Uye21 192.168.2.16 1578 75.126.203.78 80 1 POST download913.avast.com /cgi-bin/iavs4stats.cgi - Syncer/4.80 (av_pro-1169;f) 589 0 204 <empty> - - - (empty) - - - text/plain - -
|
1210953057.917183 3PKsZ2Uye21 192.168.2.16 1578 75.126.203.78 80 1 POST download913.avast.com /cgi-bin/iavs4stats.cgi - Syncer/4.80 (av_pro-1169;f) 589 0 204 <empty> - - - (empty) - - - text/plain - -
|
||||||
1210953061.585996 70MGiRM1Qf4 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - text/html - -
|
1210953061.585996 70MGiRM1Qf4 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - text/html - -
|
||||||
1210953073.381474 70MGiRM1Qf4 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - text/html - -
|
1210953073.381474 70MGiRM1Qf4 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - text/html - -
|
||||||
1210953074.674817 c4Zw9TmAE05 192.168.2.16 1580 67.228.110.120 80 1 GET www.wireshark.org / http://ipv6.google.com/search?hl=en&q=Wireshark+%21&btnG=Google+Search Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 11845 200 OK - - - (empty) - - - text/xml - -
|
1210953074.674817 c4Zw9TmAE05 192.168.2.16 1580 67.228.110.120 80 1 GET www.wireshark.org / http://ipv6.google.com/search?hl=en&q=Wireshark+%21&btnG=Google+Search Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 11845 200 OK - - - (empty) - - - text/xml - -
|
||||||
|
#end 2008-05-16-15-51-16
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path tunnel
|
#path tunnel
|
||||||
|
#start 2008-05-16-15-50-52
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||||
#types time string addr port addr port enum enum
|
#types time string addr port addr port enum enum
|
||||||
1210953052.202579 nQcgTWjvg4c 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER
|
1210953052.202579 nQcgTWjvg4c 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER
|
||||||
|
@ -11,3 +12,4 @@
|
||||||
1210953076.058333 nQcgTWjvg4c 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE
|
1210953076.058333 nQcgTWjvg4c 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE
|
||||||
1210953076.058333 GSxOnSLghOa 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE
|
1210953076.058333 GSxOnSLghOa 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE
|
||||||
1210953076.058333 TEfuqmmG4bh 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE
|
1210953076.058333 TEfuqmmG4bh 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE
|
||||||
|
#end 2008-05-16-15-51-16
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path conn
|
#path conn
|
||||||
|
#start 2012-06-19-17-39-37
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||||
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
||||||
1340127577.354166 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 0.052829 1675 10467 S1 - 0 ShADad 10 2279 12 11191 j4u32Pc5bif
|
1340127577.354166 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 0.052829 1675 10467 S1 - 0 ShADad 10 2279 12 11191 j4u32Pc5bif
|
||||||
|
@ -12,3 +13,4 @@
|
||||||
1340127577.339015 nQcgTWjvg4c fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - 0 - 1 88 0 0 k6kgXLOoSKl
|
1340127577.339015 nQcgTWjvg4c fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - 0 - 1 88 0 0 k6kgXLOoSKl
|
||||||
1340127577.343969 TEfuqmmG4bh 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.007778 4 4 OTH - 0 - 1 52 1 52 UWkUyAuUGXf,j4u32Pc5bif
|
1340127577.343969 TEfuqmmG4bh 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.007778 4 4 OTH - 0 - 1 52 1 52 UWkUyAuUGXf,j4u32Pc5bif
|
||||||
1340127577.336558 arKYeMETxOg fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - 0 - 1 64 0 0 UWkUyAuUGXf
|
1340127577.336558 arKYeMETxOg fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - 0 - 1 64 0 0 UWkUyAuUGXf
|
||||||
|
#end 2012-06-19-17-39-37
|
||||||
|
|
|
@ -3,7 +3,9 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path http
|
#path http
|
||||||
|
#start 2012-06-19-17-39-37
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
1340127577.361683 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - text/html - -
|
1340127577.361683 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - text/html - -
|
||||||
1340127577.379360 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - text/html - -
|
1340127577.379360 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - text/html - -
|
||||||
|
#end 2012-06-19-17-39-37
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path tunnel
|
#path tunnel
|
||||||
|
#start 2012-06-19-17-39-37
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||||
#types time string addr port addr port enum enum
|
#types time string addr port addr port enum enum
|
||||||
1340127577.336558 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER
|
1340127577.336558 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER
|
||||||
|
@ -11,3 +12,4 @@
|
||||||
1340127577.406995 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE
|
1340127577.406995 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE
|
||||||
1340127577.406995 j4u32Pc5bif 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE
|
1340127577.406995 j4u32Pc5bif 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE
|
||||||
1340127577.406995 k6kgXLOoSKl 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE
|
1340127577.406995 k6kgXLOoSKl 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE
|
||||||
|
#end 2012-06-19-17-39-37
|
||||||
|
|
|
@ -3,7 +3,9 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path weird
|
#path weird
|
||||||
|
#start 2012-06-19-17-39-37
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||||
#types time string addr port addr port string string bool string
|
#types time string addr port addr port string string bool string
|
||||||
1340127577.346849 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Teredo_bubble_with_payload - F bro
|
1340127577.346849 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Teredo_bubble_with_payload - F bro
|
||||||
1340127577.349292 j4u32Pc5bif 192.168.2.16 3797 83.170.1.38 32900 Teredo_bubble_with_payload - F bro
|
1340127577.349292 j4u32Pc5bif 192.168.2.16 3797 83.170.1.38 32900 Teredo_bubble_with_payload - F bro
|
||||||
|
#end 2012-06-19-17-39-37
|
||||||
|
|
|
@ -3,8 +3,10 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path conn
|
#path conn
|
||||||
|
#start 2005-10-07-23-23-55
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||||
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
||||||
952109346.874907 UWkUyAuUGXf 10.1.2.1 11001 10.34.0.1 23 tcp - 2.102560 26 0 SH - 0 SADF 11 470 0 0 (empty)
|
952109346.874907 UWkUyAuUGXf 10.1.2.1 11001 10.34.0.1 23 tcp - 2.102560 26 0 SH - 0 SADF 11 470 0 0 (empty)
|
||||||
1128727435.450898 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - 0 ShADdFaf 12 730 10 9945 (empty)
|
1128727435.450898 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - 0 ShADdFaf 12 730 10 9945 (empty)
|
||||||
1278600802.069419 k6kgXLOoSKl 10.20.80.1 50343 10.0.0.15 80 tcp - 0.004152 9 3429 SF - 0 ShADadfF 7 381 7 3801 (empty)
|
1278600802.069419 k6kgXLOoSKl 10.20.80.1 50343 10.0.0.15 80 tcp - 0.004152 9 3429 SF - 0 ShADadfF 7 381 7 3801 (empty)
|
||||||
|
#end 2010-07-08-14-53-22
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path loaded_scripts
|
#path loaded_scripts
|
||||||
|
#start 2012-07-20-01-49-31
|
||||||
#fields name
|
#fields name
|
||||||
#types string
|
#types string
|
||||||
scripts/base/init-bare.bro
|
scripts/base/init-bare.bro
|
||||||
|
@ -28,3 +29,4 @@ scripts/base/init-bare.bro
|
||||||
scripts/base/frameworks/input/./readers/raw.bro
|
scripts/base/frameworks/input/./readers/raw.bro
|
||||||
scripts/base/frameworks/input/./readers/benchmark.bro
|
scripts/base/frameworks/input/./readers/benchmark.bro
|
||||||
scripts/policy/misc/loaded-scripts.bro
|
scripts/policy/misc/loaded-scripts.bro
|
||||||
|
#end 2012-07-20-01-49-31
|
||||||
|
|
|
@ -1,5 +1,5 @@
|
||||||
1 /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 13 print cover me;
|
1 /da/home/robin/bro/master/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 13 print cover me;
|
||||||
1 /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 17 print always executed;
|
1 /da/home/robin/bro/master/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 17 print always executed;
|
||||||
0 /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 26 print also impossible, but included in code coverage analysis;
|
0 /da/home/robin/bro/master/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 26 print also impossible, but included in code coverage analysis;
|
||||||
1 /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 29 print success;
|
1 /da/home/robin/bro/master/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 29 print success;
|
||||||
1 /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 5 print first;
|
1 /da/home/robin/bro/master/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 5 print first;
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path loaded_scripts
|
#path loaded_scripts
|
||||||
|
#start 2012-07-20-01-49-33
|
||||||
#fields name
|
#fields name
|
||||||
#types string
|
#types string
|
||||||
scripts/base/init-bare.bro
|
scripts/base/init-bare.bro
|
||||||
|
@ -108,3 +109,4 @@ scripts/base/init-default.bro
|
||||||
scripts/base/protocols/syslog/./consts.bro
|
scripts/base/protocols/syslog/./consts.bro
|
||||||
scripts/base/protocols/syslog/./main.bro
|
scripts/base/protocols/syslog/./main.bro
|
||||||
scripts/policy/misc/loaded-scripts.bro
|
scripts/policy/misc/loaded-scripts.bro
|
||||||
|
#end 2012-07-20-01-49-33
|
||||||
|
|
|
@ -1,3 +1,3 @@
|
||||||
ping received, seq 0, 1324314397.698781 at src, 1324314397.699240 at dest,
|
ping received, seq 0, 1342749173.594568 at src, 1342749173.637317 at dest,
|
||||||
ping received, seq 1, 1324314398.698905 at src, 1324314398.699094 at dest,
|
ping received, seq 1, 1342749174.594948 at src, 1342749174.596551 at dest,
|
||||||
ping received, seq 2, 1324314399.699012 at src, 1324314399.699231 at dest,
|
ping received, seq 2, 1342749175.595486 at src, 1342749175.596581 at dest,
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path http
|
#path http
|
||||||
|
#start 2012-07-20-01-53-03
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
1336588614.060989 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
|
1342749182.906082 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
|
||||||
|
#end 2012-07-20-01-53-04
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path http
|
#path http
|
||||||
|
#start 2012-07-20-01-53-03
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
1336588614.060989 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
|
1342749182.906082 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
|
||||||
|
#end 2012-07-20-01-53-04
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path http
|
#path http
|
||||||
|
#start 2012-07-20-01-53-12
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
1336587178.164598 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
|
1342749191.765740 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
|
||||||
|
#end 2012-07-20-01-53-13
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path http
|
#path http
|
||||||
|
#start 2012-07-20-01-53-12
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
1336587178.164598 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
|
1342749191.765740 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
|
||||||
|
#end 2012-07-20-01-53-13
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
==== atomic
|
==== atomic
|
||||||
-10
|
-10
|
||||||
2
|
2
|
||||||
1336411585.166009
|
1342749196.619505
|
||||||
2.0 mins
|
2.0 mins
|
||||||
F
|
F
|
||||||
1.5
|
1.5
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
==== atomic a 1 ====
|
==== atomic a 1 ====
|
||||||
-4L -4
|
-4L -4
|
||||||
42 42
|
42 42
|
||||||
1336411585.1711
|
1342749196.6624
|
||||||
60.0
|
60.0
|
||||||
True True
|
True True
|
||||||
3.14
|
3.14
|
||||||
|
@ -14,7 +14,7 @@ True True
|
||||||
==== atomic a 2 ====
|
==== atomic a 2 ====
|
||||||
-10L -10
|
-10L -10
|
||||||
2 2
|
2 2
|
||||||
1336411585.1660
|
1342749196.6195
|
||||||
120.0
|
120.0
|
||||||
False False
|
False False
|
||||||
1.5
|
1.5
|
||||||
|
@ -27,7 +27,7 @@ False False
|
||||||
==== atomic b 2 ====
|
==== atomic b 2 ====
|
||||||
-10L -10
|
-10L -10
|
||||||
<broccoli.count instance at > 2
|
<broccoli.count instance at > 2
|
||||||
<broccoli.time instance at > 1336411585.1660
|
<broccoli.time instance at > 1342749196.6195
|
||||||
<broccoli.interval instance at > 120.0
|
<broccoli.interval instance at > 120.0
|
||||||
False False
|
False False
|
||||||
1.5
|
1.5
|
||||||
|
|
|
@ -1 +1 @@
|
||||||
error in /Users/robin/bro/master/testing/btest/.tmp/language.wrong-delete-field/wrong-delete-field.bro, line 10: illegal delete statement (delete x$a)
|
error in /da/home/robin/bro/master/testing/btest/.tmp/language.wrong-delete-field/wrong-delete-field.bro, line 10: illegal delete statement (delete x$a)
|
||||||
|
|
|
@ -3,20 +3,22 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path communication
|
#path communication
|
||||||
|
#start 2012-07-20-01-49-40
|
||||||
#fields ts peer src_name connected_peer_desc connected_peer_addr connected_peer_port level message
|
#fields ts peer src_name connected_peer_desc connected_peer_addr connected_peer_port level message
|
||||||
#types time string string string addr port string string
|
#types time string string string addr port string string
|
||||||
1340904724.781527 bro parent - - - info [#1/127.0.0.1:47757] added peer
|
1342748980.737451 bro parent - - - info [#1/127.0.0.1:47757] added peer
|
||||||
1340904724.784954 bro child - - - info [#1/127.0.0.1:47757] connected
|
1342748980.747149 bro child - - - info [#1/127.0.0.1:47757] connected
|
||||||
1340904724.786168 bro parent - - - info [#1/127.0.0.1:47757] peer connected
|
1342748980.748489 bro parent - - - info [#1/127.0.0.1:47757] peer connected
|
||||||
1340904724.786168 bro parent - - - info [#1/127.0.0.1:47757] phase: version
|
1342748980.748489 bro parent - - - info [#1/127.0.0.1:47757] phase: version
|
||||||
1340904724.786168 bro script - - - info connection established
|
1342748980.750749 bro script - - - info connection established
|
||||||
1340904724.786168 bro script - - - info requesting events matching /^?(NOTHING)$?/
|
1342748980.750749 bro script - - - info requesting events matching /^?(NOTHING)$?/
|
||||||
1340904724.786168 bro script - - - info accepting state
|
1342748980.750749 bro script - - - info accepting state
|
||||||
1340904724.787645 bro parent - - - info [#1/127.0.0.1:47757] phase: handshake
|
1342748980.752225 bro parent - - - info [#1/127.0.0.1:47757] phase: handshake
|
||||||
1340904724.787645 bro parent - - - info warning: no events to request
|
1342748980.752225 bro parent - - - info warning: no events to request
|
||||||
1340904724.788857 bro parent - - - info [#1/127.0.0.1:47757] peer_description is bro
|
1342748980.753384 bro parent - - - info [#1/127.0.0.1:47757] peer_description is bro
|
||||||
1340904724.829480 bro parent - - - info [#1/127.0.0.1:47757] peer supports keep-in-cache; using that
|
1342748980.793108 bro parent - - - info [#1/127.0.0.1:47757] peer supports keep-in-cache; using that
|
||||||
1340904724.829480 bro parent - - - info [#1/127.0.0.1:47757] phase: running
|
1342748980.793108 bro parent - - - info [#1/127.0.0.1:47757] phase: running
|
||||||
1340904724.829480 bro parent - - - info terminating...
|
1342748980.793108 bro parent - - - info terminating...
|
||||||
1340904724.832952 bro child - - - info terminating
|
1342748980.796454 bro child - - - info terminating
|
||||||
1340904724.834082 bro parent - - - info [#1/127.0.0.1:47757] closing connection
|
1342748980.797536 bro parent - - - info [#1/127.0.0.1:47757] closing connection
|
||||||
|
#end 2012-07-20-01-49-40
|
||||||
|
|
|
@ -3,7 +3,9 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh-new-default
|
#path ssh-new-default
|
||||||
|
#start 2012-07-20-01-49-19
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314313.140603 1.2.3.4 1234 2.3.4.5 80 success unknown
|
1342748959.430282 1.2.3.4 1234 2.3.4.5 80 success unknown
|
||||||
1324314313.140603 1.2.3.4 1234 2.3.4.5 80 failure US
|
1342748959.430282 1.2.3.4 1234 2.3.4.5 80 failure US
|
||||||
|
#end 2012-07-20-01-49-19
|
||||||
|
|
|
@ -3,8 +3,10 @@
|
||||||
#empty_field|(empty)
|
#empty_field|(empty)
|
||||||
#unset_field|-
|
#unset_field|-
|
||||||
#path|ssh
|
#path|ssh
|
||||||
|
#start|2012-07-20-01-49-19
|
||||||
#fields|data|data2
|
#fields|data|data2
|
||||||
#types|string|string
|
#types|string|string
|
||||||
abc\x0a\xffdef|DATA2
|
abc\x0a\xffdef|DATA2
|
||||||
abc\x7c\xffdef|DATA2
|
abc\x7c\xffdef|DATA2
|
||||||
abc\xff\x7cdef|DATA2
|
abc\xff\x7cdef|DATA2
|
||||||
|
#end|2012-07-20-01-49-19
|
||||||
|
|
|
@ -5,8 +5,8 @@ PREFIX<>unset_field|NOT-SET
|
||||||
PREFIX<>path|ssh
|
PREFIX<>path|ssh
|
||||||
PREFIX<>fields|t|id.orig_h|id.orig_p|id.resp_h|id.resp_p|status|country|b
|
PREFIX<>fields|t|id.orig_h|id.orig_p|id.resp_h|id.resp_p|status|country|b
|
||||||
PREFIX<>types|time|addr|port|addr|port|string|string|bool
|
PREFIX<>types|time|addr|port|addr|port|string|string|bool
|
||||||
1342126762.852986|1.2.3.4|1234|2.3.4.5|80|success|unknown|NOT-SET
|
1342748959.659721|1.2.3.4|1234|2.3.4.5|80|success|unknown|NOT-SET
|
||||||
1342126762.852986|1.2.3.4|1234|2.3.4.5|80|NOT-SET|US|NOT-SET
|
1342748959.659721|1.2.3.4|1234|2.3.4.5|80|NOT-SET|US|NOT-SET
|
||||||
1342126762.852986|1.2.3.4|1234|2.3.4.5|80|failure|UK|NOT-SET
|
1342748959.659721|1.2.3.4|1234|2.3.4.5|80|failure|UK|NOT-SET
|
||||||
1342126762.852986|1.2.3.4|1234|2.3.4.5|80|NOT-SET|BR|NOT-SET
|
1342748959.659721|1.2.3.4|1234|2.3.4.5|80|NOT-SET|BR|NOT-SET
|
||||||
1342126762.852986|1.2.3.4|1234|2.3.4.5|80|failure|EMPTY|T
|
1342748959.659721|1.2.3.4|1234|2.3.4.5|80|failure|EMPTY|T
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2012-07-20-01-49-19
|
||||||
#fields x y z
|
#fields x y z
|
||||||
#types string string string
|
#types string string string
|
||||||
\x2d - (empty)
|
\x2d - (empty)
|
||||||
|
#end 2012-07-20-01-49-19
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path http
|
#path http
|
||||||
|
#start 2011-09-12-03-57-36
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
1315799856.264750 UWkUyAuUGXf 10.0.1.104 64216 193.40.5.162 80 1 GET lepo.it.da.ut.ee /~cect/teoreetilised seminarid_2010/arheoloogia_uurimisr\xfchma_seminar/Joyce et al - The Languages of Archaeology ~ Dialogue, Narrative and Writing.pdf - Wget/1.12 (darwin10.8.0) 0 346 404 Not Found - - - (empty) - - - text/html - -
|
1315799856.264750 UWkUyAuUGXf 10.0.1.104 64216 193.40.5.162 80 1 GET lepo.it.da.ut.ee /~cect/teoreetilised seminarid_2010/arheoloogia_uurimisr\xfchma_seminar/Joyce et al - The Languages of Archaeology ~ Dialogue, Narrative and Writing.pdf - Wget/1.12 (darwin10.8.0) 0 346 404 Not Found - - - (empty) - - - text/html - -
|
||||||
|
#end 2011-09-12-03-57-37
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2012-07-20-01-49-19
|
||||||
#fields ss
|
#fields ss
|
||||||
#types table[string]
|
#types table[string]
|
||||||
CC,AA,\x2c,\x2c\x2c
|
CC,AA,\x2c,\x2c\x2c
|
||||||
|
#end 2012-07-20-01-49-19
|
||||||
|
|
|
@ -5,8 +5,8 @@
|
||||||
#path||ssh
|
#path||ssh
|
||||||
#fields||t||id.orig_h||id.orig_p||id.resp_h||id.resp_p||status||country
|
#fields||t||id.orig_h||id.orig_p||id.resp_h||id.resp_p||status||country
|
||||||
#types||time||addr||port||addr||port||string||string
|
#types||time||addr||port||addr||port||string||string
|
||||||
1324314313.899736||1.2.3.4||1234||2.3.4.5||80||success||unknown
|
1342759749.586006||1.2.3.4||1234||2.3.4.5||80||success||unknown
|
||||||
1324314313.899736||1.2.3.4||1234||2.3.4.5||80||failure||US
|
1342759749.586006||1.2.3.4||1234||2.3.4.5||80||failure||US
|
||||||
1324314313.899736||1.2.3.4||1234||2.3.4.5||80||fa\x7c\x7cure||UK
|
1342759749.586006||1.2.3.4||1234||2.3.4.5||80||fa\x7c\x7cure||UK
|
||||||
1324314313.899736||1.2.3.4||1234||2.3.4.5||80||su\x7c\x7cess||BR
|
1342759749.586006||1.2.3.4||1234||2.3.4.5||80||su\x7c\x7cess||BR
|
||||||
1324314313.899736||1.2.3.4||1234||2.3.4.5||80||failure||MX
|
1342759749.586006||1.2.3.4||1234||2.3.4.5||80||failure||MX
|
||||||
|
|
|
@ -3,10 +3,10 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
#start 2012-07-12-21-00-27
|
#start 2012-07-20-01-49-22
|
||||||
#fields data c
|
#fields data c
|
||||||
#types string count
|
#types string count
|
||||||
Test1 42
|
Test1 42
|
||||||
\x23Kaputt 42
|
\x23Kaputt 42
|
||||||
Test2 42
|
Test2 42
|
||||||
#end 2012-07-12-21-00-27
|
#end 2012-07-20-01-49-22
|
||||||
|
|
|
@ -1,5 +1,5 @@
|
||||||
1324314313.990741|1.2.3.4|1234|2.3.4.5|80|success|unknown
|
1342748960.098729|1.2.3.4|1234|2.3.4.5|80|success|unknown
|
||||||
1324314313.990741|1.2.3.4|1234|2.3.4.5|80|failure|US
|
1342748960.098729|1.2.3.4|1234|2.3.4.5|80|failure|US
|
||||||
1324314313.990741|1.2.3.4|1234|2.3.4.5|80|failure|UK
|
1342748960.098729|1.2.3.4|1234|2.3.4.5|80|failure|UK
|
||||||
1324314313.990741|1.2.3.4|1234|2.3.4.5|80|success|BR
|
1342748960.098729|1.2.3.4|1234|2.3.4.5|80|success|BR
|
||||||
1324314313.990741|1.2.3.4|1234|2.3.4.5|80|failure|MX
|
1342748960.098729|1.2.3.4|1234|2.3.4.5|80|failure|MX
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2012-07-20-01-49-20
|
||||||
#fields data
|
#fields data
|
||||||
#types time
|
#types time
|
||||||
1234567890.000000
|
1234567890.000000
|
||||||
|
@ -13,3 +14,4 @@
|
||||||
1234567890.000010
|
1234567890.000010
|
||||||
1234567890.000001
|
1234567890.000001
|
||||||
1234567890.000000
|
1234567890.000000
|
||||||
|
#end 2012-07-20-01-49-20
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh
|
#path ssh
|
||||||
|
#start 2012-07-20-01-49-20
|
||||||
#fields status country a1 b1 b2
|
#fields status country a1 b1 b2
|
||||||
#types string string count count count
|
#types string string count count count
|
||||||
success unknown 1 3 4
|
success unknown 1 3 4
|
||||||
|
#end 2012-07-20-01-49-20
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh
|
#path ssh
|
||||||
|
#start 2012-07-20-01-49-20
|
||||||
#fields status country
|
#fields status country
|
||||||
#types string string
|
#types string string
|
||||||
success unknown
|
success unknown
|
||||||
|
@ -10,3 +11,4 @@ failure US
|
||||||
failure UK
|
failure UK
|
||||||
success BR
|
success BR
|
||||||
failure MX
|
failure MX
|
||||||
|
#end 2012-07-20-01-49-20
|
||||||
|
|
|
@ -27,8 +27,8 @@
|
||||||
|
|
||||||
# Extent, type='ssh'
|
# Extent, type='ssh'
|
||||||
t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
1337216256.956476 1.2.3.4 1234 2.3.4.5 80 success unknown
|
1342748962.493341 1.2.3.4 1234 2.3.4.5 80 success unknown
|
||||||
1337216256.956476 1.2.3.4 1234 2.3.4.5 80 failure US
|
1342748962.493341 1.2.3.4 1234 2.3.4.5 80 failure US
|
||||||
1337216256.956476 1.2.3.4 1234 2.3.4.5 80 failure UK
|
1342748962.493341 1.2.3.4 1234 2.3.4.5 80 failure UK
|
||||||
1337216256.956476 1.2.3.4 1234 2.3.4.5 80 success BR
|
1342748962.493341 1.2.3.4 1234 2.3.4.5 80 success BR
|
||||||
1337216256.956476 1.2.3.4 1234 2.3.4.5 80 failure MX
|
1342748962.493341 1.2.3.4 1234 2.3.4.5 80 failure MX
|
||||||
|
|
|
@ -3,10 +3,12 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh
|
#path ssh
|
||||||
|
#start 2012-07-20-01-49-20
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314314.443785 1.2.3.4 1234 2.3.4.5 80 success unknown
|
1342748960.468458 1.2.3.4 1234 2.3.4.5 80 success unknown
|
||||||
1324314314.443785 1.2.3.4 1234 2.3.4.5 80 failure US
|
1342748960.468458 1.2.3.4 1234 2.3.4.5 80 failure US
|
||||||
1324314314.443785 1.2.3.4 1234 2.3.4.5 80 failure UK
|
1342748960.468458 1.2.3.4 1234 2.3.4.5 80 failure UK
|
||||||
1324314314.443785 1.2.3.4 1234 2.3.4.5 80 success BR
|
1342748960.468458 1.2.3.4 1234 2.3.4.5 80 success BR
|
||||||
1324314314.443785 1.2.3.4 1234 2.3.4.5 80 failure MX
|
1342748960.468458 1.2.3.4 1234 2.3.4.5 80 failure MX
|
||||||
|
#end 2012-07-20-01-49-20
|
||||||
|
|
|
@ -1,2 +1,2 @@
|
||||||
[t=1324314314.738385, id=[orig_h=1.2.3.4, orig_p=1234/tcp, resp_h=2.3.4.5, resp_p=80/tcp], status=success, country=unknown]
|
[t=1342748960.593451, id=[orig_h=1.2.3.4, orig_p=1234/tcp, resp_h=2.3.4.5, resp_p=80/tcp], status=success, country=unknown]
|
||||||
[t=1324314314.738385, id=[orig_h=1.2.3.4, orig_p=1234/tcp, resp_h=2.3.4.5, resp_p=80/tcp], status=failure, country=US]
|
[t=1342748960.593451, id=[orig_h=1.2.3.4, orig_p=1234/tcp, resp_h=2.3.4.5, resp_p=80/tcp], status=failure, country=US]
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh
|
#path ssh
|
||||||
|
#start 2012-07-20-01-49-20
|
||||||
#fields id.orig_p id.resp_h id.resp_p status country
|
#fields id.orig_p id.resp_h id.resp_p status country
|
||||||
#types port addr port string string
|
#types port addr port string string
|
||||||
1234 2.3.4.5 80 success unknown
|
1234 2.3.4.5 80 success unknown
|
||||||
|
@ -10,3 +11,4 @@
|
||||||
1234 2.3.4.5 80 failure UK
|
1234 2.3.4.5 80 failure UK
|
||||||
1234 2.3.4.5 80 success BR
|
1234 2.3.4.5 80 success BR
|
||||||
1234 2.3.4.5 80 failure MX
|
1234 2.3.4.5 80 failure MX
|
||||||
|
#end 2012-07-20-01-49-20
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh
|
#path ssh
|
||||||
|
#start 2012-07-20-01-49-20
|
||||||
#fields t f
|
#fields t f
|
||||||
#types time file
|
#types time file
|
||||||
1324314314.940195 Foo.log
|
1342748960.757056 Foo.log
|
||||||
|
#end 2012-07-20-01-49-20
|
||||||
|
|
|
@ -3,10 +3,12 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh
|
#path ssh
|
||||||
|
#start 2012-07-20-01-49-20
|
||||||
#fields t id.orig_h
|
#fields t id.orig_h
|
||||||
#types time addr
|
#types time addr
|
||||||
1324314315.040480 1.2.3.4
|
1342748960.796093 1.2.3.4
|
||||||
1324314315.040480 1.2.3.4
|
1342748960.796093 1.2.3.4
|
||||||
1324314315.040480 1.2.3.4
|
1342748960.796093 1.2.3.4
|
||||||
1324314315.040480 1.2.3.4
|
1342748960.796093 1.2.3.4
|
||||||
1324314315.040480 1.2.3.4
|
1342748960.796093 1.2.3.4
|
||||||
|
#end 2012-07-20-01-49-20
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path local
|
#path local
|
||||||
|
#start 2011-03-18-19-06-13
|
||||||
#fields ts id.orig_h
|
#fields ts id.orig_h
|
||||||
#types time addr
|
#types time addr
|
||||||
1300475168.859163 141.142.220.118
|
1300475168.859163 141.142.220.118
|
||||||
|
@ -35,3 +36,4 @@
|
||||||
1300475168.902195 141.142.220.118
|
1300475168.902195 141.142.220.118
|
||||||
1300475168.894787 141.142.220.118
|
1300475168.894787 141.142.220.118
|
||||||
1300475168.901749 141.142.220.118
|
1300475168.901749 141.142.220.118
|
||||||
|
#end 2011-03-18-19-06-13
|
||||||
|
|
|
@ -3,9 +3,11 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path remote
|
#path remote
|
||||||
|
#start 2011-03-18-19-06-13
|
||||||
#fields ts id.orig_h
|
#fields ts id.orig_h
|
||||||
#types time addr
|
#types time addr
|
||||||
1300475169.780331 173.192.163.128
|
1300475169.780331 173.192.163.128
|
||||||
1300475167.097012 fe80::217:f2ff:fed7:cf65
|
1300475167.097012 fe80::217:f2ff:fed7:cf65
|
||||||
1300475171.675372 fe80::3074:17d5:2052:c324
|
1300475171.675372 fe80::3074:17d5:2052:c324
|
||||||
1300475173.116749 fe80::3074:17d5:2052:c324
|
1300475173.116749 fe80::3074:17d5:2052:c324
|
||||||
|
#end 2011-03-18-19-06-13
|
||||||
|
|
|
@ -10,54 +10,68 @@ static-prefix-2-UK.log
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path static-prefix-0-BR
|
#path static-prefix-0-BR
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 success BR
|
1342748961.180156 1.2.3.4 1234 2.3.4.5 80 success BR
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path static-prefix-0-MX3
|
#path static-prefix-0-MX3
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 failure MX3
|
1342748961.180156 1.2.3.4 1234 2.3.4.5 80 failure MX3
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path static-prefix-0-unknown
|
#path static-prefix-0-unknown
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 success unknown
|
1342748961.180156 1.2.3.4 1234 2.3.4.5 80 success unknown
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path static-prefix-1-MX
|
#path static-prefix-1-MX
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 failure MX
|
1342748961.180156 1.2.3.4 1234 2.3.4.5 80 failure MX
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path static-prefix-1-US
|
#path static-prefix-1-US
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 failure US
|
1342748961.180156 1.2.3.4 1234 2.3.4.5 80 failure US
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path static-prefix-2-MX2
|
#path static-prefix-2-MX2
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 failure MX2
|
1342748961.180156 1.2.3.4 1234 2.3.4.5 80 failure MX2
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path static-prefix-2-UK
|
#path static-prefix-2-UK
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 failure UK
|
1342748961.180156 1.2.3.4 1234 2.3.4.5 80 failure UK
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test.failure
|
#path test.failure
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314315.498365 1.2.3.4 1234 2.3.4.5 80 failure US
|
1342748961.488370 1.2.3.4 1234 2.3.4.5 80 failure US
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test.success
|
#path test.success
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314315.498365 1.2.3.4 1234 2.3.4.5 80 success unknown
|
1342748961.488370 1.2.3.4 1234 2.3.4.5 80 success unknown
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field EMPTY
|
#empty_field EMPTY
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 1970-01-01-00-00-00
|
||||||
#fields b i e c p sn a d t iv s sc ss se vc ve
|
#fields b i e c p sn a d t iv s sc ss se vc ve
|
||||||
#types bool int enum count port subnet addr double time interval string table[count] table[string] table[string] vector[count] vector[string]
|
#types bool int enum count port subnet addr double time interval string table[count] table[string] table[string] vector[count] vector[string]
|
||||||
T -42 Test::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1324314315.880694 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY
|
T -42 Test::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1342749004.579242 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY
|
||||||
|
#end 2012-07-20-01-50-05
|
||||||
|
|
|
@ -3,8 +3,10 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test.failure
|
#path test.failure
|
||||||
|
#start 2012-07-20-01-50-18
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure US
|
1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure US
|
||||||
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure UK
|
1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure UK
|
||||||
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure MX
|
1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure MX
|
||||||
|
#end 2012-07-20-01-50-18
|
||||||
|
|
|
@ -3,10 +3,12 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2012-07-20-01-50-18
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 success unknown
|
1342749018.970682 1.2.3.4 1234 2.3.4.5 80 success unknown
|
||||||
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure US
|
1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure US
|
||||||
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure UK
|
1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure UK
|
||||||
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 success BR
|
1342749018.970682 1.2.3.4 1234 2.3.4.5 80 success BR
|
||||||
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure MX
|
1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure MX
|
||||||
|
#end 2012-07-20-01-50-18
|
||||||
|
|
|
@ -3,7 +3,9 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test.success
|
#path test.success
|
||||||
|
#start 2012-07-20-01-50-18
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 success unknown
|
1342749018.970682 1.2.3.4 1234 2.3.4.5 80 success unknown
|
||||||
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 success BR
|
1342749018.970682 1.2.3.4 1234 2.3.4.5 80 success BR
|
||||||
|
#end 2012-07-20-01-50-18
|
||||||
|
|
|
@ -3,7 +3,9 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh.failure
|
#path ssh.failure
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314328.196443 1.2.3.4 1234 2.3.4.5 80 failure US
|
1342748961.521536 1.2.3.4 1234 2.3.4.5 80 failure US
|
||||||
1324314328.196443 1.2.3.4 1234 2.3.4.5 80 failure UK
|
1342748961.521536 1.2.3.4 1234 2.3.4.5 80 failure UK
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
|
|
|
@ -3,8 +3,10 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh
|
#path ssh
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314328.196443 1.2.3.4 1234 2.3.4.5 80 failure US
|
1342748961.521536 1.2.3.4 1234 2.3.4.5 80 failure US
|
||||||
1324314328.196443 1.2.3.4 1234 2.3.4.5 80 failure UK
|
1342748961.521536 1.2.3.4 1234 2.3.4.5 80 failure UK
|
||||||
1324314328.196443 1.2.3.4 1234 2.3.4.5 80 failure BR
|
1342748961.521536 1.2.3.4 1234 2.3.4.5 80 failure BR
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
|
|
|
@ -19,11 +19,31 @@ custom rotate, [writer=Log::WRITER_ASCII, fname=test2-11-03-07_11.59.55.log, pat
|
||||||
custom rotate, [writer=Log::WRITER_ASCII, fname=test2-11-03-07_12.00.05.log, path=test2, open=1299499205.0, close=1299502795.0, terminating=F]
|
custom rotate, [writer=Log::WRITER_ASCII, fname=test2-11-03-07_12.00.05.log, path=test2, open=1299499205.0, close=1299502795.0, terminating=F]
|
||||||
custom rotate, [writer=Log::WRITER_ASCII, fname=test2-11-03-07_12.59.55.log, path=test2, open=1299502795.0, close=1299502795.0, terminating=T]
|
custom rotate, [writer=Log::WRITER_ASCII, fname=test2-11-03-07_12.59.55.log, path=test2, open=1299502795.0, close=1299502795.0, terminating=T]
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
|
#end 2011-03-07-03-59-55
|
||||||
|
#end 2011-03-07-04-00-05
|
||||||
|
#end 2011-03-07-04-59-55
|
||||||
|
#end 2011-03-07-05-00-05
|
||||||
|
#end 2011-03-07-05-59-55
|
||||||
|
#end 2011-03-07-06-00-05
|
||||||
|
#end 2011-03-07-06-59-55
|
||||||
|
#end 2011-03-07-07-00-05
|
||||||
|
#end 2011-03-07-07-59-55
|
||||||
|
#end 2011-03-07-08-00-05
|
||||||
|
#end 2011-03-07-08-59-55
|
||||||
|
#end 2011-03-07-09-00-05
|
||||||
|
#end 2011-03-07-09-59-55
|
||||||
|
#end 2011-03-07-10-00-05
|
||||||
|
#end 2011-03-07-10-59-55
|
||||||
|
#end 2011-03-07-11-00-05
|
||||||
|
#end 2011-03-07-11-59-55
|
||||||
|
#end 2011-03-07-12-00-05
|
||||||
|
#end 2011-03-07-12-59-55
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
#path test
|
#path test
|
||||||
#path test2
|
#path test2
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
|
#start 2011-03-07-03-00-05
|
||||||
#types time addr port addr port
|
#types time addr port addr port
|
||||||
#unset_field -
|
#unset_field -
|
||||||
1299466805.000000 10.0.0.1 20 10.0.0.2 1024
|
1299466805.000000 10.0.0.1 20 10.0.0.2 1024
|
||||||
|
|
|
@ -14,97 +14,117 @@ test.2011-03-07-12-00-05.log test 11-03-07_12.00.05 11-03-07_12.59.55 1 ascii
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2011-03-07-03-00-05
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
#types time addr port addr port
|
#types time addr port addr port
|
||||||
1299466805.000000 10.0.0.1 20 10.0.0.2 1024
|
1299466805.000000 10.0.0.1 20 10.0.0.2 1024
|
||||||
1299470395.000000 10.0.0.2 20 10.0.0.3 0
|
1299470395.000000 10.0.0.2 20 10.0.0.3 0
|
||||||
|
#end 2011-03-07-04-00-05
|
||||||
> test.2011-03-07-04-00-05.log
|
> test.2011-03-07-04-00-05.log
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2011-03-07-03-00-05
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
#types time addr port addr port
|
#types time addr port addr port
|
||||||
1299470405.000000 10.0.0.1 20 10.0.0.2 1025
|
1299470405.000000 10.0.0.1 20 10.0.0.2 1025
|
||||||
1299473995.000000 10.0.0.2 20 10.0.0.3 1
|
1299473995.000000 10.0.0.2 20 10.0.0.3 1
|
||||||
|
#end 2011-03-07-05-00-05
|
||||||
> test.2011-03-07-05-00-05.log
|
> test.2011-03-07-05-00-05.log
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2011-03-07-03-00-05
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
#types time addr port addr port
|
#types time addr port addr port
|
||||||
1299474005.000000 10.0.0.1 20 10.0.0.2 1026
|
1299474005.000000 10.0.0.1 20 10.0.0.2 1026
|
||||||
1299477595.000000 10.0.0.2 20 10.0.0.3 2
|
1299477595.000000 10.0.0.2 20 10.0.0.3 2
|
||||||
|
#end 2011-03-07-06-00-05
|
||||||
> test.2011-03-07-06-00-05.log
|
> test.2011-03-07-06-00-05.log
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2011-03-07-03-00-05
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
#types time addr port addr port
|
#types time addr port addr port
|
||||||
1299477605.000000 10.0.0.1 20 10.0.0.2 1027
|
1299477605.000000 10.0.0.1 20 10.0.0.2 1027
|
||||||
1299481195.000000 10.0.0.2 20 10.0.0.3 3
|
1299481195.000000 10.0.0.2 20 10.0.0.3 3
|
||||||
|
#end 2011-03-07-07-00-05
|
||||||
> test.2011-03-07-07-00-05.log
|
> test.2011-03-07-07-00-05.log
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2011-03-07-03-00-05
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
#types time addr port addr port
|
#types time addr port addr port
|
||||||
1299481205.000000 10.0.0.1 20 10.0.0.2 1028
|
1299481205.000000 10.0.0.1 20 10.0.0.2 1028
|
||||||
1299484795.000000 10.0.0.2 20 10.0.0.3 4
|
1299484795.000000 10.0.0.2 20 10.0.0.3 4
|
||||||
|
#end 2011-03-07-08-00-05
|
||||||
> test.2011-03-07-08-00-05.log
|
> test.2011-03-07-08-00-05.log
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2011-03-07-03-00-05
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
#types time addr port addr port
|
#types time addr port addr port
|
||||||
1299484805.000000 10.0.0.1 20 10.0.0.2 1029
|
1299484805.000000 10.0.0.1 20 10.0.0.2 1029
|
||||||
1299488395.000000 10.0.0.2 20 10.0.0.3 5
|
1299488395.000000 10.0.0.2 20 10.0.0.3 5
|
||||||
|
#end 2011-03-07-09-00-05
|
||||||
> test.2011-03-07-09-00-05.log
|
> test.2011-03-07-09-00-05.log
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2011-03-07-03-00-05
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
#types time addr port addr port
|
#types time addr port addr port
|
||||||
1299488405.000000 10.0.0.1 20 10.0.0.2 1030
|
1299488405.000000 10.0.0.1 20 10.0.0.2 1030
|
||||||
1299491995.000000 10.0.0.2 20 10.0.0.3 6
|
1299491995.000000 10.0.0.2 20 10.0.0.3 6
|
||||||
|
#end 2011-03-07-10-00-05
|
||||||
> test.2011-03-07-10-00-05.log
|
> test.2011-03-07-10-00-05.log
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2011-03-07-03-00-05
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
#types time addr port addr port
|
#types time addr port addr port
|
||||||
1299492005.000000 10.0.0.1 20 10.0.0.2 1031
|
1299492005.000000 10.0.0.1 20 10.0.0.2 1031
|
||||||
1299495595.000000 10.0.0.2 20 10.0.0.3 7
|
1299495595.000000 10.0.0.2 20 10.0.0.3 7
|
||||||
|
#end 2011-03-07-11-00-05
|
||||||
> test.2011-03-07-11-00-05.log
|
> test.2011-03-07-11-00-05.log
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2011-03-07-03-00-05
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
#types time addr port addr port
|
#types time addr port addr port
|
||||||
1299495605.000000 10.0.0.1 20 10.0.0.2 1032
|
1299495605.000000 10.0.0.1 20 10.0.0.2 1032
|
||||||
1299499195.000000 10.0.0.2 20 10.0.0.3 8
|
1299499195.000000 10.0.0.2 20 10.0.0.3 8
|
||||||
|
#end 2011-03-07-12-00-05
|
||||||
> test.2011-03-07-12-00-05.log
|
> test.2011-03-07-12-00-05.log
|
||||||
#separator \x09
|
#separator \x09
|
||||||
#set_separator ,
|
#set_separator ,
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path test
|
#path test
|
||||||
|
#start 2011-03-07-03-00-05
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
#types time addr port addr port
|
#types time addr port addr port
|
||||||
1299499205.000000 10.0.0.1 20 10.0.0.2 1033
|
1299499205.000000 10.0.0.1 20 10.0.0.2 1033
|
||||||
1299502795.000000 10.0.0.2 20 10.0.0.3 9
|
1299502795.000000 10.0.0.2 20 10.0.0.3 9
|
||||||
|
#end 2011-03-07-12-59-55
|
||||||
|
|
|
@ -3,10 +3,12 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path /dev/stdout
|
#path /dev/stdout
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314328.844271 1.2.3.4 1234 2.3.4.5 80 success unknown
|
1342748961.732599 1.2.3.4 1234 2.3.4.5 80 success unknown
|
||||||
1324314328.844271 1.2.3.4 1234 2.3.4.5 80 failure US
|
1342748961.732599 1.2.3.4 1234 2.3.4.5 80 failure US
|
||||||
1324314328.844271 1.2.3.4 1234 2.3.4.5 80 failure UK
|
1342748961.732599 1.2.3.4 1234 2.3.4.5 80 failure UK
|
||||||
1324314328.844271 1.2.3.4 1234 2.3.4.5 80 success BR
|
1342748961.732599 1.2.3.4 1234 2.3.4.5 80 success BR
|
||||||
1324314328.844271 1.2.3.4 1234 2.3.4.5 80 failure MX
|
1342748961.732599 1.2.3.4 1234 2.3.4.5 80 failure MX
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
|
|
|
@ -3,10 +3,12 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh
|
#path ssh
|
||||||
|
#start 2012-07-20-01-49-21
|
||||||
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
|
||||||
#types time addr port addr port string string
|
#types time addr port addr port string string
|
||||||
1324314328.950525 1.2.3.4 1234 2.3.4.5 80 success unknown
|
1342748961.748481 1.2.3.4 1234 2.3.4.5 80 success unknown
|
||||||
1324314328.950525 1.2.3.4 1234 2.3.4.5 80 failure US
|
1342748961.748481 1.2.3.4 1234 2.3.4.5 80 failure US
|
||||||
1324314328.950525 1.2.3.4 1234 2.3.4.5 80 failure UK
|
1342748961.748481 1.2.3.4 1234 2.3.4.5 80 failure UK
|
||||||
1324314328.950525 1.2.3.4 1234 2.3.4.5 80 success BR
|
1342748961.748481 1.2.3.4 1234 2.3.4.5 80 success BR
|
||||||
1324314328.950525 1.2.3.4 1234 2.3.4.5 80 failure MX
|
1342748961.748481 1.2.3.4 1234 2.3.4.5 80 failure MX
|
||||||
|
#end 2012-07-20-01-49-21
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field EMPTY
|
#empty_field EMPTY
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh
|
#path ssh
|
||||||
|
#start 2012-07-20-01-49-22
|
||||||
#fields b i e c p sn a d t iv s sc ss se vc ve f
|
#fields b i e c p sn a d t iv s sc ss se vc ve f
|
||||||
#types bool int enum count port subnet addr double time interval string table[count] table[string] table[string] vector[count] vector[string] func
|
#types bool int enum count port subnet addr double time interval string table[count] table[string] table[string] vector[count] vector[string] func
|
||||||
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1324314329.051618 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
|
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1342748962.114672 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
|
||||||
|
#end 2012-07-20-01-49-22
|
||||||
|
|
|
@ -3,7 +3,9 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path testing
|
#path testing
|
||||||
|
#start 2012-07-20-01-49-22
|
||||||
#fields a.val1 a.val2 b
|
#fields a.val1 a.val2 b
|
||||||
#types count count count
|
#types count count count
|
||||||
- - 6
|
- - 6
|
||||||
1 2 3
|
1 2 3
|
||||||
|
#end 2012-07-20-01-49-22
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ssh
|
#path ssh
|
||||||
|
#start 2012-07-20-01-49-22
|
||||||
#fields vec
|
#fields vec
|
||||||
#types vector[string]
|
#types vector[string]
|
||||||
-,2,-,-,5
|
-,2,-,-,5
|
||||||
|
#end 2012-07-20-01-49-22
|
||||||
|
|
|
@ -3,8 +3,10 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path metrics
|
#path metrics
|
||||||
|
#start 2012-07-20-01-50-41
|
||||||
#fields ts metric_id filter_name index.host index.str index.network value
|
#fields ts metric_id filter_name index.host index.str index.network value
|
||||||
#types time enum string addr string subnet count
|
#types time enum string addr string subnet count
|
||||||
1328303679.867377 TEST_METRIC foo-bar 6.5.4.3 - - 4
|
1342749041.601712 TEST_METRIC foo-bar 6.5.4.3 - - 4
|
||||||
1328303679.867377 TEST_METRIC foo-bar 7.2.1.5 - - 2
|
1342749041.601712 TEST_METRIC foo-bar 7.2.1.5 - - 2
|
||||||
1328303679.867377 TEST_METRIC foo-bar 1.2.3.4 - - 6
|
1342749041.601712 TEST_METRIC foo-bar 1.2.3.4 - - 6
|
||||||
|
#end 2012-07-20-01-50-49
|
||||||
|
|
|
@ -3,8 +3,10 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path metrics
|
#path metrics
|
||||||
|
#start 2012-07-20-01-49-22
|
||||||
#fields ts metric_id filter_name index.host index.str index.network value
|
#fields ts metric_id filter_name index.host index.str index.network value
|
||||||
#types time enum string addr string subnet count
|
#types time enum string addr string subnet count
|
||||||
1328303763.333948 TEST_METRIC foo-bar 6.5.4.3 - - 2
|
1342748962.841548 TEST_METRIC foo-bar 6.5.4.3 - - 2
|
||||||
1328303763.333948 TEST_METRIC foo-bar 7.2.1.5 - - 1
|
1342748962.841548 TEST_METRIC foo-bar 7.2.1.5 - - 1
|
||||||
1328303763.333948 TEST_METRIC foo-bar 1.2.3.4 - - 3
|
1342748962.841548 TEST_METRIC foo-bar 1.2.3.4 - - 3
|
||||||
|
#end 2012-07-20-01-49-22
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path notice
|
#path notice
|
||||||
|
#start 2012-07-20-01-50-59
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
|
||||||
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
|
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
|
||||||
1325633225.777902 - - - - - - Test_Notice Threshold crossed by metric_index(host=1.2.3.4) 100/100 - 1.2.3.4 - - 100 manager-1 Notice::ACTION_LOG 6 3600.000000 F - - - - - 1.2.3.4 - -
|
1342749059.978651 - - - - - - Test_Notice Threshold crossed by metric_index(host=1.2.3.4) 100/100 - 1.2.3.4 - - 100 manager-1 Notice::ACTION_LOG 6 3600.000000 F - - - - - 1.2.3.4 - -
|
||||||
|
#end 2012-07-20-01-51-08
|
||||||
|
|
|
@ -3,7 +3,9 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path notice
|
#path notice
|
||||||
|
#start 2012-07-20-01-49-23
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
|
||||||
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
|
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
|
||||||
1325633274.875473 - - - - - - Test_Notice Threshold crossed by metric_index(host=1.2.3.4) 3/2 - 1.2.3.4 - - 3 bro Notice::ACTION_LOG 6 3600.000000 F - - - - - 1.2.3.4 - -
|
1342748963.085888 - - - - - - Test_Notice Threshold crossed by metric_index(host=1.2.3.4) 3/2 - 1.2.3.4 - - 3 bro Notice::ACTION_LOG 6 3600.000000 F - - - - - 1.2.3.4 - -
|
||||||
1325633274.875473 - - - - - - Test_Notice Threshold crossed by metric_index(host=6.5.4.3) 2/2 - 6.5.4.3 - - 2 bro Notice::ACTION_LOG 6 3600.000000 F - - - - - 6.5.4.3 - -
|
1342748963.085888 - - - - - - Test_Notice Threshold crossed by metric_index(host=6.5.4.3) 2/2 - 6.5.4.3 - - 2 bro Notice::ACTION_LOG 6 3600.000000 F - - - - - 6.5.4.3 - -
|
||||||
|
#end 2012-07-20-01-49-23
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path notice
|
#path notice
|
||||||
|
#start 2012-07-20-01-51-18
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
|
||||||
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
|
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
|
||||||
1325633122.490990 - - - - - - Test_Notice test notice! - - - - - worker-1 Notice::ACTION_LOG 6 3600.000000 F - - - - - - - -
|
1342749078.270791 - - - - - - Test_Notice test notice! - - - - - worker-1 Notice::ACTION_LOG 6 3600.000000 F - - - - - - - -
|
||||||
|
#end 2012-07-20-01-51-27
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path notice
|
#path notice
|
||||||
|
#start 2012-07-20-01-51-36
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
|
||||||
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
|
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
|
||||||
1325633150.723248 - - - - - - Test_Notice test notice! - - - - - worker-2 Notice::ACTION_LOG 6 3600.000000 F - - - - - - - -
|
1342749096.545663 - - - - - - Test_Notice test notice! - - - - - worker-2 Notice::ACTION_LOG 6 3600.000000 F - - - - - - - -
|
||||||
|
#end 2012-07-20-01-51-45
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path notice
|
#path notice
|
||||||
|
#start 2012-07-20-01-49-23
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
|
||||||
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double
|
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double
|
||||||
1325633207.922993 - - - - - - Test_Notice test - - - - - bro Notice::ACTION_LOG 6 3600.000000 F - - - - -
|
1342748963.685754 - - - - - - Test_Notice test - - - - - bro Notice::ACTION_LOG 6 3600.000000 F - - - - -
|
||||||
|
#end 2012-07-20-01-49-23
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path conn
|
#path conn
|
||||||
|
#start 2012-02-21-16-53-13
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||||
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
||||||
1329843175.736107 arKYeMETxOg 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty)
|
1329843175.736107 arKYeMETxOg 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty)
|
||||||
|
@ -10,3 +11,4 @@
|
||||||
1329843194.151526 nQcgTWjvg4c 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty)
|
1329843194.151526 nQcgTWjvg4c 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty)
|
||||||
1329843197.783443 j4u32Pc5bif 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty)
|
1329843197.783443 j4u32Pc5bif 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty)
|
||||||
1329843161.968492 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty)
|
1329843161.968492 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty)
|
||||||
|
#end 2012-02-21-16-53-20
|
||||||
|
|
|
@ -3,7 +3,9 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ftp
|
#path ftp
|
||||||
|
#start 2012-02-21-16-53-13
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p user password command arg mime_type mime_desc file_size reply_code reply_msg tags extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p user password command arg mime_type mime_desc file_size reply_code reply_msg tags extraction_file
|
||||||
#types time string addr port addr port string string string string string string count count string table[string] file
|
#types time string addr port addr port string string string string string string count count string table[string] file
|
||||||
1329843179.926563 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test RETR ftp://199.233.217.249/./robots.txt text/plain ASCII text 77 226 Transfer complete. - -
|
1329843179.926563 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test RETR ftp://199.233.217.249/./robots.txt text/plain ASCII text 77 226 Transfer complete. - -
|
||||||
1329843197.727769 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test RETR ftp://199.233.217.249/./robots.txt text/plain ASCII text, with CRLF line terminators 77 226 Transfer complete. - -
|
1329843197.727769 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test RETR ftp://199.233.217.249/./robots.txt text/plain ASCII text, with CRLF line terminators 77 226 Transfer complete. - -
|
||||||
|
#end 2012-02-21-16-53-20
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path conn
|
#path conn
|
||||||
|
#start 2012-02-15-17-43-15
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||||
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
||||||
1329327783.316897 arKYeMETxOg 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49186 2001:470:4867:99::21 57086 tcp ftp-data 0.219721 0 342 SF - 0 ShAdfFa 5 372 4 642 (empty)
|
1329327783.316897 arKYeMETxOg 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49186 2001:470:4867:99::21 57086 tcp ftp-data 0.219721 0 342 SF - 0 ShAdfFa 5 372 4 642 (empty)
|
||||||
|
@ -11,3 +12,4 @@
|
||||||
1329327795.571921 j4u32Pc5bif 2001:470:4867:99::21 55785 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49189 tcp ftp-data 0.109813 77 0 SF - 0 ShADFaf 5 449 4 300 (empty)
|
1329327795.571921 j4u32Pc5bif 2001:470:4867:99::21 55785 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49189 tcp ftp-data 0.109813 77 0 SF - 0 ShADFaf 5 449 4 300 (empty)
|
||||||
1329327777.822004 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 tcp ftp 26.658219 310 3448 SF - 0 ShAdDfFa 57 4426 34 5908 (empty)
|
1329327777.822004 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 tcp ftp 26.658219 310 3448 SF - 0 ShAdDfFa 57 4426 34 5908 (empty)
|
||||||
1329327800.017649 TEfuqmmG4bh 2001:470:4867:99::21 55647 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49190 tcp ftp-data 0.109181 342 0 SF - 0 ShADFaf 5 714 4 300 (empty)
|
1329327800.017649 TEfuqmmG4bh 2001:470:4867:99::21 55647 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49190 tcp ftp-data 0.109181 342 0 SF - 0 ShADFaf 5 714 4 300 (empty)
|
||||||
|
#end 2012-02-15-17-43-24
|
||||||
|
|
|
@ -3,7 +3,9 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path ftp
|
#path ftp
|
||||||
|
#start 2012-02-15-17-43-07
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p user password command arg mime_type mime_desc file_size reply_code reply_msg tags extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p user password command arg mime_type mime_desc file_size reply_code reply_msg tags extraction_file
|
||||||
#types time string addr port addr port string string string string string string count count string table[string] file
|
#types time string addr port addr port string string string string string string count count string table[string] file
|
||||||
1329327787.396984 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 anonymous test RETR ftp://[2001:470:4867:99::21]/robots.txt - - 77 226 Transfer complete. - -
|
1329327787.396984 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 anonymous test RETR ftp://[2001:470:4867:99::21]/robots.txt - - 77 226 Transfer complete. - -
|
||||||
1329327795.463946 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 anonymous test RETR ftp://[2001:470:4867:99::21]/robots.txt - - 77 226 Transfer complete. - -
|
1329327795.463946 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 anonymous test RETR ftp://[2001:470:4867:99::21]/robots.txt - - 77 226 Transfer complete. - -
|
||||||
|
#end 2012-02-15-17-43-24
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path http
|
#path http
|
||||||
|
#start 2009-03-19-05-21-36
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
1237440095.634312 UWkUyAuUGXf 192.168.3.103 54102 128.146.216.51 80 1 POST www.osu.edu / - curl/7.17.1 (i386-apple-darwin8.11.1) libcurl/7.17.1 zlib/1.2.3 2001 60731 200 OK 100 Continue - (empty) - - - text/html - -
|
1237440095.634312 UWkUyAuUGXf 192.168.3.103 54102 128.146.216.51 80 1 POST www.osu.edu / - curl/7.17.1 (i386-apple-darwin8.11.1) libcurl/7.17.1 zlib/1.2.3 2001 60731 200 OK 100 Continue - (empty) - - - text/html - -
|
||||||
|
#end 2009-03-19-05-21-36
|
||||||
|
|
|
@ -3,6 +3,8 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path http
|
#path http
|
||||||
|
#start 2005-10-07-23-23-56
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
1128727435.634189 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - http-item_141.42.64.125:56730-125.190.109.199:80_resp_1.dat
|
1128727435.634189 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - http-item_141.42.64.125:56730-125.190.109.199:80_resp_1.dat
|
||||||
|
#end 2005-10-07-23-23-57
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path http
|
#path http
|
||||||
|
#start 2009-11-18-20-58-04
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
1258577884.844956 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 1 GET www.mozilla.org /style/enhanced.css http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 2675 200 OK - - - (empty) - - - FAKE_MIME - -
|
1258577884.844956 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 1 GET www.mozilla.org /style/enhanced.css http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 2675 200 OK - - - (empty) - - - FAKE_MIME - -
|
||||||
|
@ -10,3 +11,4 @@
|
||||||
1258577885.317160 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 3 GET www.mozilla.org /images/template/screen/bullet_utility.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 94 200 OK - - - (empty) - - - FAKE_MIME - -
|
1258577885.317160 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 3 GET www.mozilla.org /images/template/screen/bullet_utility.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 94 200 OK - - - (empty) - - - FAKE_MIME - -
|
||||||
1258577885.349639 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 4 GET www.mozilla.org /images/template/screen/key-point-top.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 2349 200 OK - - - (empty) - - - image/png e0029eea80812e9a8e57b8d05d52938a -
|
1258577885.349639 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 4 GET www.mozilla.org /images/template/screen/key-point-top.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 2349 200 OK - - - (empty) - - - image/png e0029eea80812e9a8e57b8d05d52938a -
|
||||||
1258577885.394612 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 5 GET www.mozilla.org /projects/calendar/images/header-sunbird.png http://www.mozilla.org/projects/calendar/calendar.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 27579 200 OK - - - (empty) - - - image/png 30aa926344f58019d047e85ba049ca1e -
|
1258577885.394612 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 5 GET www.mozilla.org /projects/calendar/images/header-sunbird.png http://www.mozilla.org/projects/calendar/calendar.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 27579 200 OK - - - (empty) - - - image/png 30aa926344f58019d047e85ba049ca1e -
|
||||||
|
#end 2009-11-18-20-58-32
|
||||||
|
|
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue