diff --git a/scripts/base/protocols/ldap/main.zeek b/scripts/base/protocols/ldap/main.zeek index da4a21871c..1e23c7bf84 100644 --- a/scripts/base/protocols/ldap/main.zeek +++ b/scripts/base/protocols/ldap/main.zeek @@ -229,6 +229,10 @@ event LDAP::message(c: connection, fmt("%s: %s -> %s", message_id, m$opcode, opcode_str), "LDAP"); } + m$opcode = opcode_str; + } else if ( ! m?$opcode ) { + # This can happen if we see a bind response before the bind request. + Reporter::conn_weird("LDAP_bind_without_opcode", c, fmt("%s: %s", message_id, opcode_str), "LDAP"); m$opcode = opcode_str; }