diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc index 17b99abb39..bd187fc9ac 100644 --- a/src/analyzer/protocol/tcp/TCP.cc +++ b/src/analyzer/protocol/tcp/TCP.cc @@ -355,7 +355,7 @@ void TCP_Analyzer::Done() { Analyzer::Done(); - if ( connection_pending && is_active && ! BothClosed() ) + if ( connection_pending && is_active && ! BothClosed() && terminating ) Event(connection_pending); LOOP_OVER_GIVEN_CHILDREN(i, packet_children) diff --git a/testing/btest/Baseline/scripts.base.protocols.tcp.pending/.stdout b/testing/btest/Baseline/scripts.base.protocols.tcp.pending/.stdout new file mode 100644 index 0000000000..84858cb67b --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.tcp.pending/.stdout @@ -0,0 +1 @@ +1469573308.013636, Connection pending, [orig_h=192.168.4.149, orig_p=55881/tcp, resp_h=74.125.239.152, resp_p=443/tcp], ShADad diff --git a/testing/btest/scripts/base/protocols/tcp/pending.bro b/testing/btest/scripts/base/protocols/tcp/pending.bro new file mode 100644 index 0000000000..1a49f5d19b --- /dev/null +++ b/testing/btest/scripts/base/protocols/tcp/pending.bro @@ -0,0 +1,7 @@ +# @TEST-EXEC: bro -C -r $TRACES/tls/chrome-34-google.trace %INPUT +# @TEST-EXEC: btest-diff .stdout + +event connection_pending(c: connection) + { + print current_time(), "Connection pending", c$id, c$history; + }