mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 08:38:20 +00:00
Merge remote-tracking branch 'origin/master' into topic/seth/file-entropy
# Conflicts: # scripts/test-all-policy.bro # testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
This commit is contained in:
Seth Hall
commit
89b4d79f93
1081 changed files with 38403 additions and 11012 deletions
|
|
@ -17,8 +17,8 @@ make-brief:
|
|||
|
||||
coverage:
|
||||
@for repo in $(DIRS); do (cd $$repo && echo "Coverage for '$$repo' dir:" && make -s coverage); done
|
||||
@test -f btest/coverage.log && cp btest/coverage.log `mktemp brocov.tmp.XXX` || true
|
||||
@for f in external/*/coverage.log; do test -f $$f && cp $$f `mktemp brocov.tmp.XXX` || true; done
|
||||
@test -f btest/coverage.log && cp btest/coverage.log `mktemp brocov.tmp.XXXXXX` || true
|
||||
@for f in external/*/coverage.log; do test -f $$f && cp $$f `mktemp brocov.tmp.XXXXXX` || true; done
|
||||
@echo "Complete test suite code coverage:"
|
||||
@./scripts/coverage-calc "brocov.tmp.*" coverage.log `pwd`/../scripts
|
||||
@rm -f brocov.tmp.*
|
||||
|
|
|
|||
8
testing/btest/Baseline/bifs.check_subnet/output
Normal file
8
testing/btest/Baseline/bifs.check_subnet/output
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
in says: 10.2.0.2/32 is member
|
||||
check_subnet says: 10.2.0.2/32 is no member
|
||||
in says: 10.2.0.2/31 is member
|
||||
check_subnet says: 10.2.0.2/31 is member
|
||||
in says: 10.0.0.0/9 is member
|
||||
check_subnet says: 10.0.0.0/9 is no member
|
||||
in says: 10.0.0.0/8 is member
|
||||
check_subnet says: 10.0.0.0/8 is member
|
||||
|
|
@ -4,3 +4,11 @@ bro
|
|||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
|
|
|
|||
12
testing/btest/Baseline/bifs.decode_base64_conn/weird.log
Normal file
12
testing/btest/Baseline/bifs.decode_base64_conn/weird.log
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2015-08-31-03-09-20
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1254722767.875996 CjhGID4nQcgTWjvg4c 10.10.1.4 1470 74.53.140.153 25 base64_illegal_encoding incomplete base64 group, padding with 12 bits of 0 F bro
|
||||
1437831787.861602 CPbrpk1qSsw6ESzHV4 192.168.133.100 49648 192.168.133.102 25 base64_illegal_encoding incomplete base64 group, padding with 12 bits of 0 F bro
|
||||
1437831799.610433 C7XEbhP654jzLoe3a 192.168.133.100 49655 17.167.150.73 443 base64_illegal_encoding incomplete base64 group, padding with 12 bits of 0 F bro
|
||||
#close 2015-08-31-03-09-20
|
||||
|
|
@ -1,5 +1,9 @@
|
|||
YnJv
|
||||
YnJv
|
||||
YnJv
|
||||
}n-v
|
||||
YnJv
|
||||
YnJv
|
||||
}n-v
|
||||
cGFkZGluZw==
|
||||
cGFkZGluZzE=
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
12
|
||||
Test \0string
|
||||
13
|
||||
Test \0string
|
||||
Test \x00string
|
||||
15
|
||||
Test \x00string
|
||||
15
|
||||
Test \x00string
|
||||
15
|
||||
Test \x00string
|
||||
13
|
||||
Test \0string
|
||||
24
|
||||
546573742000737472696e67
|
||||
|
|
|
|||
|
|
@ -35,8 +35,8 @@ test
|
|||
*/^?(^foo|bar)$?/*
|
||||
* Blue*
|
||||
* [1, 2, 3]*
|
||||
*{^J^I2,^J^I1,^J^I3^J}*
|
||||
*{^J^I[2] = bro,^J^I[1] = test^J}*
|
||||
*{\x0a\x092,\x0a\x091,\x0a\x093\x0a}*
|
||||
*{\x0a\x09[2] = bro,\x0a\x09[1] = test\x0a}*
|
||||
3.100000e+02
|
||||
310.000000
|
||||
310
|
||||
|
|
@ -45,11 +45,11 @@ test
|
|||
310
|
||||
310
|
||||
2
|
||||
3
|
||||
4
|
||||
1
|
||||
2
|
||||
2
|
||||
6
|
||||
1
|
||||
2
|
||||
2
|
||||
6
|
||||
1
|
||||
2
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
0000 61 62 63 ff 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f abc.defg hijklmno^J0010 70 71 72 73 74 75 76 77 78 79 7a pqrstuvw xyz^J
|
||||
0000 61 62 63 ff 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f abc.defg hijklmno\x0a0010 70 71 72 73 74 75 76 77 78 79 7a pqrstuvw xyz\x0a
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
04
|
||||
|
||||
\0
|
||||
\x00
|
||||
|
||||
|
|
|
|||
|
|
@ -4,3 +4,4 @@ mytest
|
|||
this__is__another__test
|
||||
thisisanothertest
|
||||
Test
|
||||
...hi..there
|
||||
|
|
|
|||
18
testing/btest/Baseline/bifs.matching_subnets/output
Normal file
18
testing/btest/Baseline/bifs.matching_subnets/output
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
10.0.0.0/8,
|
||||
10.3.0.0/16,
|
||||
10.2.0.2/31,
|
||||
2607:f8b0:4007:807::/64,
|
||||
10.2.0.0/16,
|
||||
5.2.0.0/32,
|
||||
5.5.0.0/25,
|
||||
10.1.0.0/16,
|
||||
5.0.0.0/8,
|
||||
2607:f8b0:4007:807::200e/128,
|
||||
7.2.0.0/32,
|
||||
2607:f8b0:4008:807::/64
|
||||
}
|
||||
[10.2.0.2/31, 10.2.0.0/16, 10.0.0.0/8]
|
||||
[2607:f8b0:4007:807::200e/128, 2607:f8b0:4007:807::/64]
|
||||
[]
|
||||
[10.0.0.0/8]
|
||||
|
|
@ -1 +1 @@
|
|||
[pkts_recvd=136, pkts_dropped=0, pkts_link=0]
|
||||
[pkts_recvd=136, pkts_dropped=0, pkts_link=0, bytes_recvd=25260]
|
||||
|
|
|
|||
|
|
@ -4,5 +4,5 @@ WORKGROUP
|
|||
27
|
||||
ISATAP
|
||||
0
|
||||
^A^B__MSBROWSE__^B
|
||||
\x01\x02__MSBROWSE__\x02
|
||||
1
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
*\0* 1
|
||||
*t\0* 2
|
||||
*test test\0* 10
|
||||
*\x00* 1
|
||||
*t\x00* 2
|
||||
*test test\x00* 10
|
||||
|
|
|
|||
0
testing/btest/Baseline/bifs.subnet_to_addr/error
Normal file
0
testing/btest/Baseline/bifs.subnet_to_addr/error
Normal file
3
testing/btest/Baseline/bifs.subnet_to_addr/output
Normal file
3
testing/btest/Baseline/bifs.subnet_to_addr/output
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
subnet_to_addr(0.0.0.0/32) = 0.0.0.0 (SUCCESS)
|
||||
subnet_to_addr(1.2.0.0/16) = 1.2.0.0 (SUCCESS)
|
||||
subnet_to_addr(2607:f8b0:4005:803::200e/128) = 2607:f8b0:4005:803::200e (SUCCESS)
|
||||
4
testing/btest/Baseline/bifs.subnet_version/out
Normal file
4
testing/btest/Baseline/bifs.subnet_version/out
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
T
|
||||
F
|
||||
F
|
||||
T
|
||||
|
|
@ -7,3 +7,4 @@
|
|||
18446744073709551611
|
||||
0
|
||||
123
|
||||
9223372036854775808 and 9223372036854775808 are the same
|
||||
|
|
|
|||
|
|
@ -0,0 +1,5 @@
|
|||
clone keys, [status=BrokerStore::SUCCESS, result=[d=broker::data{[one, two, myset, myvec]}]]
|
||||
lookup, one, [status=BrokerStore::SUCCESS, result=[d=broker::data{111}]]
|
||||
lookup, myset, [status=BrokerStore::SUCCESS, result=[d=broker::data{{a, c, d}}]]
|
||||
lookup, two, [status=BrokerStore::SUCCESS, result=[d=broker::data{222}]]
|
||||
lookup, myvec, [status=BrokerStore::SUCCESS, result=[d=broker::data{[delta, alpha, beta, gamma, omega]}]]
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
BrokerComm::incoming_connection_established, connector
|
||||
BrokerComm::incoming_connection_broken, connector
|
||||
|
|
@ -0,0 +1 @@
|
|||
BrokerComm::outgoing_connection_established, 127.0.0.1, 9999/tcp, listener
|
||||
99
testing/btest/Baseline/broker.data/out
Normal file
99
testing/btest/Baseline/broker.data/out
Normal file
|
|
@ -0,0 +1,99 @@
|
|||
BrokerComm::BOOL
|
||||
BrokerComm::INT
|
||||
BrokerComm::COUNT
|
||||
BrokerComm::DOUBLE
|
||||
BrokerComm::STRING
|
||||
BrokerComm::ADDR
|
||||
BrokerComm::SUBNET
|
||||
BrokerComm::PORT
|
||||
BrokerComm::TIME
|
||||
BrokerComm::INTERVAL
|
||||
BrokerComm::ENUM
|
||||
BrokerComm::SET
|
||||
BrokerComm::TABLE
|
||||
BrokerComm::VECTOR
|
||||
BrokerComm::RECORD
|
||||
***************************
|
||||
T
|
||||
F
|
||||
1
|
||||
0
|
||||
-1
|
||||
1
|
||||
0
|
||||
1.1
|
||||
-11.1
|
||||
hello
|
||||
1.2.3.4
|
||||
192.168.0.0/16
|
||||
22/tcp
|
||||
42.0
|
||||
180.0
|
||||
BrokerComm::BOOL
|
||||
***************************
|
||||
{
|
||||
two,
|
||||
one,
|
||||
three
|
||||
}
|
||||
0
|
||||
T
|
||||
1
|
||||
T
|
||||
F
|
||||
T
|
||||
2
|
||||
T
|
||||
1
|
||||
F
|
||||
{
|
||||
bye
|
||||
}
|
||||
0
|
||||
***************************
|
||||
{
|
||||
[two] = 2,
|
||||
[one] = 1,
|
||||
[three] = 3
|
||||
}
|
||||
0
|
||||
[d=<uninitialized>]
|
||||
1
|
||||
T
|
||||
42
|
||||
F
|
||||
[d=<uninitialized>]
|
||||
2
|
||||
[d=broker::data{7}]
|
||||
2
|
||||
37
|
||||
[d=broker::data{42}]
|
||||
1
|
||||
***************************
|
||||
[zero, one, two]
|
||||
0
|
||||
T
|
||||
T
|
||||
T
|
||||
T
|
||||
[hi, salutations, hello, greetings]
|
||||
4
|
||||
[d=broker::data{hello}]
|
||||
[d=broker::data{bah}]
|
||||
[d=broker::data{hi}]
|
||||
[hi, salutations, bah, greetings]
|
||||
[d=broker::data{bah}]
|
||||
[hi, salutations, greetings]
|
||||
3
|
||||
***************************
|
||||
[a=<uninitialized>, b=bee, c=1]
|
||||
[a=test, b=bee, c=1]
|
||||
[a=test, b=testagain, c=1]
|
||||
3
|
||||
T
|
||||
T
|
||||
T
|
||||
[d=broker::data{hi}]
|
||||
[d=broker::data{hello}]
|
||||
[d=broker::data{37}]
|
||||
3
|
||||
3
testing/btest/Baseline/broker.enable-and-exit/output
Normal file
3
testing/btest/Baseline/broker.enable-and-exit/output
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
1
|
||||
2
|
||||
terminating
|
||||
14
testing/btest/Baseline/broker.master_store/master.out
Normal file
14
testing/btest/Baseline/broker.master_store/master.out
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
lookup(two): [status=BrokerStore::SUCCESS, result=[d=broker::data{222}]]
|
||||
lookup(four): [status=BrokerStore::SUCCESS, result=[d=<uninitialized>]]
|
||||
lookup(myset): [status=BrokerStore::SUCCESS, result=[d=broker::data{{a, c, d}}]]
|
||||
lookup(one): [status=BrokerStore::SUCCESS, result=[d=broker::data{111}]]
|
||||
lookup(myvec): [status=BrokerStore::SUCCESS, result=[d=broker::data{[delta, alpha, beta, gamma, omega]}]]
|
||||
exists(one): [status=BrokerStore::SUCCESS, result=[d=broker::data{1}]]
|
||||
exists(two): [status=BrokerStore::SUCCESS, result=[d=broker::data{0}]]
|
||||
exists(myset): [status=BrokerStore::SUCCESS, result=[d=broker::data{1}]]
|
||||
exists(four): [status=BrokerStore::SUCCESS, result=[d=broker::data{0}]]
|
||||
pop_right(myvec): [status=BrokerStore::SUCCESS, result=[d=broker::data{omega}]]
|
||||
pop_left(myvec): [status=BrokerStore::SUCCESS, result=[d=broker::data{delta}]]
|
||||
keys: [status=BrokerStore::SUCCESS, result=[d=broker::data{[myvec, myset, one]}]]
|
||||
size: [status=BrokerStore::SUCCESS, result=[d=broker::data{3}]]
|
||||
size (after clear): [status=BrokerStore::SUCCESS, result=[d=broker::data{0}]]
|
||||
6
testing/btest/Baseline/broker.remote_event/recv.recv.out
Normal file
6
testing/btest/Baseline/broker.remote_event/recv.recv.out
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
got event msg, ping, 0
|
||||
got event msg, ping, 1
|
||||
got event msg, ping, 2
|
||||
got event msg, ping, 3
|
||||
got event msg, ping, 4
|
||||
got event msg, ping, 5
|
||||
11
testing/btest/Baseline/broker.remote_event/send.send.out
Normal file
11
testing/btest/Baseline/broker.remote_event/send.send.out
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
BrokerComm::outgoing_connection_established, 127.0.0.1, 9999/tcp
|
||||
got event msg, pong, 0
|
||||
got auto event msg, ping, 0
|
||||
got event msg, pong, 1
|
||||
got auto event msg, ping, 1
|
||||
got event msg, pong, 2
|
||||
got auto event msg, ping, 2
|
||||
got event msg, pong, 3
|
||||
got auto event msg, ping, 3
|
||||
got event msg, pong, 4
|
||||
got auto event msg, ping, 4
|
||||
6
testing/btest/Baseline/broker.remote_log/recv.recv.out
Normal file
6
testing/btest/Baseline/broker.remote_log/recv.recv.out
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
wrote log, [msg=ping, num=0, nolog=no]
|
||||
wrote log, [msg=ping, num=1, nolog=no]
|
||||
wrote log, [msg=ping, num=2, nolog=no]
|
||||
wrote log, [msg=ping, num=3, nolog=no]
|
||||
wrote log, [msg=ping, num=4, nolog=no]
|
||||
wrote log, [msg=ping, num=5, nolog=no]
|
||||
15
testing/btest/Baseline/broker.remote_log/recv.test.log
Normal file
15
testing/btest/Baseline/broker.remote_log/recv.test.log
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path test
|
||||
#open 2015-01-26-22-47-11
|
||||
#fields msg num
|
||||
#types string count
|
||||
ping 0
|
||||
ping 1
|
||||
ping 2
|
||||
ping 3
|
||||
ping 4
|
||||
ping 5
|
||||
#close 2015-01-26-22-47-11
|
||||
1
testing/btest/Baseline/broker.remote_log/send.send.out
Normal file
1
testing/btest/Baseline/broker.remote_log/send.send.out
Normal file
|
|
@ -0,0 +1 @@
|
|||
BrokerComm::outgoing_connection_established, 127.0.0.1, 9999/tcp
|
||||
15
testing/btest/Baseline/broker.remote_log/send.test.log
Normal file
15
testing/btest/Baseline/broker.remote_log/send.test.log
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path test
|
||||
#open 2015-01-26-22-47-11
|
||||
#fields msg num
|
||||
#types string count
|
||||
ping 0
|
||||
ping 1
|
||||
ping 2
|
||||
ping 3
|
||||
ping 4
|
||||
ping 5
|
||||
#close 2015-01-26-22-47-11
|
||||
6
testing/btest/Baseline/broker.remote_print/recv.recv.out
Normal file
6
testing/btest/Baseline/broker.remote_print/recv.recv.out
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
got print msg, ping 0
|
||||
got print msg, ping 1
|
||||
got print msg, ping 2
|
||||
got print msg, ping 3
|
||||
got print msg, ping 4
|
||||
got print msg, ping 5
|
||||
6
testing/btest/Baseline/broker.remote_print/send.send.out
Normal file
6
testing/btest/Baseline/broker.remote_print/send.send.out
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
BrokerComm::outgoing_connection_established, 127.0.0.1, 9999/tcp
|
||||
got print msg, pong 0
|
||||
got print msg, pong 1
|
||||
got print msg, pong 2
|
||||
got print msg, pong 3
|
||||
got print msg, pong 4
|
||||
23
testing/btest/Baseline/core.conn-size-threshold/.stdout
Normal file
23
testing/btest/Baseline/core.conn-size-threshold/.stdout
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
0
|
||||
0
|
||||
0
|
||||
0
|
||||
Threshold set for [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp]
|
||||
3000
|
||||
2000
|
||||
63
|
||||
50
|
||||
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2000, F
|
||||
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 3000, T
|
||||
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 50, F
|
||||
0
|
||||
0
|
||||
0
|
||||
0
|
||||
Threshold set for [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp]
|
||||
3000
|
||||
2000
|
||||
63
|
||||
50
|
||||
triggered bytes, [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp], 2000, F
|
||||
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 63, T
|
||||
|
|
@ -6,15 +6,15 @@ icmp_time_exceeded (code=0)
|
|||
conn_id: [orig_h=10.0.0.1, orig_p=11/icmp, resp_h=10.0.0.2, resp_p=0/icmp]
|
||||
icmp_conn: [orig_h=10.0.0.1, resp_h=10.0.0.2, itype=11, icode=0, len=32, hlim=64, v6=F]
|
||||
icmp_context: [id=[orig_h=10.0.0.2, orig_p=30000/udp, resp_h=10.0.0.1, resp_p=13000/udp], len=32, proto=2, frag_offset=0, bad_hdr_len=F, bad_checksum=F, MF=F, DF=F]
|
||||
icmp_echo_request (id=34844, seq=0, payload=O\x85\xe0C\0^N\xeb\xff^H^I^J^K^L^M^N^O^P^Q^R^S^T^U^V^W^X^Y^Z\x1b\x1c\x1d\x1e\x1f !"#$%&'()*+,-./01234567)
|
||||
icmp_echo_request (id=34844, seq=0, payload=O\x85\xe0C\x00\x0e\xeb\xff\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&'()*+,-./01234567)
|
||||
conn_id: [orig_h=10.0.0.1, orig_p=8/icmp, resp_h=74.125.225.99, resp_p=0/icmp]
|
||||
icmp_conn: [orig_h=10.0.0.1, resp_h=74.125.225.99, itype=8, icode=0, len=56, hlim=64, v6=F]
|
||||
icmp_echo_reply (id=34844, seq=0, payload=O\x85\xe0C\0^N\xeb\xff^H^I^J^K^L^M^N^O^P^Q^R^S^T^U^V^W^X^Y^Z\x1b\x1c\x1d\x1e\x1f !"#$%&'()*+,-./01234567)
|
||||
icmp_echo_reply (id=34844, seq=0, payload=O\x85\xe0C\x00\x0e\xeb\xff\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&'()*+,-./01234567)
|
||||
conn_id: [orig_h=10.0.0.1, orig_p=8/icmp, resp_h=74.125.225.99, resp_p=0/icmp]
|
||||
icmp_conn: [orig_h=10.0.0.1, resp_h=74.125.225.99, itype=8, icode=0, len=56, hlim=64, v6=F]
|
||||
icmp_echo_request (id=34844, seq=1, payload=O\x85\xe0D\0^N\xf0}^H^I^J^K^L^M^N^O^P^Q^R^S^T^U^V^W^X^Y^Z\x1b\x1c\x1d\x1e\x1f !"#$%&'()*+,-./01234567)
|
||||
icmp_echo_request (id=34844, seq=1, payload=O\x85\xe0D\x00\x0e\xf0}\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&'()*+,-./01234567)
|
||||
conn_id: [orig_h=10.0.0.1, orig_p=8/icmp, resp_h=74.125.225.99, resp_p=0/icmp]
|
||||
icmp_conn: [orig_h=10.0.0.1, resp_h=74.125.225.99, itype=8, icode=0, len=56, hlim=64, v6=F]
|
||||
icmp_echo_reply (id=34844, seq=1, payload=O\x85\xe0D\0^N\xf0}^H^I^J^K^L^M^N^O^P^Q^R^S^T^U^V^W^X^Y^Z\x1b\x1c\x1d\x1e\x1f !"#$%&'()*+,-./01234567)
|
||||
icmp_echo_reply (id=34844, seq=1, payload=O\x85\xe0D\x00\x0e\xf0}\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&'()*+,-./01234567)
|
||||
conn_id: [orig_h=10.0.0.1, orig_p=8/icmp, resp_h=74.125.225.99, resp_p=0/icmp]
|
||||
icmp_conn: [orig_h=10.0.0.1, resp_h=74.125.225.99, itype=8, icode=0, len=56, hlim=64, v6=F]
|
||||
|
|
|
|||
|
|
@ -1,28 +1,28 @@
|
|||
icmp_redirect options
|
||||
[otype=4, len=8, link_address=<uninitialized>, prefix=<uninitialized>, redirect=[id=[orig_h=fe80::aaaa, orig_p=30000/udp, resp_h=fe80::bbbb, resp_p=13000/udp], len=56, proto=2, frag_offset=0, bad_hdr_len=F, bad_checksum=F, MF=F, DF=F], mtu=<uninitialized>, payload=<uninitialized>]
|
||||
icmp_neighbor_advertisement options
|
||||
[otype=2, len=1, link_address=\xc2\0T\xf5\0\0, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
[otype=2, len=1, link_address=\xc2\x00T\xf5\x00\x00, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
MAC: c20054f50000
|
||||
icmp_router_advertisement options
|
||||
[otype=1, len=1, link_address=\xc2\0T\xf5\0\0, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
[otype=1, len=1, link_address=\xc2\x00T\xf5\x00\x00, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
MAC: c20054f50000
|
||||
[otype=5, len=1, link_address=<uninitialized>, prefix=<uninitialized>, redirect=<uninitialized>, mtu=1500, payload=<uninitialized>]
|
||||
[otype=3, len=4, link_address=<uninitialized>, prefix=[prefix_len=64, L_flag=T, A_flag=T, valid_lifetime=30.0 days, preferred_lifetime=7.0 days, prefix=2001:db8:0:1::], redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
icmp_neighbor_advertisement options
|
||||
[otype=2, len=1, link_address=\xc2\0T\xf5\0\0, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
[otype=2, len=1, link_address=\xc2\x00T\xf5\x00\x00, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
MAC: c20054f50000
|
||||
icmp_router_advertisement options
|
||||
[otype=1, len=1, link_address=\xc2\0T\xf5\0\0, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
[otype=1, len=1, link_address=\xc2\x00T\xf5\x00\x00, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
MAC: c20054f50000
|
||||
[otype=5, len=1, link_address=<uninitialized>, prefix=<uninitialized>, redirect=<uninitialized>, mtu=1500, payload=<uninitialized>]
|
||||
[otype=3, len=4, link_address=<uninitialized>, prefix=[prefix_len=64, L_flag=T, A_flag=T, valid_lifetime=30.0 days, preferred_lifetime=7.0 days, prefix=2001:db8:0:1::], redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
icmp_router_advertisement options
|
||||
[otype=1, len=1, link_address=\xc2\0T\xf5\0\0, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
[otype=1, len=1, link_address=\xc2\x00T\xf5\x00\x00, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
MAC: c20054f50000
|
||||
[otype=5, len=1, link_address=<uninitialized>, prefix=<uninitialized>, redirect=<uninitialized>, mtu=1500, payload=<uninitialized>]
|
||||
[otype=3, len=4, link_address=<uninitialized>, prefix=[prefix_len=64, L_flag=T, A_flag=T, valid_lifetime=30.0 days, preferred_lifetime=7.0 days, prefix=2001:db8:0:1::], redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
icmp_router_advertisement options
|
||||
[otype=1, len=1, link_address=\xc2\0T\xf5\0\0, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
[otype=1, len=1, link_address=\xc2\x00T\xf5\x00\x00, prefix=<uninitialized>, redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
MAC: c20054f50000
|
||||
[otype=5, len=1, link_address=<uninitialized>, prefix=<uninitialized>, redirect=<uninitialized>, mtu=1500, payload=<uninitialized>]
|
||||
[otype=3, len=4, link_address=<uninitialized>, prefix=[prefix_len=64, L_flag=T, A_flag=T, valid_lifetime=30.0 days, preferred_lifetime=7.0 days, prefix=2001:db8:0:1::], redirect=<uninitialized>, mtu=<uninitialized>, payload=<uninitialized>]
|
||||
|
|
|
|||
2
testing/btest/Baseline/core.icmp.icmp_sent/out
Normal file
2
testing/btest/Baseline/core.icmp.icmp_sent/out
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
icmp_sent, [orig_h=fe80::2c23:b96c:78d:e116, orig_p=143/icmp, resp_h=ff02::16, resp_p=0/icmp], [orig_h=fe80::2c23:b96c:78d:e116, resp_h=ff02::16, itype=143, icode=0, len=20, hlim=1, v6=T]
|
||||
icmp_sent_payload, [orig_h=fe80::2c23:b96c:78d:e116, orig_p=143/icmp, resp_h=ff02::16, resp_p=0/icmp], [orig_h=fe80::2c23:b96c:78d:e116, resp_h=ff02::16, itype=143, icode=0, len=20, hlim=1, v6=T], 20
|
||||
|
|
@ -1,3 +1,3 @@
|
|||
weird routing0_hdr from 2001:4f8:4:7:2e0:81ff:fe52:ffff to 2001:78:1:32::2
|
||||
[orig_h=2001:4f8:4:7:2e0:81ff:fe52:ffff, orig_p=53/udp, resp_h=2001:78:1:32::2, resp_p=53/udp]
|
||||
[ip=<uninitialized>, ip6=[class=0, flow=0, len=59, nxt=0, hlim=64, src=2001:4f8:4:7:2e0:81ff:fe52:ffff, dst=2001:4f8:4:7:2e0:81ff:fe52:9a6b, exts=[[id=0, hopopts=[nxt=43, len=0, options=[[otype=1, len=4, data=\0\0\0\0]]], dstopts=<uninitialized>, routing=<uninitialized>, fragment=<uninitialized>, ah=<uninitialized>, esp=<uninitialized>, mobility=<uninitialized>], [id=43, hopopts=<uninitialized>, dstopts=<uninitialized>, routing=[nxt=17, len=4, rtype=0, segleft=2, data=\0\0\0\0 ^A\0x\0^A\02\0\0\0\0\0\0\0^A ^A\0x\0^A\02\0\0\0\0\0\0\0^B], fragment=<uninitialized>, ah=<uninitialized>, esp=<uninitialized>, mobility=<uninitialized>]]], tcp=<uninitialized>, udp=[sport=53/udp, dport=53/udp, ulen=11], icmp=<uninitialized>]
|
||||
[ip=<uninitialized>, ip6=[class=0, flow=0, len=59, nxt=0, hlim=64, src=2001:4f8:4:7:2e0:81ff:fe52:ffff, dst=2001:4f8:4:7:2e0:81ff:fe52:9a6b, exts=[[id=0, hopopts=[nxt=43, len=0, options=[[otype=1, len=4, data=\x00\x00\x00\x00]]], dstopts=<uninitialized>, routing=<uninitialized>, fragment=<uninitialized>, ah=<uninitialized>, esp=<uninitialized>, mobility=<uninitialized>], [id=43, hopopts=<uninitialized>, dstopts=<uninitialized>, routing=[nxt=17, len=4, rtype=0, segleft=2, data=\x00\x00\x00\x00 \x01\x00x\x00\x01\x002\x00\x00\x00\x00\x00\x00\x00\x01 \x01\x00x\x00\x01\x002\x00\x00\x00\x00\x00\x00\x00\x02], fragment=<uninitialized>, ah=<uninitialized>, esp=<uninitialized>, mobility=<uninitialized>]]], tcp=<uninitialized>, udp=[sport=53/udp, dport=53/udp, ulen=11], icmp=<uninitialized>]
|
||||
|
|
|
|||
|
|
@ -0,0 +1,5 @@
|
|||
clone keys, [status=BrokerStore::SUCCESS, result=[d=broker::data{[one, two, myset, myvec]}]]
|
||||
lookup, one, [status=BrokerStore::SUCCESS, result=[d=broker::data{111}]]
|
||||
lookup, two, [status=BrokerStore::SUCCESS, result=[d=broker::data{222}]]
|
||||
lookup, myset, [status=BrokerStore::SUCCESS, result=[d=broker::data{{a, c, d}}]]
|
||||
lookup, myvec, [status=BrokerStore::SUCCESS, result=[d=broker::data{[delta, alpha, beta, gamma, omega]}]]
|
||||
99
testing/btest/Baseline/core.leaks.broker.data/bro..stdout
Normal file
99
testing/btest/Baseline/core.leaks.broker.data/bro..stdout
Normal file
|
|
@ -0,0 +1,99 @@
|
|||
BrokerComm::BOOL
|
||||
BrokerComm::INT
|
||||
BrokerComm::COUNT
|
||||
BrokerComm::DOUBLE
|
||||
BrokerComm::STRING
|
||||
BrokerComm::ADDR
|
||||
BrokerComm::SUBNET
|
||||
BrokerComm::PORT
|
||||
BrokerComm::TIME
|
||||
BrokerComm::INTERVAL
|
||||
BrokerComm::ENUM
|
||||
BrokerComm::SET
|
||||
BrokerComm::TABLE
|
||||
BrokerComm::VECTOR
|
||||
BrokerComm::RECORD
|
||||
***************************
|
||||
T
|
||||
F
|
||||
1
|
||||
0
|
||||
-1
|
||||
1
|
||||
0
|
||||
1.1
|
||||
-11.1
|
||||
hello
|
||||
1.2.3.4
|
||||
192.168.0.0/16
|
||||
22/tcp
|
||||
42.0
|
||||
180.0
|
||||
BrokerComm::BOOL
|
||||
***************************
|
||||
{
|
||||
two,
|
||||
one,
|
||||
three
|
||||
}
|
||||
0
|
||||
T
|
||||
1
|
||||
T
|
||||
F
|
||||
T
|
||||
2
|
||||
T
|
||||
1
|
||||
F
|
||||
{
|
||||
bye
|
||||
}
|
||||
0
|
||||
***************************
|
||||
{
|
||||
[two] = 2,
|
||||
[one] = 1,
|
||||
[three] = 3
|
||||
}
|
||||
0
|
||||
[d=<uninitialized>]
|
||||
1
|
||||
T
|
||||
42
|
||||
F
|
||||
[d=<uninitialized>]
|
||||
2
|
||||
[d=broker::data{7}]
|
||||
2
|
||||
37
|
||||
[d=broker::data{42}]
|
||||
1
|
||||
***************************
|
||||
[zero, one, two]
|
||||
0
|
||||
T
|
||||
T
|
||||
T
|
||||
T
|
||||
[hi, salutations, hello, greetings]
|
||||
4
|
||||
[d=broker::data{hello}]
|
||||
[d=broker::data{bah}]
|
||||
[d=broker::data{hi}]
|
||||
[hi, salutations, bah, greetings]
|
||||
[d=broker::data{bah}]
|
||||
[hi, salutations, greetings]
|
||||
3
|
||||
***************************
|
||||
[a=<uninitialized>, b=bee, c=1]
|
||||
[a=test, b=bee, c=1]
|
||||
[a=test, b=testagain, c=1]
|
||||
3
|
||||
T
|
||||
T
|
||||
T
|
||||
[d=broker::data{hi}]
|
||||
[d=broker::data{hello}]
|
||||
[d=broker::data{37}]
|
||||
3
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
lookup(two): [status=BrokerStore::SUCCESS, result=[d=broker::data{222}]]
|
||||
lookup(four): [status=BrokerStore::SUCCESS, result=[d=<uninitialized>]]
|
||||
lookup(myset): [status=BrokerStore::SUCCESS, result=[d=broker::data{{a, c, d}}]]
|
||||
lookup(one): [status=BrokerStore::SUCCESS, result=[d=broker::data{111}]]
|
||||
lookup(myvec): [status=BrokerStore::SUCCESS, result=[d=broker::data{[delta, alpha, beta, gamma, omega]}]]
|
||||
exists(one): [status=BrokerStore::SUCCESS, result=[d=broker::data{1}]]
|
||||
exists(two): [status=BrokerStore::SUCCESS, result=[d=broker::data{0}]]
|
||||
exists(myset): [status=BrokerStore::SUCCESS, result=[d=broker::data{1}]]
|
||||
exists(four): [status=BrokerStore::SUCCESS, result=[d=broker::data{0}]]
|
||||
pop_right(myvec): [status=BrokerStore::SUCCESS, result=[d=broker::data{omega}]]
|
||||
pop_left(myvec): [status=BrokerStore::SUCCESS, result=[d=broker::data{delta}]]
|
||||
keys: [status=BrokerStore::SUCCESS, result=[d=broker::data{[myvec, myset, one]}]]
|
||||
size: [status=BrokerStore::SUCCESS, result=[d=broker::data{3}]]
|
||||
size (after clear): [status=BrokerStore::SUCCESS, result=[d=broker::data{0}]]
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
got event msg, ping, 0
|
||||
got event msg, ping, 1
|
||||
got event msg, ping, 2
|
||||
got event msg, ping, 3
|
||||
got event msg, ping, 4
|
||||
got event msg, ping, 5
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
BrokerComm::outgoing_connection_established, 127.0.0.1, 9999/tcp
|
||||
got event msg, pong, 0
|
||||
got auto event msg, ping, 0
|
||||
got event msg, pong, 1
|
||||
got auto event msg, ping, 1
|
||||
got event msg, pong, 2
|
||||
got auto event msg, ping, 2
|
||||
got event msg, pong, 3
|
||||
got auto event msg, ping, 3
|
||||
got event msg, pong, 4
|
||||
got auto event msg, ping, 4
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
wrote log, [msg=ping, num=0]
|
||||
wrote log, [msg=ping, num=1]
|
||||
wrote log, [msg=ping, num=2]
|
||||
wrote log, [msg=ping, num=3]
|
||||
wrote log, [msg=ping, num=4]
|
||||
wrote log, [msg=ping, num=5]
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path test
|
||||
#open 2015-02-12-17-33-13
|
||||
#fields msg num
|
||||
#types string count
|
||||
ping 0
|
||||
ping 1
|
||||
ping 2
|
||||
ping 3
|
||||
ping 4
|
||||
ping 5
|
||||
#close 2015-02-12-17-33-14
|
||||
|
|
@ -0,0 +1 @@
|
|||
BrokerComm::outgoing_connection_established, 127.0.0.1, 9999/tcp
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path test
|
||||
#open 2015-02-12-17-33-13
|
||||
#fields msg num
|
||||
#types string count
|
||||
ping 0
|
||||
ping 1
|
||||
ping 2
|
||||
ping 3
|
||||
ping 4
|
||||
ping 5
|
||||
#close 2015-02-12-17-33-15
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
got print msg, ping 0
|
||||
got print msg, ping 1
|
||||
got print msg, ping 2
|
||||
got print msg, ping 3
|
||||
got print msg, ping 4
|
||||
got print msg, ping 5
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
BrokerComm::outgoing_connection_established, 127.0.0.1, 9999/tcp
|
||||
got print msg, pong 0
|
||||
got print msg, pong 1
|
||||
got print msg, pong 2
|
||||
got print msg, pong 3
|
||||
got print msg, pong 4
|
||||
|
|
@ -3,8 +3,8 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2015-02-23-21-32-49
|
||||
#open 2015-03-30-21-38-30
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1278600802.069419 CXWv6p3arKYeMETxOg 10.20.80.1 50343 10.0.0.15 80 tcp - 0.004152 9 3429 SF - - 0 ShADadfF 7 381 7 3801 (empty)
|
||||
#close 2015-02-23-21-32-49
|
||||
#close 2015-03-30-21-38-30
|
||||
|
|
|
|||
|
|
@ -3,28 +3,28 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path packet_filter
|
||||
#open 2013-10-24-18-53-49
|
||||
#open 2015-03-30-21-38-29
|
||||
#fields ts node filter init success
|
||||
#types time string string bool bool
|
||||
1382640829.338079 bro ip or not ip T T
|
||||
#close 2013-10-24-18-53-49
|
||||
1427751509.034738 bro ip or not ip T T
|
||||
#close 2015-03-30-21-38-29
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path packet_filter
|
||||
#open 2013-10-24-18-53-49
|
||||
#open 2015-03-30-21-38-29
|
||||
#fields ts node filter init success
|
||||
#types time string string bool bool
|
||||
1382640829.495639 bro port 42 T T
|
||||
#close 2013-10-24-18-53-49
|
||||
1427751509.711080 bro port 42 T T
|
||||
#close 2015-03-30-21-38-29
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path packet_filter
|
||||
#open 2013-10-24-18-53-49
|
||||
#open 2015-03-30-21-38-30
|
||||
#fields ts node filter init success
|
||||
#types time string string bool bool
|
||||
1382640829.653368 bro (vlan) and (ip or not ip) T T
|
||||
#close 2013-10-24-18-53-49
|
||||
1427751510.380510 bro (vlan) and (ip or not ip) T T
|
||||
#close 2015-03-30-21-38-30
|
||||
|
|
|
|||
|
|
@ -13,9 +13,11 @@
|
|||
1 2811
|
||||
1 3128
|
||||
1 3306
|
||||
1 3389
|
||||
1 3544
|
||||
1 443
|
||||
2 443
|
||||
1 502
|
||||
1 5060
|
||||
1 5072
|
||||
1 514
|
||||
1 5223
|
||||
|
|
@ -38,14 +40,15 @@
|
|||
1 8000
|
||||
1 8080
|
||||
1 81
|
||||
2 88
|
||||
1 8888
|
||||
1 989
|
||||
1 990
|
||||
1 992
|
||||
1 993
|
||||
1 995
|
||||
49 and
|
||||
48 or
|
||||
49 port
|
||||
34 tcp
|
||||
15 udp
|
||||
54 and
|
||||
53 or
|
||||
54 port
|
||||
36 tcp
|
||||
18 udp
|
||||
|
|
|
|||
11
testing/btest/Baseline/core.radiotap/conn.log
Normal file
11
testing/btest/Baseline/core.radiotap/conn.log
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2016-01-19-09-01-31
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1439902891.705224 CXWv6p3arKYeMETxOg 172.17.156.76 61738 208.67.220.220 53 udp dns 0.041654 35 128 SF - - 0 Dd 1 63 1 156 (empty)
|
||||
1439903050.580632 CjhGID4nQcgTWjvg4c fe80::a667:6ff:fef7:ec54 5353 ff02::fb 5353 udp dns - - - S0 - - 0 D 1 328 0 0 (empty)
|
||||
#close 2016-01-19-09-01-31
|
||||
44
testing/btest/Baseline/core.raw_packet/output
Normal file
44
testing/btest/Baseline/core.raw_packet/output
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
[l2=[encap=LINK_ETHERNET, len=215, cap_len=215, src=e8:de:27:ff:c0:78, dst=ff:ff:ff:ff:ff:ff, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=201, id=0, ttl=64, p=17, src=192.168.1.1, dst=255.255.255.255], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=40190/udp, dport=7437/udp, ulen=181], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=68, cap_len=68, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=54, id=52261, ttl=64, p=6, src=192.168.1.103, dst=64.4.23.176], ip6=<uninitialized>, tcp=[sport=65493/tcp, dport=40031/tcp, seq=2642773190, ack=2891276360, hl=32, dl=2, flags=24, win=4096], udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=78, cap_len=78, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=64, id=32575, ttl=64, p=17, src=192.168.1.103, dst=192.168.1.1], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=65170/udp, dport=53/udp, ulen=44], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=78, cap_len=78, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=64, id=55466, ttl=64, p=17, src=192.168.1.103, dst=192.168.1.1], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=53129/udp, dport=53/udp, ulen=44], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=92, cap_len=92, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=78, id=32240, ttl=64, p=17, src=192.168.1.103, dst=192.168.1.1], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=53129/udp, dport=53/udp, ulen=58], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=85, cap_len=85, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=71, id=53895, ttl=64, p=17, src=192.168.1.103, dst=192.168.1.1], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=57932/udp, dport=53/udp, ulen=51], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=42, cap_len=42, src=00:50:56:3e:93:6b, dst=ff:ff:ff:ff:ff:ff, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2054, proto=L3_ARP], ip=<uninitialized>, ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=42, cap_len=42, src=00:50:56:3e:93:6b, dst=ff:ff:ff:ff:ff:ff, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2054, proto=L3_ARP], ip=<uninitialized>, ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=307, cap_len=307, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=293, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=273], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=316, cap_len=316, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=302, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=282], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=379, cap_len=379, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=365, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=345], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=371, cap_len=371, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=357, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=337], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=355, cap_len=355, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=341, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=321], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=42, cap_len=42, src=00:50:56:3e:93:6b, dst=ff:ff:ff:ff:ff:ff, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2054, proto=L3_ARP], ip=<uninitialized>, ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=387, cap_len=387, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=373, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=353], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=316, cap_len=316, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=302, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=282], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=375, cap_len=375, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=361, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=341], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=369, cap_len=369, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=355, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=335], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=316, cap_len=316, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=302, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=282], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=371, cap_len=371, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=357, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=337], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=381, cap_len=381, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=367, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=45335/udp, dport=1900/udp, ulen=347], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=215, cap_len=215, src=e8:de:27:ff:c0:78, dst=ff:ff:ff:ff:ff:ff, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=201, id=0, ttl=64, p=17, src=192.168.1.1, dst=255.255.255.255], ip6=<uninitialized>, tcp=<uninitialized>, udp=[sport=40190/udp, dport=7437/udp, ulen=181], icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=98, cap_len=98, src=00:50:56:3e:93:6b, dst=e8:de:27:ff:c0:78, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=84, id=29257, ttl=64, p=1, src=192.168.1.104, dst=192.168.1.1], ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=[icmp_type=8]]
|
||||
[l2=[encap=LINK_ETHERNET, len=98, cap_len=98, src=e8:de:27:ff:c0:78, dst=00:50:56:3e:93:6b, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=84, id=3684, ttl=64, p=1, src=192.168.1.1, dst=192.168.1.104], ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=[icmp_type=0]]
|
||||
[l2=[encap=LINK_ETHERNET, len=112, cap_len=112, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=98, id=56893, ttl=64, p=6, src=192.168.1.103, dst=74.125.21.138], ip6=<uninitialized>, tcp=[sport=49171/tcp, dport=443/tcp, seq=3725176031, ack=445274592, hl=32, dl=46, flags=24, win=4096], udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=22643, ttl=64, p=6, src=192.168.1.103, dst=74.125.21.138], ip6=<uninitialized>, tcp=[sport=49171/tcp, dport=443/tcp, seq=3725176077, ack=445274652, hl=32, dl=0, flags=16, win=4094], udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=112, cap_len=112, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=98, id=85, ttl=64, p=6, src=192.168.1.103, dst=74.125.21.138], ip6=<uninitialized>, tcp=[sport=49171/tcp, dport=443/tcp, seq=3725176077, ack=445274652, hl=32, dl=46, flags=24, win=4096], udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=97, cap_len=97, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=83, id=28558, ttl=64, p=6, src=192.168.1.103, dst=74.125.21.138], ip6=<uninitialized>, tcp=[sport=49171/tcp, dport=443/tcp, seq=3725176123, ack=445274652, hl=32, dl=31, flags=24, win=4096], udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=<uninitialized>, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=36529, ttl=64, p=6, src=192.168.1.103, dst=74.125.21.138], ip6=<uninitialized>, tcp=[sport=49171/tcp, dport=443/tcp, seq=3725176154, ack=445274652, hl=32, dl=0, flags=17, win=4096], udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=64, cap_len=64, src=00:19:06:ea:b8:c1, dst=ff:ff:ff:ff:ff:ff, vlan=123, inner_vlan=<uninitialized>, eth_type=2054, proto=L3_ARP], ip=<uninitialized>, ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=64, cap_len=64, src=00:18:73:de:57:c1, dst=ff:ff:ff:ff:ff:ff, vlan=123, inner_vlan=<uninitialized>, eth_type=2054, proto=L3_ARP], ip=<uninitialized>, ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=64, cap_len=64, src=00:18:73:de:57:c1, dst=ff:ff:ff:ff:ff:ff, vlan=123, inner_vlan=<uninitialized>, eth_type=2054, proto=L3_ARP], ip=<uninitialized>, ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=64, cap_len=64, src=00:19:06:ea:b8:c1, dst=00:18:73:de:57:c1, vlan=123, inner_vlan=<uninitialized>, eth_type=2054, proto=L3_ARP], ip=<uninitialized>, ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=118, cap_len=118, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=100, id=5, ttl=255, p=1, src=192.168.123.2, dst=192.168.123.1], ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=[icmp_type=8]]
|
||||
[l2=[encap=LINK_ETHERNET, len=64, cap_len=64, src=00:19:06:ea:b8:c1, dst=ff:ff:ff:ff:ff:ff, vlan=123, inner_vlan=<uninitialized>, eth_type=2054, proto=L3_ARP], ip=<uninitialized>, ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=64, cap_len=64, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, inner_vlan=<uninitialized>, eth_type=2054, proto=L3_ARP], ip=<uninitialized>, ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=<uninitialized>]
|
||||
[l2=[encap=LINK_ETHERNET, len=118, cap_len=118, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=100, id=6, ttl=255, p=1, src=192.168.123.2, dst=192.168.123.1], ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=[icmp_type=8]]
|
||||
[l2=[encap=LINK_ETHERNET, len=118, cap_len=118, src=00:19:06:ea:b8:c1, dst=00:18:73:de:57:c1, vlan=123, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=100, id=6, ttl=255, p=1, src=192.168.123.1, dst=192.168.123.2], ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=[icmp_type=0]]
|
||||
[l2=[encap=LINK_ETHERNET, len=118, cap_len=118, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=100, id=7, ttl=255, p=1, src=192.168.123.2, dst=192.168.123.1], ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=[icmp_type=8]]
|
||||
[l2=[encap=LINK_ETHERNET, len=118, cap_len=118, src=00:19:06:ea:b8:c1, dst=00:18:73:de:57:c1, vlan=123, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=100, id=7, ttl=255, p=1, src=192.168.123.1, dst=192.168.123.2], ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=[icmp_type=0]]
|
||||
[l2=[encap=LINK_ETHERNET, len=118, cap_len=118, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=100, id=8, ttl=255, p=1, src=192.168.123.2, dst=192.168.123.1], ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=[icmp_type=8]]
|
||||
[l2=[encap=LINK_ETHERNET, len=118, cap_len=118, src=00:19:06:ea:b8:c1, dst=00:18:73:de:57:c1, vlan=123, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=100, id=8, ttl=255, p=1, src=192.168.123.1, dst=192.168.123.2], ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=[icmp_type=0]]
|
||||
[l2=[encap=LINK_ETHERNET, len=118, cap_len=118, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=100, id=9, ttl=255, p=1, src=192.168.123.2, dst=192.168.123.1], ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=[icmp_type=8]]
|
||||
[l2=[encap=LINK_ETHERNET, len=118, cap_len=118, src=00:19:06:ea:b8:c1, dst=00:18:73:de:57:c1, vlan=123, inner_vlan=<uninitialized>, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=100, id=9, ttl=255, p=1, src=192.168.123.1, dst=192.168.123.2], ip6=<uninitialized>, tcp=<uninitialized>, udp=<uninitialized>, icmp=[icmp_type=0]]
|
||||
32
testing/btest/Baseline/core.reassembly/output
Normal file
32
testing/btest/Baseline/core.reassembly/output
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
----------------------
|
||||
flow weird, excessively_small_fragment, 164.1.123.163, 164.1.123.61
|
||||
flow weird, fragment_size_inconsistency, 164.1.123.163, 164.1.123.61
|
||||
flow weird, fragment_inconsistency, 164.1.123.163, 164.1.123.61
|
||||
flow weird, fragment_inconsistency, 164.1.123.163, 164.1.123.61
|
||||
flow weird, dns_unmatched_msg, 164.1.123.163, 164.1.123.61
|
||||
----------------------
|
||||
flow weird, excessively_small_fragment, 164.1.123.163, 164.1.123.61
|
||||
flow weird, excessively_small_fragment, 164.1.123.163, 164.1.123.61
|
||||
flow weird, fragment_overlap, 164.1.123.163, 164.1.123.61
|
||||
----------------------
|
||||
flow weird, fragment_with_DF, 210.54.213.247, 131.243.1.10
|
||||
flow weird, fragment_with_DF, 210.54.213.247, 131.243.1.10
|
||||
flow weird, fragment_with_DF, 210.54.213.247, 131.243.1.10
|
||||
flow weird, fragment_with_DF, 210.54.213.247, 131.243.1.10
|
||||
flow weird, fragment_with_DF, 210.54.213.247, 131.243.1.10
|
||||
----------------------
|
||||
flow weird, excessively_small_fragment, 128.32.46.142, 10.0.0.1
|
||||
flow weird, excessively_small_fragment, 128.32.46.142, 10.0.0.1
|
||||
flow weird, fragment_inconsistency, 128.32.46.142, 10.0.0.1
|
||||
----------------------
|
||||
net_weird, truncated_IP
|
||||
net_weird, truncated_IP
|
||||
net_weird, truncated_IP
|
||||
net_weird, truncated_IP
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliidlhd, A
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], dgphrodofqhq, orgmmpelofil, A
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], lenhfdqhqfgs, dfpqssidkpdg, A
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliislrr, A
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], iokgedlsdkjkiefgmeqkfjoh, ggdeolssksemrhedoledddml, A
|
||||
net_weird, truncated_IP
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO HTTP/1.1\x0d\x0aHost: 127.0.0.1\x0d\x0aContent-Type: text/xml\x0d\x0aContent-length: 1\x0d\x0a\x0d\x0aO<?xml version="1.0"?>\x0d\x0a<g:searchrequest xmlns:g=, OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO HTTP/1.1\x0d\x0aHost: 127.0.0.1\x0d\x0aContent-Type: text/xml\x0d\x0aContent-length: 1\x0d\x0a\x0d\x0aO<?xml version="1.0"?igplqgeqsonkllfshdjplhjspmde, AP
|
||||
|
|
@ -3,10 +3,10 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2015-02-23-21-32-56
|
||||
#open 2015-04-15-23-53-28
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1395939406.175845 CjhGID4nQcgTWjvg4c 192.168.56.1 59763 192.168.56.101 63988 tcp ftp-data 0.001676 0 270 SF - - 0 ShAdfFa 5 272 4 486 (empty)
|
||||
1395939411.361078 CCvvfg3TEfuqmmG4bh 192.168.56.1 59764 192.168.56.101 37150 tcp ftp-data 150.496065 0 5416666670 SF - - 4675708816 ShAdfFa 13 688 12 24454 (empty)
|
||||
1395939399.984671 CXWv6p3arKYeMETxOg 192.168.56.1 59762 192.168.56.101 21 tcp ftp 169.634297 104 1041 SF - - 0 ShAdDaFf 31 1728 18 1985 (empty)
|
||||
#close 2015-02-23-21-32-56
|
||||
#close 2015-04-15-23-53-28
|
||||
|
|
|
|||
|
|
@ -3,9 +3,9 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path files
|
||||
#open 2014-04-09-16-44-53
|
||||
#open 2015-04-15-23-53-28
|
||||
#fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted
|
||||
#types time string set[addr] set[addr] set[string] string count set[string] string string interval bool bool count count count count bool string string string string string
|
||||
1395939406.177079 FAb5m22Dhe2Zi95anf 192.168.56.101 192.168.56.1 CjhGID4nQcgTWjvg4c FTP_DATA 0 DATA_EVENT text/plain - 0.000000 - F 270 - 0 0 F - - - - -
|
||||
1395939411.364462 FhI0ao2FNTjabdfSBd 192.168.56.101 192.168.56.1 CCvvfg3TEfuqmmG4bh FTP_DATA 0 DATA_EVENT text/plain - 150.490904 - F 23822 - 5416642848 0 F - - - - -
|
||||
#close 2014-04-09-16-44-54
|
||||
#close 2015-04-15-23-53-28
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
5
testing/btest/Baseline/core.tcp.quantum-insert/.stdout
Normal file
5
testing/btest/Baseline/core.tcp.quantum-insert/.stdout
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
----- rexmit_inconsistency -----
|
||||
1429652006.683290 c: [orig_h=178.200.100.200, orig_p=39976/tcp, resp_h=96.126.98.124, resp_p=80/tcp]
|
||||
1429652006.683290 t1: HTTP/1.1 200 OK\x0d\x0aContent-Length: 5\x0d\x0a\x0d\x0aBANG!
|
||||
1429652006.683290 t2: HTTP/1.1 200 OK\x0d\x0aServer: nginx/1.4.4\x0d\x0aDate:
|
||||
1429652006.683290 tcp_flags: AP
|
||||
23
testing/btest/Baseline/core.tcp.truncated-header/out
Normal file
23
testing/btest/Baseline/core.tcp.truncated-header/out
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
1103139821.635001, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139821.833528, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139821.841126, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.039902, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.040151, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.040254, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.040878, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.240529, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.240632, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.247627, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.450278, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.450381, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.453253, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.65178, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.651883, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.652756, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.882264, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.933982, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.934084, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.934209, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.934214, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139823.145731, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139823.145958, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
|
|
@ -3,38 +3,48 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2012-04-11-16-01-35
|
||||
#open 2015-08-31-21-35-27
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1334160095.895421 - - - - - truncated_IP - F bro
|
||||
#close 2012-04-11-16-01-35
|
||||
#close 2015-08-31-21-35-27
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2012-04-11-14-57-21
|
||||
#open 2015-08-31-21-35-27
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1334156241.519125 - - - - - truncated_IP - F bro
|
||||
#close 2012-04-11-14-57-21
|
||||
#close 2015-08-31-21-35-27
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2012-04-10-21-50-48
|
||||
#open 2015-08-31-21-35-28
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1334094648.590126 - - - - - truncated_IP - F bro
|
||||
#close 2012-04-10-21-50-48
|
||||
#close 2015-08-31-21-35-28
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2012-05-29-22-02-34
|
||||
#open 2015-08-31-21-35-30
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1338328954.078361 - - - - - internally_truncated_header - F bro
|
||||
#close 2012-05-29-22-02-34
|
||||
#close 2015-08-31-21-35-30
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2015-08-31-21-35-30
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
0.000000 - - - - - truncated_link_header - F bro
|
||||
#close 2015-08-31-21-35-30
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2015-02-23-21-33-02
|
||||
#open 2016-01-15-18-40-13
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1257655301.595604 CIPOse170MGiRM1Qf4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 tcp http 2.101052 2981 4665 S1 - - 0 ShADad 10 3605 11 5329 CCvvfg3TEfuqmmG4bh
|
||||
|
|
@ -14,4 +14,4 @@
|
|||
1257655296.585188 CPbrpk1qSsw6ESzHV4 fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff00:2 130 icmp - 0.919988 32 0 OTH - - 0 - 2 144 0 0 CCvvfg3TEfuqmmG4bh
|
||||
1257655296.585151 CRJuHdVW0XPVINV8a fe80::216:cbff:fe9a:4cb9 131 ff02::2:f901:d225 130 icmp - 0.719947 32 0 OTH - - 0 - 2 144 0 0 CCvvfg3TEfuqmmG4bh
|
||||
1257655296.585034 CsRx2w45OKnoww6xl4 fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff9a:4cb9 130 icmp - 4.922880 32 0 OTH - - 0 - 2 144 0 0 CCvvfg3TEfuqmmG4bh
|
||||
#close 2015-02-23-21-33-02
|
||||
#close 2016-01-15-18-40-13
|
||||
|
|
|
|||
|
|
@ -3,10 +3,10 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path http
|
||||
#open 2014-04-01-22-56-43
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
|
||||
1257655301.652206 CIPOse170MGiRM1Qf4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 10102 200 OK - - - (empty) - - - - - FYAtjT24MvCBUs5K5f text/html
|
||||
1257655302.514424 CIPOse170MGiRM1Qf4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 2 GET ipv6.google.com /csi?v=3&s=webhp&action=&tran=undefined&e=17259,19771,21517,21766,21887,22212&ei=BUz2Su7PMJTglQfz3NzCAw&rt=prt.77,xjs.565,ol.645 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - - -
|
||||
1257655303.603569 CIPOse170MGiRM1Qf4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 3 GET ipv6.google.com /gen_204?atyp=i&ct=fade&cad=1254&ei=BUz2Su7PMJTglQfz3NzCAw&zx=1257655303600 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - - -
|
||||
#close 2014-04-01-22-56-43
|
||||
#open 2016-01-15-18-40-13
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
|
||||
1257655301.652206 CIPOse170MGiRM1Qf4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 1 GET ipv6.google.com / - 1.1 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 10102 200 OK - - - (empty) - - - - - FYAtjT24MvCBUs5K5f text/html
|
||||
1257655302.514424 CIPOse170MGiRM1Qf4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 2 GET ipv6.google.com /csi?v=3&s=webhp&action=&tran=undefined&e=17259,19771,21517,21766,21887,22212&ei=BUz2Su7PMJTglQfz3NzCAw&rt=prt.77,xjs.565,ol.645 http://ipv6.google.com/ 1.1 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - - -
|
||||
1257655303.603569 CIPOse170MGiRM1Qf4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 3 GET ipv6.google.com /gen_204?atyp=i&ct=fade&cad=1254&ei=BUz2Su7PMJTglQfz3NzCAw&zx=1257655303600 http://ipv6.google.com/ 1.1 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - - -
|
||||
#close 2016-01-15-18-40-13
|
||||
|
|
|
|||
|
|
@ -3,11 +3,11 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path tunnel
|
||||
#open 2013-08-26-19-02-15
|
||||
#open 2016-01-15-18-40-13
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||
#types time string addr port addr port enum enum
|
||||
1257655293.629048 CXWv6p3arKYeMETxOg 192.168.3.101 53796 216.14.98.22 5072 Tunnel::AYIYA Tunnel::DISCOVER
|
||||
1257655296.585034 CCvvfg3TEfuqmmG4bh 192.168.3.101 53859 216.14.98.22 5072 Tunnel::AYIYA Tunnel::DISCOVER
|
||||
1257655317.464035 CCvvfg3TEfuqmmG4bh 192.168.3.101 53859 216.14.98.22 5072 Tunnel::AYIYA Tunnel::CLOSE
|
||||
1257655317.464035 CXWv6p3arKYeMETxOg 192.168.3.101 53796 216.14.98.22 5072 Tunnel::AYIYA Tunnel::CLOSE
|
||||
#close 2013-08-26-19-02-15
|
||||
#close 2016-01-15-18-40-13
|
||||
|
|
|
|||
|
|
@ -1,15 +0,0 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2009-11-18-17-59-51
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1258567191.405770 - - - - - truncated_header_in_tunnel - F bro
|
||||
1258578181.260420 - - - - - truncated_header_in_tunnel - F bro
|
||||
1258579063.557927 - - - - - truncated_header_in_tunnel - F bro
|
||||
1258581768.568451 - - - - - truncated_header_in_tunnel - F bro
|
||||
1258584478.859853 - - - - - truncated_header_in_tunnel - F bro
|
||||
1258600683.934458 - - - - - truncated_header_in_tunnel - F bro
|
||||
#close 2009-11-19-03-18-03
|
||||
|
|
@ -6,6 +6,6 @@
|
|||
#open 2014-01-16-21-51-36
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||
#types time string addr port addr port enum enum
|
||||
1341436424.204043 CXWv6p3arKYeMETxOg 72.205.54.70 0 86.106.164.150 0 Tunnel::IP Tunnel::DISCOVER
|
||||
1341436424.204043 CjhGID4nQcgTWjvg4c 10.10.11.2 0 10.10.13.2 0 Tunnel::IP Tunnel::DISCOVER
|
||||
1341436424.204043 CXWv6p3arKYeMETxOg 72.205.54.70 0 86.106.164.150 0 Tunnel::GRE Tunnel::DISCOVER
|
||||
1341436424.204043 CjhGID4nQcgTWjvg4c 10.10.11.2 0 10.10.13.2 0 Tunnel::GRE Tunnel::DISCOVER
|
||||
#close 2014-01-16-21-51-36
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path ssh
|
||||
#open 2014-01-16-21-51-12
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p status direction client server
|
||||
#types time string addr port addr port string enum string string
|
||||
1055289978.855137 CsRx2w45OKnoww6xl4 66.59.111.190 40264 172.28.2.3 22 failure INBOUND SSH-2.0-OpenSSH_3.6.1p1 SSH-1.99-OpenSSH_3.1p1
|
||||
#close 2014-01-16-21-51-12
|
||||
#open 2015-03-17-17-42-58
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version auth_success direction client server cipher_alg mac_alg compression_alg kex_alg host_key_alg host_key
|
||||
#types time string addr port addr port count bool enum string string string string string string string string
|
||||
1055289978.855543 CsRx2w45OKnoww6xl4 66.59.111.190 40264 172.28.2.3 22 2 - - SSH-2.0-OpenSSH_3.6.1p1 SSH-1.99-OpenSSH_3.1p1 aes128-cbc hmac-md5 none diffie-hellman-group-exchange-sha1 ssh-rsa 20:7c:e5:96:b0:4e:ce:a4:db:e4:aa:29:e8:90:98:07
|
||||
#close 2015-03-17-17-42-59
|
||||
|
|
|
|||
|
|
@ -6,5 +6,5 @@
|
|||
#open 2014-01-16-21-51-12
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||
#types time string addr port addr port enum enum
|
||||
1055289968.793044 CXWv6p3arKYeMETxOg 172.27.1.66 0 66.59.109.137 0 Tunnel::IP Tunnel::DISCOVER
|
||||
1055289968.793044 CXWv6p3arKYeMETxOg 172.27.1.66 0 66.59.109.137 0 Tunnel::GRE Tunnel::DISCOVER
|
||||
#close 2014-01-16-21-51-12
|
||||
|
|
|
|||
|
|
@ -3,10 +3,10 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2015-02-23-21-33-07
|
||||
#open 2016-01-15-18-40-14
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1333458850.321642 CjhGID4nQcgTWjvg4c 10.131.17.170 51803 173.199.115.168 80 tcp http 0.257902 1138 63424 S3 - - 0 ShADadf 29 2310 49 65396 CXWv6p3arKYeMETxOg,CCvvfg3TEfuqmmG4bh
|
||||
1333458850.325787 CCvvfg3TEfuqmmG4bh 207.233.125.40 2152 167.55.105.244 2152 udp gtpv1 0.251127 65788 0 S0 - - 0 D 49 67160 0 0 (empty)
|
||||
1333458850.321642 CXWv6p3arKYeMETxOg 167.55.105.244 5906 207.233.125.40 2152 udp gtpv1 0.257902 2542 0 S0 - - 0 D 29 3354 0 0 (empty)
|
||||
#close 2015-02-23-21-33-07
|
||||
#close 2016-01-15-18-40-14
|
||||
|
|
|
|||
|
|
@ -3,9 +3,9 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path http
|
||||
#open 2014-04-01-22-56-58
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
|
||||
1333458850.340368 CjhGID4nQcgTWjvg4c 10.131.17.170 51803 173.199.115.168 80 1 GET cdn.epicgameads.com /ads/flash/728x90_nx8com.swf?clickTAG=http://www.epicgameads.com/ads/bannerclickPage.php?id=e3ubwU6IF&pd=1&adid=0&icpc=1&axid=0&uctt=1&channel=4&cac=1&t=728x90&cb=1333458879 http://www.epicgameads.com/ads/banneriframe.php?id=e3ubwU6IF&t=728x90&channel=4&cb=1333458905296 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 0 31461 200 OK - - - (empty) - - - - - FHKKd91EMHBEK0hbdg application/x-shockwave-flash
|
||||
1333458850.399501 CjhGID4nQcgTWjvg4c 10.131.17.170 51803 173.199.115.168 80 2 GET cdn.epicgameads.com /ads/flash/728x90_nx8com.swf?clickTAG=http://www.epicgameads.com/ads/bannerclickPage.php?id=e3ubwU6IF&pd=1&adid=0&icpc=1&axid=0&uctt=1&channel=0&cac=1&t=728x90&cb=1333458881 http://www.epicgameads.com/ads/banneriframe.php?id=e3ubwU6IF&t=728x90&cb=1333458920207 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 0 31461 200 OK - - - (empty) - - - - - Fu64Vqjy6nBop9nRd application/x-shockwave-flash
|
||||
#close 2014-04-01-22-56-58
|
||||
#open 2016-01-15-18-40-14
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
|
||||
1333458850.340368 CjhGID4nQcgTWjvg4c 10.131.17.170 51803 173.199.115.168 80 1 GET cdn.epicgameads.com /ads/flash/728x90_nx8com.swf?clickTAG=http://www.epicgameads.com/ads/bannerclickPage.php?id=e3ubwU6IF&pd=1&adid=0&icpc=1&axid=0&uctt=1&channel=4&cac=1&t=728x90&cb=1333458879 http://www.epicgameads.com/ads/banneriframe.php?id=e3ubwU6IF&t=728x90&channel=4&cb=1333458905296 1.1 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 0 31461 200 OK - - - (empty) - - - - - FHKKd91EMHBEK0hbdg application/x-shockwave-flash
|
||||
1333458850.399501 CjhGID4nQcgTWjvg4c 10.131.17.170 51803 173.199.115.168 80 2 GET cdn.epicgameads.com /ads/flash/728x90_nx8com.swf?clickTAG=http://www.epicgameads.com/ads/bannerclickPage.php?id=e3ubwU6IF&pd=1&adid=0&icpc=1&axid=0&uctt=1&channel=0&cac=1&t=728x90&cb=1333458881 http://www.epicgameads.com/ads/banneriframe.php?id=e3ubwU6IF&t=728x90&cb=1333458920207 1.1 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 0 31461 200 OK - - - (empty) - - - - - Fu64Vqjy6nBop9nRd application/x-shockwave-flash
|
||||
#close 2016-01-15-18-40-14
|
||||
|
|
|
|||
|
|
@ -3,11 +3,11 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path tunnel
|
||||
#open 2013-08-26-19-34-59
|
||||
#open 2016-01-15-18-40-14
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||
#types time string addr port addr port enum enum
|
||||
1333458850.321642 CXWv6p3arKYeMETxOg 167.55.105.244 5906 207.233.125.40 2152 Tunnel::GTPv1 Tunnel::DISCOVER
|
||||
1333458850.325787 CCvvfg3TEfuqmmG4bh 207.233.125.40 2152 167.55.105.244 2152 Tunnel::GTPv1 Tunnel::DISCOVER
|
||||
1333458850.579544 CCvvfg3TEfuqmmG4bh 207.233.125.40 2152 167.55.105.244 2152 Tunnel::GTPv1 Tunnel::CLOSE
|
||||
1333458850.579544 CXWv6p3arKYeMETxOg 167.55.105.244 5906 207.233.125.40 2152 Tunnel::GTPv1 Tunnel::CLOSE
|
||||
#close 2013-08-26-19-34-59
|
||||
#close 2016-01-15-18-40-14
|
||||
|
|
|
|||
|
|
@ -3,9 +3,9 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2015-02-23-21-33-13
|
||||
#open 2016-01-15-18-40-15
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1333458850.364667 CjhGID4nQcgTWjvg4c 10.131.47.185 1923 79.101.110.141 80 tcp http 0.069783 2100 56702 SF - - 0 ShADadfF 27 3204 41 52594 CXWv6p3arKYeMETxOg
|
||||
1333458850.364667 CXWv6p3arKYeMETxOg 239.114.155.111 2152 63.94.149.181 2152 udp gtpv1 0.069813 3420 52922 SF - - 0 Dd 27 4176 41 54070 (empty)
|
||||
#close 2015-02-23-21-33-14
|
||||
#close 2016-01-15-18-40-15
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path http
|
||||
#open 2014-04-01-22-57-15
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
|
||||
1333458850.375568 CjhGID4nQcgTWjvg4c 10.131.47.185 1923 79.101.110.141 80 1 GET o-o.preferred.telekomrs-beg1.v2.lscache8.c.youtube.com /videoplayback?upn=MTU2MDY5NzQ5OTM0NTI3NDY4NDc&sparams=algorithm,burst,cp,factor,id,ip,ipbits,itag,source,upn,expire&fexp=912300,907210&algorithm=throttle-factor&itag=34&ip=212.0.0.0&burst=40&sver=3&signature=832FB1042E20780CFCA77A4DB5EA64AC593E8627.D1166C7E8365732E52DAFD68076DAE0146E0AE01&source=youtube&expire=1333484980&key=yt1&ipbits=8&factor=1.25&cp=U0hSSFRTUl9NSkNOMl9MTVZKOjh5eEN2SG8tZF84&id=ebf1e932d4bd1286&cm2=1 http://s.ytimg.com/yt/swfbin/watch_as3-vflqrJwOA.swf Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.11 (KHTML, like Gecko; X-SBLSP) Chrome/17.0.963.83 Safari/535.11 0 56320 206 Partial Content - - - (empty) - - - - - FNJkBA1b8FSHt5N8jl -
|
||||
#close 2014-04-01-22-57-15
|
||||
#open 2016-01-15-18-40-15
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
|
||||
1333458850.375568 CjhGID4nQcgTWjvg4c 10.131.47.185 1923 79.101.110.141 80 1 GET o-o.preferred.telekomrs-beg1.v2.lscache8.c.youtube.com /videoplayback?upn=MTU2MDY5NzQ5OTM0NTI3NDY4NDc&sparams=algorithm,burst,cp,factor,id,ip,ipbits,itag,source,upn,expire&fexp=912300,907210&algorithm=throttle-factor&itag=34&ip=212.0.0.0&burst=40&sver=3&signature=832FB1042E20780CFCA77A4DB5EA64AC593E8627.D1166C7E8365732E52DAFD68076DAE0146E0AE01&source=youtube&expire=1333484980&key=yt1&ipbits=8&factor=1.25&cp=U0hSSFRTUl9NSkNOMl9MTVZKOjh5eEN2SG8tZF84&id=ebf1e932d4bd1286&cm2=1 http://s.ytimg.com/yt/swfbin/watch_as3-vflqrJwOA.swf 1.1 Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.11 (KHTML, like Gecko; X-SBLSP) Chrome/17.0.963.83 Safari/535.11 0 56320 206 Partial Content - - - (empty) - - - - - FNJkBA1b8FSHt5N8jl -
|
||||
#close 2016-01-15-18-40-15
|
||||
|
|
|
|||
|
|
@ -3,9 +3,9 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path tunnel
|
||||
#open 2013-08-26-19-35-01
|
||||
#open 2016-01-15-18-40-15
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||
#types time string addr port addr port enum enum
|
||||
1333458850.364667 CXWv6p3arKYeMETxOg 239.114.155.111 2152 63.94.149.181 2152 Tunnel::GTPv1 Tunnel::DISCOVER
|
||||
1333458850.434480 CXWv6p3arKYeMETxOg 239.114.155.111 2152 63.94.149.181 2152 Tunnel::GTPv1 Tunnel::CLOSE
|
||||
#close 2013-08-26-19-35-01
|
||||
#close 2016-01-15-18-40-15
|
||||
|
|
|
|||
|
|
@ -2,12 +2,12 @@ gtpv1_message, [orig_h=192.169.100.1, orig_p=34273/udp, resp_h=10.100.200.33, re
|
|||
[version=1, pt_flag=T, rsv=F, e_flag=F, s_flag=T, pn_flag=F, msg_type=16, length=137, teid=0, seq=4875, n_pdu=0, next_type=0]
|
||||
gtp create request, [orig_h=192.169.100.1, orig_p=34273/udp, resp_h=10.100.200.33, resp_p=2123/udp]
|
||||
[version=1, pt_flag=T, rsv=F, e_flag=F, s_flag=T, pn_flag=F, msg_type=16, length=137, teid=0, seq=4875, n_pdu=0, next_type=0]
|
||||
[imsi=460004100000101, rai=[mcc=460, mnc=6, lac=65534, rac=255], recovery=176, select_mode=1, data1=854600697, cp=854600697, nsapi=5, linked_nsapi=<uninitialized>, charge_character=<uninitialized>, trace_ref=<uninitialized>, trace_type=<uninitialized>, end_user_addr=[pdp_type_org=1, pdp_type_num=33, pdp_ip=<uninitialized>, pdp_other_addr=<uninitialized>], ap_name=^Feetest, opts=\x80\x80!^V^A^A\0^V^C^F\0\0\0\0\x81^F\0\0\0\0\x83^F\0\0\0\0, signal_addr=[ip=192.169.100.1, other=<uninitialized>], user_addr=[ip=192.169.100.1, other=<uninitialized>], msisdn=\x91hQ"^A\0^A\xf1, qos_prof=[priority=2, data=\x1bB\x1fs\x8c@@tK@@], tft=<uninitialized>, trigger_id=<uninitialized>, omc_id=<uninitialized>, ext=[id=10923, value=^B^A^C]]
|
||||
[imsi=460004100000101, rai=[mcc=460, mnc=6, lac=65534, rac=255], recovery=176, select_mode=1, data1=854600697, cp=854600697, nsapi=5, linked_nsapi=<uninitialized>, charge_character=<uninitialized>, trace_ref=<uninitialized>, trace_type=<uninitialized>, end_user_addr=[pdp_type_org=1, pdp_type_num=33, pdp_ip=<uninitialized>, pdp_other_addr=<uninitialized>], ap_name=\x06eetest, opts=\x80\x80!\x16\x01\x01\x00\x16\x03\x06\x00\x00\x00\x00\x81\x06\x00\x00\x00\x00\x83\x06\x00\x00\x00\x00, signal_addr=[ip=192.169.100.1, other=<uninitialized>], user_addr=[ip=192.169.100.1, other=<uninitialized>], msisdn=\x91hQ"\x01\x00\x01\xf1, qos_prof=[priority=2, data=\x1bB\x1fs\x8c@@tK@@], tft=<uninitialized>, trigger_id=<uninitialized>, omc_id=<uninitialized>, ext=[id=10923, value=\x02\x01\x03]]
|
||||
gtpv1_message, [orig_h=192.169.100.1, orig_p=34273/udp, resp_h=10.100.200.33, resp_p=2123/udp]
|
||||
[version=1, pt_flag=T, rsv=F, e_flag=F, s_flag=T, pn_flag=F, msg_type=17, length=101, teid=854600697, seq=4875, n_pdu=0, next_type=0]
|
||||
gtp create response, [orig_h=192.169.100.1, orig_p=34273/udp, resp_h=10.100.200.33, resp_p=2123/udp]
|
||||
[version=1, pt_flag=T, rsv=F, e_flag=F, s_flag=T, pn_flag=F, msg_type=17, length=101, teid=854600697, seq=4875, n_pdu=0, next_type=0]
|
||||
[cause=128, reorder_req=F, recovery=24, data1=268435589, cp=268435584, charging_id=103000009, end_user_addr=[pdp_type_org=1, pdp_type_num=33, pdp_ip=192.168.252.130, pdp_other_addr=<uninitialized>], opts=\x80\x80!^P^D^A\0^P\x81^F\0\0\0\0\x83^F\0\0\0\0\x80!^J^C^A\0^J^C^F\xc0\xa8\xfc\x82, cp_addr=[ip=10.100.200.34, other=<uninitialized>], user_addr=[ip=10.100.200.49, other=<uninitialized>], qos_prof=[priority=2, data=\x1bB\x1fs\x8c@@tK@@], charge_gateway=<uninitialized>, ext=<uninitialized>]
|
||||
[cause=128, reorder_req=F, recovery=24, data1=268435589, cp=268435584, charging_id=103000009, end_user_addr=[pdp_type_org=1, pdp_type_num=33, pdp_ip=192.168.252.130, pdp_other_addr=<uninitialized>], opts=\x80\x80!\x10\x04\x01\x00\x10\x81\x06\x00\x00\x00\x00\x83\x06\x00\x00\x00\x00\x80!\x0a\x03\x01\x00\x0a\x03\x06\xc0\xa8\xfc\x82, cp_addr=[ip=10.100.200.34, other=<uninitialized>], user_addr=[ip=10.100.200.49, other=<uninitialized>], qos_prof=[priority=2, data=\x1bB\x1fs\x8c@@tK@@], charge_gateway=<uninitialized>, ext=<uninitialized>]
|
||||
gtpv1_message, [orig_h=127.0.0.2, orig_p=2123/udp, resp_h=127.0.0.1, resp_p=2123/udp]
|
||||
[version=1, pt_flag=T, rsv=F, e_flag=F, s_flag=T, pn_flag=F, msg_type=1, length=4, teid=0, seq=3072, n_pdu=0, next_type=0]
|
||||
gtpv1_message, [orig_h=127.0.0.2, orig_p=2123/udp, resp_h=127.0.0.1, resp_p=2123/udp]
|
||||
|
|
@ -16,9 +16,9 @@ gtpv1_message, [orig_h=127.0.0.2, orig_p=2123/udp, resp_h=127.0.0.1, resp_p=2123
|
|||
[version=1, pt_flag=T, rsv=F, e_flag=F, s_flag=T, pn_flag=F, msg_type=16, length=104, teid=0, seq=3073, n_pdu=0, next_type=0]
|
||||
gtp create request, [orig_h=127.0.0.2, orig_p=2123/udp, resp_h=127.0.0.1, resp_p=2123/udp]
|
||||
[version=1, pt_flag=T, rsv=F, e_flag=F, s_flag=T, pn_flag=F, msg_type=16, length=104, teid=0, seq=3073, n_pdu=0, next_type=0]
|
||||
[imsi=240010123456789, rai=<uninitialized>, recovery=3, select_mode=1, data1=1, cp=1, nsapi=0, linked_nsapi=<uninitialized>, charge_character=2048, trace_ref=<uninitialized>, trace_type=<uninitialized>, end_user_addr=[pdp_type_org=1, pdp_type_num=33, pdp_ip=<uninitialized>, pdp_other_addr=<uninitialized>], ap_name=^Hinternet, opts=\x80\xc0#^Q^A^A\0^Q^Cmig^Hhemmelig, signal_addr=[ip=127.0.0.2, other=<uninitialized>], user_addr=[ip=127.0.0.2, other=<uninitialized>], msisdn=\x91d^G^R2T\xf6, qos_prof=[priority=0, data=^K\x92\x1f], tft=<uninitialized>, trigger_id=<uninitialized>, omc_id=<uninitialized>, ext=<uninitialized>]
|
||||
[imsi=240010123456789, rai=<uninitialized>, recovery=3, select_mode=1, data1=1, cp=1, nsapi=0, linked_nsapi=<uninitialized>, charge_character=2048, trace_ref=<uninitialized>, trace_type=<uninitialized>, end_user_addr=[pdp_type_org=1, pdp_type_num=33, pdp_ip=<uninitialized>, pdp_other_addr=<uninitialized>], ap_name=\x08internet, opts=\x80\xc0#\x11\x01\x01\x00\x11\x03mig\x08hemmelig, signal_addr=[ip=127.0.0.2, other=<uninitialized>], user_addr=[ip=127.0.0.2, other=<uninitialized>], msisdn=\x91d\x07\x122T\xf6, qos_prof=[priority=0, data=\x0b\x92\x1f], tft=<uninitialized>, trigger_id=<uninitialized>, omc_id=<uninitialized>, ext=<uninitialized>]
|
||||
gtpv1_message, [orig_h=127.0.0.2, orig_p=2123/udp, resp_h=127.0.0.1, resp_p=2123/udp]
|
||||
[version=1, pt_flag=T, rsv=F, e_flag=F, s_flag=T, pn_flag=F, msg_type=17, length=78, teid=1, seq=3073, n_pdu=0, next_type=0]
|
||||
gtp create response, [orig_h=127.0.0.2, orig_p=2123/udp, resp_h=127.0.0.1, resp_p=2123/udp]
|
||||
[version=1, pt_flag=T, rsv=F, e_flag=F, s_flag=T, pn_flag=F, msg_type=17, length=78, teid=1, seq=3073, n_pdu=0, next_type=0]
|
||||
[cause=128, reorder_req=F, recovery=1, data1=1, cp=1, charging_id=1, end_user_addr=[pdp_type_org=1, pdp_type_num=33, pdp_ip=192.168.0.2, pdp_other_addr=<uninitialized>], opts=\x80\x80!^P^B\0\0^P\x81^F\0\0\0\0\x83^F\0\0\0\0, cp_addr=[ip=127.0.0.1, other=<uninitialized>], user_addr=[ip=127.0.0.1, other=<uninitialized>], qos_prof=[priority=0, data=^K\x92\x1f], charge_gateway=<uninitialized>, ext=<uninitialized>]
|
||||
[cause=128, reorder_req=F, recovery=1, data1=1, cp=1, charging_id=1, end_user_addr=[pdp_type_org=1, pdp_type_num=33, pdp_ip=192.168.0.2, pdp_other_addr=<uninitialized>], opts=\x80\x80!\x10\x02\x00\x00\x10\x81\x06\x00\x00\x00\x00\x83\x06\x00\x00\x00\x00, cp_addr=[ip=127.0.0.1, other=<uninitialized>], user_addr=[ip=127.0.0.1, other=<uninitialized>], qos_prof=[priority=0, data=\x0b\x92\x1f], charge_gateway=<uninitialized>, ext=<uninitialized>]
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dpd
|
||||
#open 2013-08-26-19-02-18
|
||||
#open 2015-04-15-23-53-30
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto analyzer failure_reason
|
||||
#types time string addr port addr port enum string string
|
||||
1333458853.075889 CXWv6p3arKYeMETxOg 173.86.159.28 2152 213.72.147.186 2152 udp GTPV1 Truncated GTPv1 [0\xff\x00\xac\x98\x13\x01LE\x00\x05\xc8G\xea@\x00\x80\x06\xb6\x83\x0a\x83w&\xd9\x14\x9c\x04\xd9\xc2\x00P\xddh\xb4\x8f41eV...]
|
||||
#close 2013-08-26-19-02-18
|
||||
1333458853.075889 CXWv6p3arKYeMETxOg 173.86.159.28 2152 213.72.147.186 2152 udp GTPV1 Truncated GTPv1 [0\\xff\\x00\\xac\\x98\\x13\\x01LE\\x00\\x05\\xc8G\\xea@\\x00\\x80\\x06\\xb6\\x83\\x0a\\x83w&\\xd9\\x14\\x9c\\x04\\xd9\\xc2\\x00P\\xddh\\xb4\\x8f41eV...]
|
||||
#close 2015-04-15-23-53-30
|
||||
|
|
|
|||
|
|
@ -3,9 +3,9 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path tunnel
|
||||
#open 2013-08-26-19-35-01
|
||||
#open 2015-04-15-23-53-30
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||
#types time string addr port addr port enum enum
|
||||
1333458853.034734 CXWv6p3arKYeMETxOg 173.86.159.28 2152 213.72.147.186 2152 Tunnel::GTPv1 Tunnel::DISCOVER
|
||||
1333458853.108391 CXWv6p3arKYeMETxOg 173.86.159.28 2152 213.72.147.186 2152 Tunnel::GTPv1 Tunnel::CLOSE
|
||||
#close 2013-08-26-19-35-01
|
||||
#close 2015-04-15-23-53-30
|
||||
|
|
|
|||
|
|
@ -1,10 +0,0 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path known_services
|
||||
#open 2014-04-01-22-57-25
|
||||
#fields ts host port_num port_proto service
|
||||
#types time addr port enum set[string]
|
||||
1258567191.405770 192.168.1.1 53 udp TEREDO
|
||||
#close 2014-04-01-22-57-25
|
||||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2015-02-23-21-33-18
|
||||
#open 2016-01-15-18-40-16
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1210953047.736921 CjhGID4nQcgTWjvg4c 192.168.2.16 1576 75.126.130.163 80 tcp - 0.000357 0 0 SHR - - 0 fA 1 40 1 40 (empty)
|
||||
|
|
@ -27,4 +27,4 @@
|
|||
1210953052.324629 C6pKV8GSxOnSLghOa fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - - 0 - 1 88 0 0 CPbrpk1qSsw6ESzHV4
|
||||
1210953060.829303 CEle3f3zno26fFZkrh 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.463615 4 4 OTH - - 0 - 1 52 1 52 C3SfNE4BWaU4aSuwkc,CsRx2w45OKnoww6xl4
|
||||
1210953052.202579 CRJuHdVW0XPVINV8a fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - - 0 - 1 64 0 0 CsRx2w45OKnoww6xl4
|
||||
#close 2015-02-23-21-33-18
|
||||
#close 2016-01-15-18-40-16
|
||||
|
|
|
|||
|
|
@ -3,11 +3,11 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path http
|
||||
#open 2014-04-01-22-57-21
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
|
||||
1210953057.917183 C7XEbhP654jzLoe3a 192.168.2.16 1578 75.126.203.78 80 1 POST download913.avast.com /cgi-bin/iavs4stats.cgi - Syncer/4.80 (av_pro-1169;f) 589 0 204 <empty> - - - (empty) - - - Fp32SIJztq0Szn5Qc text/plain - -
|
||||
1210953061.585996 CwSkQu4eWZCH7OONC1 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - - - FNFYdH11h5iQcoD3a2 text/html
|
||||
1210953073.381474 CwSkQu4eWZCH7OONC1 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - - - FHD5nv1iSVFZVM0aH7 text/html
|
||||
1210953074.674817 Cab0vO1xNYSS2hJkle 192.168.2.16 1580 67.228.110.120 80 1 GET www.wireshark.org / http://ipv6.google.com/search?hl=en&q=Wireshark+%21&btnG=Google+Search Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 11845 200 OK - - - (empty) - - - - - FS7lUf2cJFAVBCu6w6 application/xml
|
||||
#close 2014-04-01-22-57-21
|
||||
#open 2016-01-15-18-40-16
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
|
||||
1210953057.917183 C7XEbhP654jzLoe3a 192.168.2.16 1578 75.126.203.78 80 1 POST download913.avast.com /cgi-bin/iavs4stats.cgi - 1.1 Syncer/4.80 (av_pro-1169;f) 589 0 204 <empty> - - - (empty) - - - Fp32SIJztq0Szn5Qc text/plain - -
|
||||
1210953061.585996 CwSkQu4eWZCH7OONC1 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - - - FNFYdH11h5iQcoD3a2 text/html
|
||||
1210953073.381474 CwSkQu4eWZCH7OONC1 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - - - FHD5nv1iSVFZVM0aH7 text/html
|
||||
1210953074.674817 Cab0vO1xNYSS2hJkle 192.168.2.16 1580 67.228.110.120 80 1 GET www.wireshark.org / http://ipv6.google.com/search?hl=en&q=Wireshark+%21&btnG=Google+Search 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 11845 200 OK - - - (empty) - - - - - FS7lUf2cJFAVBCu6w6 text/html
|
||||
#close 2016-01-15-18-40-16
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path tunnel
|
||||
#open 2013-08-26-19-02-19
|
||||
#open 2016-01-15-18-40-16
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||
#types time string addr port addr port enum enum
|
||||
1210953052.202579 CsRx2w45OKnoww6xl4 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER
|
||||
|
|
@ -12,4 +12,4 @@
|
|||
1210953076.058333 CsRx2w45OKnoww6xl4 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE
|
||||
1210953076.058333 C3SfNE4BWaU4aSuwkc 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE
|
||||
1210953076.058333 CPbrpk1qSsw6ESzHV4 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE
|
||||
#close 2013-08-26-19-02-19
|
||||
#close 2016-01-15-18-40-16
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2015-02-23-21-33-21
|
||||
#open 2016-01-15-18-40-17
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1340127577.354166 C6pKV8GSxOnSLghOa 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 0.052829 1675 10467 S1 - - 0 ShADad 10 2279 12 11191 CRJuHdVW0XPVINV8a
|
||||
|
|
@ -13,4 +13,4 @@
|
|||
1340127577.339015 CsRx2w45OKnoww6xl4 fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - - 0 - 1 88 0 0 CCvvfg3TEfuqmmG4bh
|
||||
1340127577.343969 CPbrpk1qSsw6ESzHV4 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.007778 4 4 OTH - - 0 - 1 52 1 52 CXWv6p3arKYeMETxOg,CRJuHdVW0XPVINV8a
|
||||
1340127577.336558 CjhGID4nQcgTWjvg4c fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - - 0 - 1 64 0 0 CXWv6p3arKYeMETxOg
|
||||
#close 2015-02-23-21-33-21
|
||||
#close 2016-01-15-18-40-17
|
||||
|
|
|
|||
|
|
@ -3,9 +3,9 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path http
|
||||
#open 2014-04-01-22-57-27
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
|
||||
1340127577.361683 C6pKV8GSxOnSLghOa 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - - - FWSTWv4EZLVlc2Zywi text/html
|
||||
1340127577.379360 C6pKV8GSxOnSLghOa 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - - - FGKV3B3jz083xhGO13 text/html
|
||||
#close 2014-04-01-22-57-27
|
||||
#open 2016-01-15-18-40-17
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
|
||||
1340127577.361683 C6pKV8GSxOnSLghOa 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - - - FWSTWv4EZLVlc2Zywi text/html
|
||||
1340127577.379360 C6pKV8GSxOnSLghOa 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - - - FGKV3B3jz083xhGO13 text/html
|
||||
#close 2016-01-15-18-40-17
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path tunnel
|
||||
#open 2013-08-26-19-02-20
|
||||
#open 2016-01-15-18-40-17
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||
#types time string addr port addr port enum enum
|
||||
1340127577.336558 CXWv6p3arKYeMETxOg 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER
|
||||
|
|
@ -12,4 +12,4 @@
|
|||
1340127577.406995 CXWv6p3arKYeMETxOg 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE
|
||||
1340127577.406995 CRJuHdVW0XPVINV8a 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE
|
||||
1340127577.406995 CCvvfg3TEfuqmmG4bh 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE
|
||||
#close 2013-08-26-19-02-20
|
||||
#close 2016-01-15-18-40-17
|
||||
|
|
|
|||
|
|
@ -3,9 +3,9 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2013-08-26-19-46-43
|
||||
#open 2016-01-15-18-40-17
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1340127577.341510 CRJuHdVW0XPVINV8a 192.168.2.16 3797 83.170.1.38 32900 Teredo_bubble_with_payload - F bro
|
||||
1340127577.346849 CXWv6p3arKYeMETxOg 192.168.2.16 3797 65.55.158.80 3544 Teredo_bubble_with_payload - F bro
|
||||
#close 2013-08-26-19-46-43
|
||||
#close 2016-01-15-18-40-17
|
||||
|
|
|
|||
16
testing/btest/Baseline/core.x509-generalizedtime/output
Normal file
16
testing/btest/Baseline/core.x509-generalizedtime/output
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
----- x509_certificate ----
|
||||
serial: 03E8
|
||||
not_valid_before: 2015-09-01-13:33:37.000000000 (epoch: 1441114417.0)
|
||||
not_valid_after : 2025-09-01-13:33:37.000000000 (epoch: 1756733617.0)
|
||||
----- x509_certificate ----
|
||||
serial: 99FAA8037A4EB2FAEF84EB5E55D5B8C8
|
||||
not_valid_before: 2011-05-04-00:00:00.000000000 (epoch: 1304467200.0)
|
||||
not_valid_after : 2016-07-04-23:59:59.000000000 (epoch: 1467676799.0)
|
||||
----- x509_certificate ----
|
||||
serial: 1690C329B6780607511F05B0344846CB
|
||||
not_valid_before: 2010-04-16-00:00:00.000000000 (epoch: 1271376000.0)
|
||||
not_valid_after : 2020-05-30-10:48:38.000000000 (epoch: 1590835718.0)
|
||||
----- x509_certificate ----
|
||||
serial: 01
|
||||
not_valid_before: 2000-05-30-10:48:38.000000000 (epoch: 959683718.0)
|
||||
not_valid_after : 2020-05-30-10:48:38.000000000 (epoch: 1590835718.0)
|
||||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2014-10-31-20-38-14
|
||||
#open 2015-08-31-04-50-43
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
|
|
@ -13,7 +13,10 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/bro.bif.bro
|
||||
build/scripts/base/bif/reporter.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SNMP.types.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_KRB.types.bif.bro
|
||||
build/scripts/base/bif/event.bif.bro
|
||||
scripts/base/frameworks/broker/__load__.bro
|
||||
scripts/base/frameworks/broker/main.bro
|
||||
scripts/base/frameworks/logging/__load__.bro
|
||||
scripts/base/frameworks/logging/main.bro
|
||||
build/scripts/base/bif/logging.bif.bro
|
||||
|
|
@ -43,16 +46,21 @@ scripts/base/init-bare.bro
|
|||
scripts/base/frameworks/files/magic/__load__.bro
|
||||
build/scripts/base/bif/__load__.bro
|
||||
build/scripts/base/bif/broxygen.bif.bro
|
||||
build/scripts/base/bif/pcap.bif.bro
|
||||
build/scripts/base/bif/functions.bif.bro
|
||||
build/scripts/base/bif/bloom-filter.bif.bro
|
||||
build/scripts/base/bif/cardinality-counter.bif.bro
|
||||
build/scripts/base/bif/top-k.bif.bro
|
||||
build/scripts/base/bif/comm.bif.bro
|
||||
build/scripts/base/bif/data.bif.bro
|
||||
build/scripts/base/bif/messaging.bif.bro
|
||||
build/scripts/base/bif/store.bif.bro
|
||||
build/scripts/base/bif/plugins/__load__.bro
|
||||
build/scripts/base/bif/plugins/Bro_ARP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_AYIYA.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_BackDoor.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_BitTorrent.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ConnSize.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ConnSize.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DNP3.events.bif.bro
|
||||
|
|
@ -69,6 +77,7 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/plugins/Bro_Ident.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_InterConn.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_IRC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_KRB.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Login.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Login.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_MIME.events.bif.bro
|
||||
|
|
@ -77,17 +86,20 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/plugins/Bro_NCP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetBIOS.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetFlow.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_PIA.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_POP3.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_RADIUS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_RDP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_RDP.types.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_RPC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SIP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SNMP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMB.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMTP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SOCKS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSH.types.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSH.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSL.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SteppingStone.events.bif.bro
|
||||
|
|
@ -100,6 +112,7 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/plugins/Bro_FileExtract.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FileExtract.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FileHash.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_PE.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Unified2.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Unified2.types.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_X509.events.bif.bro
|
||||
|
|
@ -115,4 +128,4 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/plugins/Bro_SQLiteWriter.sqlite.bif.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
scripts/base/utils/paths.bro
|
||||
#close 2014-10-31-20-38-14
|
||||
#close 2015-08-31-04-50-43
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2015-02-26-14-14-34
|
||||
#open 2016-02-17-20-30-50
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
|
|
@ -13,7 +13,10 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/bro.bif.bro
|
||||
build/scripts/base/bif/reporter.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SNMP.types.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_KRB.types.bif.bro
|
||||
build/scripts/base/bif/event.bif.bro
|
||||
scripts/base/frameworks/broker/__load__.bro
|
||||
scripts/base/frameworks/broker/main.bro
|
||||
scripts/base/frameworks/logging/__load__.bro
|
||||
scripts/base/frameworks/logging/main.bro
|
||||
build/scripts/base/bif/logging.bif.bro
|
||||
|
|
@ -43,16 +46,21 @@ scripts/base/init-bare.bro
|
|||
scripts/base/frameworks/files/magic/__load__.bro
|
||||
build/scripts/base/bif/__load__.bro
|
||||
build/scripts/base/bif/broxygen.bif.bro
|
||||
build/scripts/base/bif/pcap.bif.bro
|
||||
build/scripts/base/bif/functions.bif.bro
|
||||
build/scripts/base/bif/bloom-filter.bif.bro
|
||||
build/scripts/base/bif/cardinality-counter.bif.bro
|
||||
build/scripts/base/bif/top-k.bif.bro
|
||||
build/scripts/base/bif/comm.bif.bro
|
||||
build/scripts/base/bif/data.bif.bro
|
||||
build/scripts/base/bif/messaging.bif.bro
|
||||
build/scripts/base/bif/store.bif.bro
|
||||
build/scripts/base/bif/plugins/__load__.bro
|
||||
build/scripts/base/bif/plugins/Bro_ARP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_AYIYA.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_BackDoor.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_BitTorrent.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ConnSize.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ConnSize.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DNP3.events.bif.bro
|
||||
|
|
@ -69,6 +77,7 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/plugins/Bro_Ident.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_InterConn.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_IRC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_KRB.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Login.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Login.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_MIME.events.bif.bro
|
||||
|
|
@ -77,17 +86,20 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/plugins/Bro_NCP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetBIOS.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetFlow.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_PIA.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_POP3.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_RADIUS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_RDP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_RDP.types.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_RPC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SIP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SNMP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMB.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMTP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SOCKS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSH.types.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSH.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSL.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SteppingStone.events.bif.bro
|
||||
|
|
@ -101,6 +113,7 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/plugins/Bro_FileExtract.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FileExtract.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FileHash.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_PE.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Unified2.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Unified2.types.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_X509.events.bif.bro
|
||||
|
|
@ -176,11 +189,36 @@ scripts/base/init-default.bro
|
|||
scripts/base/frameworks/sumstats/non-cluster.bro
|
||||
scripts/base/frameworks/tunnels/__load__.bro
|
||||
scripts/base/frameworks/tunnels/main.bro
|
||||
scripts/base/frameworks/openflow/__load__.bro
|
||||
scripts/base/frameworks/openflow/consts.bro
|
||||
scripts/base/frameworks/openflow/types.bro
|
||||
scripts/base/frameworks/openflow/main.bro
|
||||
scripts/base/frameworks/openflow/plugins/__load__.bro
|
||||
scripts/base/frameworks/openflow/plugins/ryu.bro
|
||||
scripts/base/utils/json.bro
|
||||
scripts/base/frameworks/openflow/plugins/log.bro
|
||||
scripts/base/frameworks/openflow/plugins/broker.bro
|
||||
scripts/base/frameworks/openflow/non-cluster.bro
|
||||
scripts/base/frameworks/netcontrol/__load__.bro
|
||||
scripts/base/frameworks/netcontrol/types.bro
|
||||
scripts/base/frameworks/netcontrol/main.bro
|
||||
scripts/base/frameworks/netcontrol/plugin.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/__load__.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/debug.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/openflow.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/packetfilter.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/broker.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/acld.bro
|
||||
scripts/base/frameworks/netcontrol/drop.bro
|
||||
scripts/base/frameworks/netcontrol/shunt.bro
|
||||
scripts/base/frameworks/netcontrol/catch-and-release.bro
|
||||
scripts/base/frameworks/netcontrol/non-cluster.bro
|
||||
scripts/base/protocols/conn/__load__.bro
|
||||
scripts/base/protocols/conn/main.bro
|
||||
scripts/base/protocols/conn/contents.bro
|
||||
scripts/base/protocols/conn/inactivity.bro
|
||||
scripts/base/protocols/conn/polling.bro
|
||||
scripts/base/protocols/conn/thresholds.bro
|
||||
scripts/base/protocols/dhcp/__load__.bro
|
||||
scripts/base/protocols/dhcp/consts.bro
|
||||
scripts/base/protocols/dhcp/main.bro
|
||||
|
|
@ -216,6 +254,10 @@ scripts/base/init-default.bro
|
|||
scripts/base/protocols/irc/main.bro
|
||||
scripts/base/protocols/irc/dcc-send.bro
|
||||
scripts/base/protocols/irc/files.bro
|
||||
scripts/base/protocols/krb/__load__.bro
|
||||
scripts/base/protocols/krb/main.bro
|
||||
scripts/base/protocols/krb/consts.bro
|
||||
scripts/base/protocols/krb/files.bro
|
||||
scripts/base/protocols/modbus/__load__.bro
|
||||
scripts/base/protocols/modbus/consts.bro
|
||||
scripts/base/protocols/modbus/main.bro
|
||||
|
|
@ -226,6 +268,11 @@ scripts/base/init-default.bro
|
|||
scripts/base/protocols/radius/__load__.bro
|
||||
scripts/base/protocols/radius/main.bro
|
||||
scripts/base/protocols/radius/consts.bro
|
||||
scripts/base/protocols/rdp/__load__.bro
|
||||
scripts/base/protocols/rdp/consts.bro
|
||||
scripts/base/protocols/rdp/main.bro
|
||||
scripts/base/protocols/sip/__load__.bro
|
||||
scripts/base/protocols/sip/main.bro
|
||||
scripts/base/protocols/snmp/__load__.bro
|
||||
scripts/base/protocols/snmp/main.bro
|
||||
scripts/base/protocols/smtp/__load__.bro
|
||||
|
|
@ -241,6 +288,9 @@ scripts/base/init-default.bro
|
|||
scripts/base/protocols/syslog/consts.bro
|
||||
scripts/base/protocols/syslog/main.bro
|
||||
scripts/base/protocols/tunnels/__load__.bro
|
||||
scripts/base/files/pe/__load__.bro
|
||||
scripts/base/files/pe/consts.bro
|
||||
scripts/base/files/pe/main.bro
|
||||
scripts/base/files/extract/__load__.bro
|
||||
scripts/base/files/extract/main.bro
|
||||
scripts/base/files/unified2/__load__.bro
|
||||
|
|
@ -248,4 +298,4 @@ scripts/base/init-default.bro
|
|||
scripts/base/misc/find-checksum-offloading.bro
|
||||
scripts/base/misc/find-filtered-trace.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
#close 2015-02-26-14-14-34
|
||||
#close 2016-02-17-20-30-50
|
||||
|
|
|
|||
|
|
@ -18,16 +18,24 @@ known_devices
|
|||
known_hosts
|
||||
known_modbus
|
||||
known_services
|
||||
krb
|
||||
loaded_scripts
|
||||
modbus
|
||||
modbus_register_change
|
||||
mysql
|
||||
net_control
|
||||
netcontrol_drop
|
||||
netcontrol_shunt
|
||||
notice
|
||||
notice_alarm
|
||||
open_flow
|
||||
packet_filter
|
||||
pe
|
||||
radius
|
||||
rdp
|
||||
reporter
|
||||
signatures
|
||||
sip
|
||||
smtp
|
||||
snmp
|
||||
socks
|
||||
|
|
|
|||
|
|
@ -3,6 +3,8 @@
|
|||
-./frameworks/cluster/nodes/worker.bro
|
||||
-./frameworks/cluster/setup-connections.bro
|
||||
-./frameworks/intel/cluster.bro
|
||||
-./frameworks/netcontrol/cluster.bro
|
||||
-./frameworks/notice/cluster.bro
|
||||
-./frameworks/openflow/cluster.bro
|
||||
-./frameworks/packet-filter/cluster.bro
|
||||
-./frameworks/sumstats/cluster.bro
|
||||
|
|
|
|||
|
|
@ -0,0 +1,26 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# bro -r tls/tls-expired-cert.trace conditional-notice.bro
|
||||
|
||||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# cat notice.log
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path notice
|
||||
#open 2015-03-23-18-03-21
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
|
||||
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] interval bool string string string double double
|
||||
1394745603.293028 CXWv6p3arKYeMETxOg 192.168.4.149 60539 87.98.220.10 443 F1fX1R2cDOzbvg17ye - - tcp SSL::Certificate_Expired Certificate CN=www.spidh.org,OU=COMODO SSL,OU=Domain Control Validated expired at 2014-03-04-23:59:59.000000000 - 192.168.4.149 87.98.220.10 443 - bro Notice::ACTION_EMAIL,Notice::ACTION_LOG 86400.000000 F - - - - -
|
||||
#close 2015-03-23-18-03-21
|
||||
|
||||
|
|
@ -7,7 +7,7 @@
|
|||
# bro -b -r http/get.trace connection_record_01.bro
|
||||
[id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={
|
||||
|
||||
}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, conn=[ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=<uninitialized>, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=<uninitialized>, local_resp=<uninitialized>, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={
|
||||
}, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, conn=[ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=<uninitialized>, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=<uninitialized>, local_resp=<uninitialized>, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={
|
||||
|
||||
}], extract_orig=F, extract_resp=F]
|
||||
}], extract_orig=F, extract_resp=F, thresholds=<uninitialized>]
|
||||
|
||||
|
|
|
|||
|
|
@ -7,11 +7,11 @@
|
|||
# bro -b -r http/get.trace connection_record_02.bro
|
||||
[id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={
|
||||
|
||||
}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, conn=[ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=<uninitialized>, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=<uninitialized>, local_resp=<uninitialized>, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={
|
||||
}, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, conn=[ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=<uninitialized>, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=<uninitialized>, local_resp=<uninitialized>, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={
|
||||
|
||||
}], extract_orig=F, extract_resp=F, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={
|
||||
}], extract_orig=F, extract_resp=F, thresholds=<uninitialized>, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=<uninitialized>, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={
|
||||
|
||||
}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={
|
||||
|
||||
}, current_request=1, current_response=1]]
|
||||
}, current_request=1, current_response=1, trans_depth=1]]
|
||||
|
||||
|
|
|
|||
|
|
@ -5,13 +5,13 @@
|
|||
:emphasize-lines: 1,1
|
||||
|
||||
# bro -r wikipedia.trace data_type_time.bro
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.118^J
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.2^J
|
||||
2011/06/18 19:03:09: New connection established from 141.142.220.235 to 173.192.163.128^J
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.118\x0a
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3\x0a
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3\x0a
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3\x0a
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3\x0a
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3\x0a
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3\x0a
|
||||
2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.2\x0a
|
||||
2011/06/18 19:03:09: New connection established from 141.142.220.235 to 173.192.163.128\x0a
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,22 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
connecting-connector.bro
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "connector";
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
BrokerComm::enable();
|
||||
BrokerComm::connect("127.0.0.1", broker_port, 1sec);
|
||||
}
|
||||
|
||||
event BrokerComm::outgoing_connection_established(peer_address: string,
|
||||
peer_port: port,
|
||||
peer_name: string)
|
||||
{
|
||||
print "BrokerComm::outgoing_connection_established",
|
||||
peer_address, peer_port, peer_name;
|
||||
terminate();
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
connecting-listener.bro
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "listener";
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
BrokerComm::enable();
|
||||
BrokerComm::listen(broker_port, "127.0.0.1");
|
||||
}
|
||||
|
||||
event BrokerComm::incoming_connection_established(peer_name: string)
|
||||
{
|
||||
print "BrokerComm::incoming_connection_established", peer_name;
|
||||
}
|
||||
|
||||
event BrokerComm::incoming_connection_broken(peer_name: string)
|
||||
{
|
||||
print "BrokerComm::incoming_connection_broken", peer_name;
|
||||
terminate();
|
||||
}
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
events-connector.bro
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "connector";
|
||||
global my_event: event(msg: string, c: count);
|
||||
global my_auto_event: event(msg: string, c: count);
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
BrokerComm::enable();
|
||||
BrokerComm::connect("127.0.0.1", broker_port, 1sec);
|
||||
BrokerComm::auto_event("bro/event/my_auto_event", my_auto_event);
|
||||
}
|
||||
|
||||
event BrokerComm::outgoing_connection_established(peer_address: string,
|
||||
peer_port: port,
|
||||
peer_name: string)
|
||||
{
|
||||
print "BrokerComm::outgoing_connection_established",
|
||||
peer_address, peer_port, peer_name;
|
||||
BrokerComm::event("bro/event/my_event", BrokerComm::event_args(my_event, "hi", 0));
|
||||
event my_auto_event("stuff", 88);
|
||||
BrokerComm::event("bro/event/my_event", BrokerComm::event_args(my_event, "...", 1));
|
||||
event my_auto_event("more stuff", 51);
|
||||
BrokerComm::event("bro/event/my_event", BrokerComm::event_args(my_event, "bye", 2));
|
||||
}
|
||||
|
||||
event BrokerComm::outgoing_connection_broken(peer_address: string,
|
||||
peer_port: port)
|
||||
{
|
||||
terminate();
|
||||
}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
events-listener.bro
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "listener";
|
||||
global msg_count = 0;
|
||||
global my_event: event(msg: string, c: count);
|
||||
global my_auto_event: event(msg: string, c: count);
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
BrokerComm::enable();
|
||||
BrokerComm::subscribe_to_events("bro/event/");
|
||||
BrokerComm::listen(broker_port, "127.0.0.1");
|
||||
}
|
||||
|
||||
event BrokerComm::incoming_connection_established(peer_name: string)
|
||||
{
|
||||
print "BrokerComm::incoming_connection_established", peer_name;
|
||||
}
|
||||
|
||||
event my_event(msg: string, c: count)
|
||||
{
|
||||
++msg_count;
|
||||
print "got my_event", msg, c;
|
||||
|
||||
if ( msg_count == 5 )
|
||||
terminate();
|
||||
}
|
||||
|
||||
event my_auto_event(msg: string, c: count)
|
||||
{
|
||||
++msg_count;
|
||||
print "got my_auto_event", msg, c;
|
||||
|
||||
if ( msg_count == 5 )
|
||||
terminate();
|
||||
}
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
logs-connector.bro
|
||||
|
||||
@load ./testlog
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "connector";
|
||||
redef Log::enable_local_logging = F;
|
||||
redef Log::enable_remote_logging = F;
|
||||
global n = 0;
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
BrokerComm::enable();
|
||||
BrokerComm::enable_remote_logs(Test::LOG);
|
||||
BrokerComm::connect("127.0.0.1", broker_port, 1sec);
|
||||
}
|
||||
|
||||
event do_write()
|
||||
{
|
||||
if ( n == 6 )
|
||||
return;
|
||||
|
||||
Log::write(Test::LOG, [$msg = "ping", $num = n]);
|
||||
++n;
|
||||
event do_write();
|
||||
}
|
||||
|
||||
event BrokerComm::outgoing_connection_established(peer_address: string,
|
||||
peer_port: port,
|
||||
peer_name: string)
|
||||
{
|
||||
print "BrokerComm::outgoing_connection_established",
|
||||
peer_address, peer_port, peer_name;
|
||||
event do_write();
|
||||
}
|
||||
|
||||
event BrokerComm::outgoing_connection_broken(peer_address: string,
|
||||
peer_port: port)
|
||||
{
|
||||
terminate();
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
logs-listener.bro
|
||||
|
||||
@load ./testlog
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "listener";
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
BrokerComm::enable();
|
||||
BrokerComm::subscribe_to_logs("bro/log/Test::LOG");
|
||||
BrokerComm::listen(broker_port, "127.0.0.1");
|
||||
}
|
||||
|
||||
event BrokerComm::incoming_connection_established(peer_name: string)
|
||||
{
|
||||
print "BrokerComm::incoming_connection_established", peer_name;
|
||||
}
|
||||
|
||||
event Test::log_test(rec: Test::Info)
|
||||
{
|
||||
print "wrote log", rec;
|
||||
|
||||
if ( rec$num == 5 )
|
||||
terminate();
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue