diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction-request/.stdout b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction-request/.stdout new file mode 100644 index 0000000000..b9d6e354ee --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction-request/.stdout @@ -0,0 +1 @@ +smb1_transaction_request hdr: [command=37, status=0, flags=0, flags2=0, tid=31335, pid=1, uid=11132, mid=2], name: \\PIPE\lsarpc, sub_cmd: 2600, params: some_params, data: some_data diff --git a/testing/btest/Traces/smb/smb1_transaction_request.pcap b/testing/btest/Traces/smb/smb1_transaction_request.pcap new file mode 100644 index 0000000000..e234ec4e76 Binary files /dev/null and b/testing/btest/Traces/smb/smb1_transaction_request.pcap differ diff --git a/testing/btest/scripts/base/protocols/smb/smb1-transaction-request.test b/testing/btest/scripts/base/protocols/smb/smb1-transaction-request.test new file mode 100644 index 0000000000..9334230e84 --- /dev/null +++ b/testing/btest/scripts/base/protocols/smb/smb1-transaction-request.test @@ -0,0 +1,12 @@ +#@TEST-EXEC: bro -b -C -r $TRACES/smb/smb1_transaction_request.pcap %INPUT +#@TEST-EXEC: btest-diff .stdout + +@load base/protocols/smb +@load policy/protocols/smb + +# Check that smb1_transaction requests are parsed correctly + +event smb1_transaction_request(c: connection, hdr: SMB1::Header, name: string, sub_cmd: count, parameters: string, data: string) +{ + print fmt("smb1_transaction_request hdr: %s, name: %s, sub_cmd: %x, params: %s, data: %s", hdr, name, sub_cmd, parameters, data); +}