Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 10:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add RDP over UDP analyzer

Browse source
This commit is contained in:
Anthony Kasza 2020-03-22 14:43:54 -06:00 • committed by Jon Siwek
parent c42ebfa1cf
commit 60644bc85f
15 changed files with 512 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

23
testing/btest/scripts/base/protocols/rdp/rdp-rdpeudp-handshake-fail.zeek Normal file
View file

@ -0,0 +1,23 @@
# @TEST-EXEC: zeek -r $TRACES/rdp/rdp-rdpeudp-handshake-fail.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
@load base/protocols/rdp
event rdpeudp_syn(c: connection) {
print "rdpeudp_syn";
}
event rdpeudp_synack(c: connection) {
print "rdpeudp_synack";
}
event rdpeudp_established(c: connection, version: count) {
print "rdpeudp_established";
print "version", version;
}
event rdpeudp_data(c: connection, is_orig: bool, version: count, data: string)
{
print "rdpeudp_data";
print fmt("is_orig: %s, version %d, data: %s", is_orig, version, data);
}

23
testing/btest/scripts/base/protocols/rdp/rdp-rdpeudp-handshake-success.zeek Normal file
View file

@ -0,0 +1,23 @@
# @TEST-EXEC: zeek -r $TRACES/rdp/rdp-rdpeudp-handshake-success.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
@load base/protocols/rdp
event rdpeudp_syn(c: connection) {
print "rdpeudp_syn";
}
event rdpeudp_synack(c: connection) {
print "rdpeudp_synack";
}
event rdpeudp_established(c: connection, version: count) {
print "rdpeudp_established";
print "version", version;
}
event rdpeudp_data(c: connection, is_orig: bool, version: count, data: string)
{
print "rdpeudp_data";
print fmt("is_orig: %s, version %d, data: %s", is_orig, version, data);
}