Add cleaned-up version of zeek-aux

This is the zeek-aux repository with all of the git-related stuff removed, including all of the pre-commit configuration files, git directories, and submodules. It has a modified version of the CMake configuration that uses Zeek's variables and paths, making zeek-aux effectively just a subdirectory to Zeek. All of the source files now have Zeek's license header in them as well.
2025-10-02 14:48:21 +00:00 · 2025-08-07 13:45:09 -07:00 · 2025-08-07 13:45:09 -07:00 · a1d0cebca4
commit a1d0cebca4
parent c090ec1ccd
213 changed files with 7611 additions and 0 deletions
--- a/auxil/zeek-aux/CMakeLists.txt
+++ b/auxil/zeek-aux/CMakeLists.txt
@ -0,0 +1,49 @@
+cmake_minimum_required(VERSION 3.15 FATAL_ERROR)
+
+# ##############################################################################
+# Dependency Configuration
+
+find_package(PCAP REQUIRED)
+
+include_directories(BEFORE ${PCAP_INCLUDE_DIR})
+
+# ##############################################################################
+# System Introspection
+
+include(CheckHeaders)
+include(CheckFunctions)
+include(CheckNameserCompat)
+include(MiscTests)
+
+configure_file(${CMAKE_CURRENT_SOURCE_DIR}/config.h.in ${CMAKE_CURRENT_BINARY_DIR}/config.h)
+
+include_directories(BEFORE ${CMAKE_CURRENT_BINARY_DIR})
+
+# ##############################################################################
+# Recurse on sub-directories
+
+# For binary packaging or if this is the main CMake project, go through the
+# regular install target, else use a custom target so programs have to be
+# explicitly installed by the user via "make install-aux"
+macro (AddAuxInstallTarget _target)
+    add_custom_target(
+            install-${_target} COMMAND ${CMAKE_COMMAND} -E make_directory
+        ${CMAKE_INSTALL_PREFIX}/bin
+        COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_FILE:${_target}> ${CMAKE_INSTALL_PREFIX}/bin)
+    add_dependencies(install-${_target} ${_target})
+    set(AUX_TARGETS install-${_target};${AUX_TARGETS})
+    set(AUX_TARGETS ${AUX_TARGETS} PARENT_SCOPE)
+endmacro (AddAuxInstallTarget)
+
+if (NOT ZEEK_MAN_INSTALL_PATH)
+    set(ZEEK_MAN_INSTALL_PATH ${CMAKE_INSTALL_PREFIX}/share/man)
+endif ()
+
+add_subdirectory(adtrace)
+add_subdirectory(zeek-archiver)
+add_subdirectory(zeek-cut)
+add_subdirectory(rst)
+
+add_custom_target(install-aux
+    COMMENT "Zeek auxiliary tools installed to ${CMAKE_INSTALL_PREFIX}/bin")
+add_dependencies(install-aux ${AUX_TARGETS})
--- a/auxil/zeek-aux/README
+++ b/auxil/zeek-aux/README
@ -0,0 +1,107 @@
+.. -*- mode: rst; -*-
+..
+.. Version number is filled in automatically.
+.. |version| replace:: 0.50-174
+
+=======================
+Zeek Auxiliary Programs
+=======================
+
+.. contents::
+
+:Version: |version|
+
+Handy auxiliary programs related to the use of the Zeek Network Security
+Monitor (https://www.zeek.org).
+
+Installation
+============
+
+Installation is simple and standard::
+
+    ./configure
+    make
+    make install
+
+adtrace
+=======
+
+The "adtrace" utility is used to compute the
+network address that compose the internal and extern nets that Zeek
+is monitoring. This program just reads a pcap
+(tcpdump) file and writes out the src MAC, dst MAC, src IP, dst
+IP for each packet seen in the file.
+
+zeek-archiver
+=============
+
+This is a modern replacement for Zeek's historical log-archival process. For
+details, please refer to its dedicated README in the zeek-archiver subdirectory.
+
+zeek-cut
+========
+
+The "zeek-cut" utility reads ASCII Zeek logs on standard input
+and outputs them to standard output with only the specified columns (the
+column names can be found in each log file in the "#fields" header line).
+If no column names are specified, then "zeek-cut" simply outputs all columns.
+
+There are several command-line options available to modify the output (run
+"zeek-cut -h" to see a list of all options).  There are options to convert
+timestamps into human-readable format, and options to specify whether or not
+to include the format header lines in the output (by default, they're not
+included).
+
+For example, the following command will output the three specified columns
+from conn.log with the timestamps from the "ts" column being converted to
+human-readable format::
+
+    cat conn.log | zeek-cut -d ts id.orig_h id.orig_p
+
+The specified order of the column names determines the output order of the
+columns (i.e., "zeek-cut" can reorder the columns).
+
+The "zeek-cut" utility can read the concatenation of one or more uncompressed
+ASCII log files (however, JSON format is not supported) produced by Zeek
+version 2.0 or newer, as long as each log file contains format header
+lines (these are the lines at the beginning of the file starting with "#").
+In fact, "zeek-cut" can process the concatenation of multiple ASCII log files
+that have different column layouts.
+
+To read a compressed log file, a tool such as "zcat" must be used to
+uncompress the file.  For example, "zeek-cut" can read a group of compressed
+conn.log files with a command like this::
+
+    zcat conn.*.log.gz | zeek-cut
+
+
+devel-tools
+===========
+
+A set of scripts used commonly for Zeek development. Note that none of
+these scripts are installed by 'make install'.
+
+extract-conn-by-uid
+    Extracts a connection from a trace file based
+    on its UID found in Zeek's conn.log
+
+gen-mozilla-ca-list.rb
+    Generates list of Mozilla SSL root certificates in
+    a format readable by Zeek.
+
+update-changes
+    A script to maintain the CHANGES and VERSION files.
+
+git-show-fastpath
+    Show commits to the fastpath branch not yet merged into master.
+
+cpu-bench-with-trace
+    Run a number of Zeek benchmarks on a trace file.
+
+
+rst
+===
+
+The "rst" utility can be invoked by a Zeek script to terminate an
+established TCP connection by forging RST tear-down packets.
+
--- a/auxil/zeek-aux/README.rst
+++ b/auxil/zeek-aux/README.rst
@ -0,0 +1 @@
+README
--- a/auxil/zeek-aux/adtrace/CMakeLists.txt
+++ b/auxil/zeek-aux/adtrace/CMakeLists.txt
@ -0,0 +1,8 @@
+find_package(PCAP REQUIRED)
+
+set(adtrace_SRCS adtrace.c)
+
+add_executable(adtrace ${adtrace_SRCS})
+target_include_directories(adtrace BEFORE PRIVATE ${PCAP_INCLUDE_DIR})
+target_link_libraries(adtrace ${PCAP_LIBRARY})
+AddAuxInstallTarget(adtrace)
--- a/auxil/zeek-aux/adtrace/adtrace.c
+++ b/auxil/zeek-aux/adtrace/adtrace.c
@ -0,0 +1,91 @@
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <pcap.h>
+
+#include "ip.h"
+#include "ether.h" 
+#include "ethertype.h"
+
+pcap_t *p;
+
+const u_char*  printEAddr(const u_char* pkt, u_char* endp){
+  const struct ether_header *ep;
+  int i=0;
+  ep = (const struct ether_header*) pkt;
+
+  if (pkt+ETHER_HDRLEN > endp ||
+      ntohs(ep->ether_type) != ETHERTYPE_IP){
+    return 0;
+  }
+
+  for (i = 0; i<ETHER_ADDR_LEN; i++){
+    if (i>0) putchar(':');
+    printf("%02x", ep->ether_shost[i]);
+  }
+  putchar (' ');
+  for (i = 0; i<ETHER_ADDR_LEN; i++){
+    if (i>0) putchar(':');
+    printf("%02x", ep->ether_dhost[i]);
+  }
+  putchar(' ');
+  return (pkt+ETHER_HDRLEN);
+}
+
+void printIPAddr(const u_char* pkt, u_char* endp){
+  const struct ip* iph;
+  if (pkt+sizeof(struct ip) > endp) return;
+  iph = (const struct ip*) pkt;
+  fputs ((char*) inet_ntoa(iph->ip_src), stdout);
+  putchar(' ');
+  puts ((char*) inet_ntoa(iph->ip_dst));
+}
+
+void handler(u_char *user, const struct pcap_pkthdr *head, const u_char *packet){
+  u_char* endp;
+
+  endp =(u_char*) packet + head->caplen;
+  packet = printEAddr(packet, endp);
+  if (packet)
+    printIPAddr(packet, endp);
+}
+
+void usage(char *av[])
+{
+	fprintf(stderr,"usage: %s filename \n", av[0]);
+	exit(1);
+}
+
+int main (int argc, char *argv[])
+{
+  char *file;
+  char errbuf[PCAP_ERRBUF_SIZE];
+  u_char* pkt, endp; 
+  struct pcap_pkthdr *head;
+
+  if ( argc != 2 ) 
+	  usage(argv);
+
+  file = argv[1];
+
+  p = pcap_open_offline(file, errbuf);
+  if(p==NULL){
+    fprintf (stderr, "cannot open %s: %s\n", file, errbuf);
+    exit(2);
+  }
+  
+  if (pcap_datalink(p) != DLT_EN10MB){
+    fputs ("sorry, currently only ethernet links supported\n", stderr);
+    exit(1); //if it is not ethernet we are watching we won't have MACs
+  }
+
+  pcap_loop(p, -1, handler, NULL);
+  pcap_close(p);
+  return(0);
+}
+
--- a/auxil/zeek-aux/adtrace/ether.h
+++ b/auxil/zeek-aux/adtrace/ether.h
@ -0,0 +1,59 @@
+/* @(#) $Header$ (LBL) */
+/*
+ * Copyright (c) 1982, 1986, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *	@(#)if_ether.h	8.3 (Berkeley) 5/2/95
+ */
+
+#define	ETHERMTU	1500
+
+/*
+ * The number of bytes in an ethernet (MAC) address.
+ */
+#define	ETHER_ADDR_LEN		6
+
+/*
+ * Structure of a DEC/Intel/Xerox or 802.3 Ethernet header.
+ */
+struct	ether_header {
+	u_int8_t	ether_dhost[ETHER_ADDR_LEN];
+	u_int8_t	ether_shost[ETHER_ADDR_LEN];
+	u_int16_t	ether_type;
+};
+
+/*
+ * Length of a DEC/Intel/Xerox or 802.3 Ethernet header; note that some
+ * compilers may pad "struct ether_header" to a multiple of 4 bytes,
+ * for example, so "sizeof (struct ether_header)" may not give the right
+ * answer.
+ */
+#define ETHER_HDRLEN		14
--- a/auxil/zeek-aux/adtrace/ethertype.h
+++ b/auxil/zeek-aux/adtrace/ethertype.h
@ -0,0 +1,122 @@
+/*
+ * Copyright (c) 1993, 1994, 1996
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ * @(#) $Header$ (LBL)
+ */
+
+/*
+ * Ethernet types.
+ *
+ * We wrap the declarations with #ifdef, so that if a file includes
+ * <netinet/if_ether.h>, which may declare some of these, we don't
+ * get a bunch of complaints from the C compiler about redefinitions
+ * of these values.
+ *
+ * We declare all of them here so that no file has to include
+ * <netinet/if_ether.h> if all it needs are ETHERTYPE_ values.
+ */
+
+#ifndef ETHERTYPE_PUP
+#define	ETHERTYPE_PUP		0x0200	/* PUP protocol */
+#endif
+#ifndef ETHERTYPE_IP
+#define	ETHERTYPE_IP		0x0800	/* IP protocol */
+#endif
+#ifndef ETHERTYPE_ARP
+#define ETHERTYPE_ARP		0x0806	/* Addr. resolution protocol */
+#endif
+#ifndef ETHERTYPE_REVARP
+#define ETHERTYPE_REVARP	0x8035	/* reverse Addr. resolution protocol */
+#endif
+#ifndef ETHERTYPE_NS
+#define ETHERTYPE_NS		0x0600
+#endif
+#ifndef	ETHERTYPE_SPRITE
+#define	ETHERTYPE_SPRITE	0x0500
+#endif
+#ifndef ETHERTYPE_TRAIL
+#define ETHERTYPE_TRAIL		0x1000
+#endif
+#ifndef	ETHERTYPE_MOPDL
+#define	ETHERTYPE_MOPDL		0x6001
+#endif
+#ifndef	ETHERTYPE_MOPRC
+#define	ETHERTYPE_MOPRC		0x6002
+#endif
+#ifndef	ETHERTYPE_DN
+#define	ETHERTYPE_DN		0x6003
+#endif
+#ifndef	ETHERTYPE_LAT
+#define	ETHERTYPE_LAT		0x6004
+#endif
+#ifndef ETHERTYPE_SCA
+#define ETHERTYPE_SCA		0x6007
+#endif
+#ifndef ETHERTYPE_REVARP
+#define ETHERTYPE_REVARP	0x8035
+#endif
+#ifndef	ETHERTYPE_LANBRIDGE
+#define	ETHERTYPE_LANBRIDGE	0x8038
+#endif
+#ifndef	ETHERTYPE_DECDNS
+#define	ETHERTYPE_DECDNS	0x803c
+#endif
+#ifndef	ETHERTYPE_DECDTS
+#define	ETHERTYPE_DECDTS	0x803e
+#endif
+#ifndef	ETHERTYPE_VEXP
+#define	ETHERTYPE_VEXP		0x805b
+#endif
+#ifndef	ETHERTYPE_VPROD
+#define	ETHERTYPE_VPROD		0x805c
+#endif
+#ifndef ETHERTYPE_ATALK
+#define ETHERTYPE_ATALK		0x809b
+#endif
+#ifndef ETHERTYPE_AARP
+#define ETHERTYPE_AARP		0x80f3
+#endif
+#ifndef	ETHERTYPE_8021Q
+#define	ETHERTYPE_8021Q		0x8100
+#endif
+#ifndef ETHERTYPE_IPX
+#define ETHERTYPE_IPX		0x8137
+#endif
+#ifndef ETHERTYPE_IPV6
+#define ETHERTYPE_IPV6		0x86dd
+#endif
+#ifndef ETHERTYPE_PPP
+#define	ETHERTYPE_PPP		0x880b
+#endif
+#ifndef	ETHERTYPE_MPLS
+#define	ETHERTYPE_MPLS		0x8847
+#endif
+#ifndef	ETHERTYPE_MPLS_MULTI
+#define	ETHERTYPE_MPLS_MULTI	0x8848
+#endif
+#ifndef ETHERTYPE_PPPOED
+#define ETHERTYPE_PPPOED	0x8863
+#endif
+#ifndef ETHERTYPE_PPPOES
+#define ETHERTYPE_PPPOES	0x8864
+#endif
+#ifndef	ETHERTYPE_LOOPBACK
+#define	ETHERTYPE_LOOPBACK	0x9000
+#endif
--- a/auxil/zeek-aux/adtrace/ip.h
+++ b/auxil/zeek-aux/adtrace/ip.h
@ -0,0 +1,159 @@
+/* @(#) $Header$ (LBL) */
+/*
+ * Copyright (c) 1982, 1986, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *	@(#)ip.h	8.2 (Berkeley) 6/1/94
+ */
+
+/*
+ * Definitions for internet protocol version 4.
+ * Per RFC 791, September 1981.
+ */
+#define	IPVERSION	4
+
+/*
+ * Structure of an internet header, naked of options.
+ *
+ * We declare ip_len and ip_off to be short, rather than u_short
+ * pragmatically since otherwise unsigned comparisons can result
+ * against negative integers quite easily, and fail in subtle ways.
+ */
+struct ip {
+	u_int8_t	ip_vhl;		/* header length, version */
+#define IP_V(ip)	(((ip)->ip_vhl & 0xf0) >> 4)
+#define IP_HL(ip)	((ip)->ip_vhl & 0x0f)
+	u_int8_t	ip_tos;		/* type of service */
+	u_int16_t	ip_len;		/* total length */
+	u_int16_t	ip_id;		/* identification */
+	u_int16_t	ip_off;		/* fragment offset field */
+#define	IP_DF 0x4000			/* dont fragment flag */
+#define	IP_MF 0x2000			/* more fragments flag */
+#define	IP_OFFMASK 0x1fff		/* mask for fragmenting bits */
+	u_int8_t	ip_ttl;		/* time to live */
+	u_int8_t	ip_p;		/* protocol */
+	u_int16_t	ip_sum;		/* checksum */
+	struct	in_addr ip_src,ip_dst;	/* source and dest address */
+};
+
+#define	IP_MAXPACKET	65535		/* maximum packet size */
+
+/*
+ * Definitions for IP type of service (ip_tos)
+ */
+#define	IPTOS_LOWDELAY		0x10
+#define	IPTOS_THROUGHPUT	0x08
+#define	IPTOS_RELIABILITY	0x04
+
+/*
+ * Definitions for IP precedence (also in ip_tos) (hopefully unused)
+ */
+#define	IPTOS_PREC_NETCONTROL		0xe0
+#define	IPTOS_PREC_INTERNETCONTROL	0xc0
+#define	IPTOS_PREC_CRITIC_ECP		0xa0
+#define	IPTOS_PREC_FLASHOVERRIDE	0x80
+#define	IPTOS_PREC_FLASH		0x60
+#define	IPTOS_PREC_IMMEDIATE		0x40
+#define	IPTOS_PREC_PRIORITY		0x20
+#define	IPTOS_PREC_ROUTINE		0x00
+
+/*
+ * Definitions for options.
+ */
+#define	IPOPT_COPIED(o)		((o)&0x80)
+#define	IPOPT_CLASS(o)		((o)&0x60)
+#define	IPOPT_NUMBER(o)		((o)&0x1f)
+
+#define	IPOPT_CONTROL		0x00
+#define	IPOPT_RESERVED1		0x20
+#define	IPOPT_DEBMEAS		0x40
+#define	IPOPT_RESERVED2		0x60
+
+#define	IPOPT_EOL		0		/* end of option list */
+#define	IPOPT_NOP		1		/* no operation */
+
+#define	IPOPT_RR		7		/* record packet route */
+#define	IPOPT_TS		68		/* timestamp */
+#define	IPOPT_SECURITY		130		/* provide s,c,h,tcc */
+#define	IPOPT_LSRR		131		/* loose source route */
+#define	IPOPT_SATID		136		/* satnet id */
+#define	IPOPT_SSRR		137		/* strict source route */
+
+/*
+ * Offsets to fields in options other than EOL and NOP.
+ */
+#define	IPOPT_OPTVAL		0		/* option ID */
+#define	IPOPT_OLEN		1		/* option length */
+#define IPOPT_OFFSET		2		/* offset within option */
+#define	IPOPT_MINOFF		4		/* min value of above */
+
+/*
+ * Time stamp option structure.
+ */
+struct	ip_timestamp {
+	u_int8_t	ipt_code;	/* IPOPT_TS */
+	u_int8_t	ipt_len;	/* size of structure (variable) */
+	u_int8_t	ipt_ptr;	/* index of current entry */
+	u_int8_t	ipt_oflwflg;	/* flags, overflow counter */
+#define IPTS_OFLW(ip)	(((ipt)->ipt_oflwflg & 0xf0) >> 4)
+#define IPTS_FLG(ip)	((ipt)->ipt_oflwflg & 0x0f)
+	union ipt_timestamp {
+		u_int32_t ipt_time[1];
+		struct	ipt_ta {
+			struct in_addr ipt_addr;
+			u_int32_t ipt_time;
+		} ipt_ta[1];
+	} ipt_timestamp;
+};
+
+/* flag bits for ipt_flg */
+#define	IPOPT_TS_TSONLY		0		/* timestamps only */
+#define	IPOPT_TS_TSANDADDR	1		/* timestamps and addresses */
+#define	IPOPT_TS_PRESPEC	3		/* specified modules only */
+
+/* bits for security (not byte swapped) */
+#define	IPOPT_SECUR_UNCLASS	0x0000
+#define	IPOPT_SECUR_CONFID	0xf135
+#define	IPOPT_SECUR_EFTO	0x789a
+#define	IPOPT_SECUR_MMMM	0xbc4d
+#define	IPOPT_SECUR_RESTR	0xaf13
+#define	IPOPT_SECUR_SECRET	0xd788
+#define	IPOPT_SECUR_TOPSECRET	0x6bc5
+
+/*
+ * Internet implementation parameters.
+ */
+#define	MAXTTL		255		/* maximum time to live (seconds) */
+#define	IPDEFTTL	64		/* default ttl, from RFC 1340 */
+#define	IPFRAGTTL	60		/* time to live for frags, slowhz */
+#define	IPTTLDEC	1		/* subtracted when forwarding */
+
+#define	IP_MSS		576		/* default maximum segment size */
--- a/auxil/zeek-aux/config.h.in
+++ b/auxil/zeek-aux/config.h.in
@ -0,0 +1,28 @@
+/* These autoconf variables are obsolete; it's portable to assume C89
+   and signal handlers that return void */
+#define RETSIGTYPE void
+#define RETSIGVAL 
+
+/* Define if you have the `sigaction' function. */
+#cmakedefine HAVE_SIGACTION
+
+/* Define if you have the `sigset' function. */
+#cmakedefine HAVE_SIGSET
+
+/* Define if you have the <memory.h> header file. */
+#cmakedefine HAVE_MEMORY_H
+
+/* Define if you have the `strerror' function. */
+#cmakedefine HAVE_STRERROR
+
+/* should explicitly declare socket() and friends */
+#cmakedefine DO_SOCK_DECL
+
+/* Compatibility for Darwin */
+#cmakedefine NEED_NAMESER_COMPAT_H
+
+/* have os-proto.h */
+#cmakedefine HAVE_OS_PROTO_H
+
+/* have sin_len field in sockaddr_in */
+#cmakedefine SIN_LEN
--- a/auxil/zeek-aux/devel-tools/check-release
+++ b/auxil/zeek-aux/devel-tools/check-release
@ -0,0 +1,15 @@
+#! /usr/bin/env bash
+#
+# Checks the current repository and all if its submodules for being
+# in "release shape".
+
+repo_status="$(cd $(dirname $0) && pwd)/repo-status"
+check_cmd="test -e CHANGES && $repo_status"
+
+printf '    %20s    %-10s %-8s %-8s %-7s %-5s %-15s %s\n' "" "Branch" "CHANGES" "Pending" "Modif" "Sub" "VERSION" "Tags"
+
+(
+    eval $check_cmd
+    git submodule foreach -q --recursive "$check_cmd; true"
+) |
+    awk '/!/{print "-  ", $0; next;} {print "+  ", $0; next;}'
--- a/auxil/zeek-aux/devel-tools/cpu-bench-with-trace
+++ b/auxil/zeek-aux/devel-tools/cpu-bench-with-trace
@ -0,0 +1,32 @@
+#! /usr/bin/env bash
+#
+# This runs a number of Zeek configurations on trace $2. It
+# starts with the bare config and then
+# kept adding the scripts load from init-default.zeek and local.zeek one
+# by one, measuring user time for each run (i.e., the measurements are
+# cumulative).
+
+if [ "$2" == "" ]; then
+    echo "usage: $(basename $0) <zeekdir> <trace>"
+    exit 1
+fi
+
+zeek=$1
+trace=$2
+tmp=/tmp/bench.$$.zeek
+
+export ZEEKPATH=$($zeek/build/zeek-path-dev)
+
+cat </dev/null >$tmp
+
+cat $zeek/scripts/base/init-default.zeek $zeek/scripts/site/local.zeek | grep '^ *@load' | while read line; do
+    echo $line >>$tmp
+    script=$(echo $line | awk '{print $2}' | sed 's#/#.#g')
+    output="bench.output.$script.log"
+
+    (time -p $zeek/build/src/zeek -b -r $trace $tmp) >$output 2>&1
+    user=$(cat $output | grep user | awk '{print $2}')
+    printf "%40s %s\n" $script $user
+done
+
+rm -f $tmp
--- a/auxil/zeek-aux/devel-tools/extract-conn-by-uid
+++ b/auxil/zeek-aux/devel-tools/extract-conn-by-uid
@ -0,0 +1,42 @@
+#! /usr/bin/env bash
+#
+# Searches the connection with UID $1 in conn.log, and then extracts
+# it from trace file $2.
+
+if [ $# != 2 ]; then
+    echo "usage: $(basename $0) <uid> <trace>"
+    exit 1
+fi
+
+uid=$1
+trace=$2
+
+if [ ! -e conn.log ]; then
+    echo "no conn.log found"
+    exit 1
+fi
+
+if [ ! -e $trace ]; then
+    echo "trace $trace not found"
+    exit 1
+fi
+
+filter=$(awk -v uid=$uid '$2==uid { printf("host %s and port %s and host %s and port %s\n", $3, $4, $5, $6)}' <conn.log)
+
+if [ "$filter" == "" ]; then
+    echo uid $uid not found in conn.log
+    exit 1
+fi
+
+echo filter: $filter
+
+out=$(basename $trace).$uid
+
+if echo $trace | grep -q '\.gz$'; then
+    cat $trace | gunzip | tcpdump -r - -w $out "$filter"
+else
+    tcpdump -r $trace -w $out "$filter"
+fi
+
+echo connection in $out
+ls -al $out
--- a/auxil/zeek-aux/devel-tools/gen-ct-list.pl
+++ b/auxil/zeek-aux/devel-tools/gen-ct-list.pl
@ -0,0 +1,62 @@
+#!/usr/bin/env perl
+#
+# Generate the Zeek file containing the current list of known
+# Certificate Transparency logs from the source file provided
+# by Google.
+#
+
+use 5.14.1;
+use strict;
+use warnings;
+
+# This is the only kind-of user-configurable line
+
+my $google_log_url = "https://www.gstatic.com/ct/log_list/v3/log_list.json";
+
+# And begin with loading everything we need.
+# I was lazy and you probably will have to install a few of these.
+
+use Carp;
+use autodie;
+use Net::SSLeay;
+use HTML::HeadParser;
+use LWP::Protocol::https;
+use LWP::UserAgent;
+use LWP::Simple;
+use JSON::Parse qw/parse_json/;
+use MIME::Base64;
+use Digest::SHA qw/sha256/;
+use Mozilla::CA;
+
+my $ua = LWP::UserAgent->new();
+my $google_known_logs_json = $ua->get($google_log_url);
+croak("Could not get $google_log_url") unless defined($google_known_logs_json);
+
+my $list = parse_json($google_known_logs_json->content);
+
+say "#\n# Do not edit this file. This file is automatically generated by gen-ct-list.pl";
+say "# File generated at ".localtime;
+say "# File generated from ".$google_log_url;
+say "# Source file generated at: ".$list->{log_list_timestamp};
+say "# Source file version: ".$list->{version};
+say "#";
+say "";
+say '@load base/protocols/ssl';
+say "module SSL;";
+say "";
+say '## @docs-omit-value';
+say "redef ct_logs += {";
+
+for my $operator (@{$list->{operators}}) {
+	my $opname = $operator->{name};
+	for my $log (@{$operator->{logs}}) {
+		my $key = join('', map {"\\x$_" } unpack("(H2)*", decode_base64($log->{key})));
+		my $logid = join('', map {"\\x$_" } unpack("(H2)*", sha256(decode_base64($log->{key}))));
+		my $mmd = $log->{mmd};
+		my $url = $log->{url};
+		my $desc = $log->{description};
+		say "[\"$logid\"] = CTInfo(\$description=\"$desc\", \$operator=\"$opname\", \$url=\"$url\", \$maximum_merge_delay=$mmd, \$key=\"$key\"),";
+	}
+}
+
+say "};";
--- a/auxil/zeek-aux/devel-tools/gen-mozilla-ca-list.rb
+++ b/auxil/zeek-aux/devel-tools/gen-mozilla-ca-list.rb
@ -0,0 +1,84 @@
+#!/usr/bin/env ruby
+
+tmpcert = "/tmp/tmpcert.der"
+
+incert=false
+intrust=false
+
+if ARGV.length != 1
+  abort "\nPass path to the certdata.txt you want to add as first input argument to this script\n\n"+
+    "certdata.txt can be retrieved from the newest NSS release."
+end
+
+url = 'http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1'
+io = open(ARGV[0]);
+
+puts "# Don't edit!  This file is automatically generated."
+puts "# Generated at: #{Time.now}"
+puts "# Generated from: #{url}"
+puts "#"
+puts "# The original source file comes with this licensing statement:"
+puts "#"
+puts "#   This Source Code Form is subject to the terms of the Mozilla Public"
+puts "#   License, v. 2.0. If a copy of the MPL was not distributed with this"
+puts "#   file, You can obtain one at http://mozilla.org/MPL/2.0/."
+puts ""
+
+puts "@load base/protocols/ssl"
+puts "module SSL;";
+puts "";
+puts "## @docs-omit-value"
+puts "redef root_certs += {";
+
+all_certs = []
+all_subjects = []
+
+cert_name = ""
+cert = ""
+io.each do |line|
+  line.chomp!
+  if intrust
+    if line =~ /^CKA_TRUST_SERVER_AUTH/
+      if line =~ /CKT_NSS_TRUSTED_DELEGATOR/
+        File.open(tmpcert, "wb") do |f|
+            byteArray = cert.split("\\x")
+            max = byteArray.length() - 1
+            byteArray[1..max].each do | byte |
+                f.print byte.hex.chr
+            end
+        end
+
+        cert_subj = `openssl x509 -in #{tmpcert} -inform DER -noout -subject -nameopt RFC2253`
+        cert_subj["subject="]= ""
+        cert_subj.chomp!
+        File.delete(tmpcert)
+
+        if not all_subjects.include?(cert_subj)
+            puts "	[\"#{cert_subj}\"] = \"#{cert}\","
+            all_subjects << cert_subj
+        end
+      end
+      intrust=false
+    end
+  else
+    if line =~ /^CKA_LABEL/
+      cert_name = line.sub(/.*\"(.*)\".*/, "\\1")
+      i = 0
+      while all_certs.include?(cert_name)
+        i+=1
+        cert_name += " #{i}"
+      end
+      all_certs << cert_name
+    elsif line =~ /^CKA_VALUE MULTILINE_OCTAL/
+      incert=true
+      cert=""
+    elsif line =~ /^CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST/
+      intrust=true
+    elsif line =~ /^END/
+      incert=false
+    elsif incert
+      cert += line.split(/\\/).collect { |x| x.oct.chr.unpack("H2")[0].upcase if x!="" }.join("\\x")
+    end
+  end
+end
+puts "};"
--- a/auxil/zeek-aux/devel-tools/git-delete-old-branches
+++ b/auxil/zeek-aux/devel-tools/git-delete-old-branches
@ -0,0 +1,32 @@
+# ! /usr/bin/env bash
+#
+# Adapted from http://devblog.springest.com/a-script-to-remove-old-git-branches
+#
+
+# This has to be run from master
+git checkout master
+
+# Update our list of remotes
+git fetch
+git remote prune origin
+
+# # Remove local fully merged branches
+# git branch --merged master | grep -v 'master$' | xargs git branch -d
+
+# Show remote fully merged branches
+echo "The following remote branches are fully merged and will be removed:"
+git branch -r --merged master | sed 's/ *origin\///' | grep '^topic/'
+
+if [ $? != 0 ]; then
+    exit 0
+fi
+
+read -p "Continue (y/n)? "
+
+if [ "$REPLY" == "y" ]
+then
+   # Remove remote fully merged branches
+   git branch -r --merged master | sed 's/ *origin\///' \
+             | grep '^topic/' | xargs -I% git push origin :%
+   echo "Done!"
+fi
--- a/auxil/zeek-aux/devel-tools/git-move-submodules
+++ b/auxil/zeek-aux/devel-tools/git-move-submodules
@ -0,0 +1,77 @@
+#! /usr/bin/env bash
+#
+# Recursively check outs the most recent version of all submodules on a given
+# branch, and commits the updates to the parents.
+
+branch=$1
+
+if [ "$branch" == "" ]; then
+    echo "usage: $(basename $0) <branch>"
+    exit 1
+fi
+
+paths_to_push=()
+
+function update_module {
+    local cwd=$1
+    local i
+    local modules=""
+
+    cd $cwd
+
+    # These submodules should be ignored by the loop below.
+    local ignored_modules=(
+        "3rdparty"
+        "IXWebSocket"
+        "c-ares"
+        "caf"
+        "cppzmq"
+        "expected-lite"
+        "filesystem"
+        "highwayhash"
+        "libkqueue"
+        "libunistd"
+        "out_ptr"
+        "prometheus-cpp"
+        "rapidjson"
+        "vcpkg")
+
+    # Note we don't use --recursive here, as we want to do a depth-first
+    # search so that we update children first.
+    for i in $(git submodule foreach -q 'echo $path' | grep -vE $(
+        IFS="|"
+        echo "${ignored_modules[*]}"
+    )); do
+        # See if repository has a branch of the given name. Otherwise leave it alone.
+        (cd $i && git show-ref --verify --quiet refs/heads/$branch) || continue
+
+        modules="$modules $i"
+
+        echo "--- Checking out $branch of $(basename $i)"
+        cd $i
+        git fetch -q || exit 1
+        git checkout -q $branch || exit 1
+        git merge origin/master || exit 1
+
+        update_module $cwd/$i
+
+        cd $cwd
+    done
+
+    if [ "$modules" != "" ]; then
+        if [ -n "$(git status --untracked-files=no --porcelain)" ]; then
+            echo "+++ Committing updates to $(basename $cwd)"
+            git commit -m 'Updating submodule(s) [nomail]' --only $modules
+            paths_to_push+=($cwd)
+        fi
+    fi
+
+}
+
+update_module $(pwd)
+
+echo
+echo "Added ${#paths_to_push[@]} commits. Run the following commands to push them:"
+for path in "${paths_to_push[@]}"; do
+    echo "(cd ${path} && git push)"
+done
--- a/auxil/zeek-aux/devel-tools/git-pre-push-hook
+++ b/auxil/zeek-aux/devel-tools/git-pre-push-hook
@ -0,0 +1,31 @@
+#!/bin/sh
+#
+# A pre-push hook that makes sure all testing/external changes
+# have been pushed already. If not, it will abort. Note that
+# it will only check for unpushed commits, not for uncommitted
+# changes.
+#
+# To install this, copy it into you Zeek tree's .git/hooks/pre-push.
+#
+# This hook is called with the following parameters:
+#
+# $1 -- Name of the remote to which the push is being done
+# $2 -- URL to which the push is being done
+#
+# If this script exits with a non-zero status nothing will be pushed.
+
+test -d testing/external || exit 0
+
+cd testing/external
+
+base=$(pwd)
+abort=0
+
+for repo in $(./scripts/find-git-repos); do
+    cd ${base}/${repo} &&
+        git rev-list @{u}.. | grep -q . &&
+        echo "ERROR: testing/external/$(basename $repo) has commits that are not pushed." &&
+        abort=1
+done
+
+exit ${abort}
--- a/auxil/zeek-aux/devel-tools/git-show-fastpath
+++ b/auxil/zeek-aux/devel-tools/git-show-fastpath
@ -0,0 +1,19 @@
+#! /usr/bin/env bash
+#
+# Shows pending fastpath commits for all modules.
+
+show="git show-ref -q origin/fastpath && git --no-pager log --format=oneline origin/fastpath ^master || exit 0"
+
+(echo "Entering <top-level>" && eval $show && git submodule foreach --recursive "$show") | awk '
+
+/Entering/ { current = $2; next }
+
+{
+    if ( current != "" )
+        print "==" current;
+
+    print;
+
+    current = "";
+}
+'
--- a/auxil/zeek-aux/devel-tools/github-manage
+++ b/auxil/zeek-aux/devel-tools/github-manage
@ -0,0 +1,461 @@
+#! /usr/bin/env python3
+#
+# https://pypi.org/project/argcomplete/#global-completion
+# PYTHON_ARGCOMPLETE_OK
+
+"""This script provides tooling to administrate the github.com/zeek organization."""
+
+import argparse
+import json
+import os
+import sys
+from enum import IntEnum
+from pathlib import Path
+
+# This is the high-level error for API problems, per
+# https://github.com/fastai/ghapi/issues/138 and confirmed
+# in manual testing
+from urllib.error import HTTPError
+
+
+def print_err(*args, **kwargs):
+    print(*args, file=sys.stderr, **kwargs)
+
+
+try:
+    import yaml
+except ImportError:
+    # PyYAML is optional; we will see below whether we need it as we retrieve
+    # the auth token.
+    pass
+
+try:
+    from ghapi.all import GhApi, paged
+except ImportError:
+    print_err("This requires the Python Github API package: https://ghapi.fast.ai")
+    sys.exit(1)
+
+try:
+    # Argcomplete provides command-line completion for users of argparse.
+    # We support it if available, but don't complain when it isn't.
+    import argcomplete
+except ImportError:
+    pass
+
+GITHUB_SERVER = "github.com"
+GITHUB_ORG = "zeek"
+
+# There's a mismatch between how Github shows access levels in the UI vs how
+# they work in the API. We use the UI-level ones here and provide helper
+# functions to translate. The discrepancies are "read" being "pull" in the API,
+# and "write" being "push". The others match.
+AccessLevel = IntEnum("AccessLevel", ["READ", "TRIAGE", "WRITE", "MAINTAIN", "ADMIN"])
+
+
+def get_api_token(args):
+    if args.auth_token:
+        return args.auth_token
+
+    # This is the ghapi-recommended way to configure your token and works
+    # transparently:
+    token = os.getenv("GITHUB_TOKEN")
+    if token:
+        return token
+
+    # Try somewhat hard to locate gh's config file:
+    gh_host_config = (
+        Path(os.getenv("XDG_CONFIG_HOME", default=Path.home() / ".config"))
+        / "gh"
+        / "hosts.yml"
+    )
+    if gh_host_config.is_file():
+        if "yaml" not in sys.modules:
+            print_err(
+                "This requires PyYAML to use your existing gh config. See: https://pyyaml.org"
+            )
+            print_err(
+                "Please set the GITHUB_TOKEN environment variable to your Github API token."
+            )
+            sys.exit(1)
+
+        try:
+            with open(gh_host_config) as stream:
+                ymldata = yaml.safe_load(stream)
+                return ymldata[GITHUB_SERVER]["oauth_token"]
+        except (OSError, yaml.YAMLError, KeyError) as error:
+            print_err(f"Unexpected gh configuration ({error}).")
+            print_err(
+                "Please set the GITHUB_TOKEN environment variable to your Github API token."
+            )
+            sys.exit(1)
+
+    print_err(
+        "Please provide a Github API token via --auth-token or set the GITHUB_TOKEN environment variable"
+    )
+    sys.exit(1)
+
+
+def get_access_level_string(perms):
+    res = get_access_level(perms)
+    if not res:
+        return None
+    return res.name.lower()
+
+
+def access_level_to_github(level):
+    if level == AccessLevel.ADMIN:
+        return "admin"
+    if level == AccessLevel.MAINTAIN:
+        return "maintain"
+    if level == AccessLevel.WRITE:
+        return "push"
+    if level == AccessLevel.TRIAGE:
+        return "triage"
+    if level == AccessLevel.READ:
+        return "pull"
+    return None
+
+
+def access_level_from_github(level):
+    if level == "admin":
+        return AccessLevel.ADMIN
+    if level == "maintain":
+        return AccessLevel.MAINTAIN
+    if level == "push":
+        return AccessLevel.WRITE
+    if level == "triage":
+        return AccessLevel.TRIAGE
+    if level == "pull":
+        return AccessLevel.READ
+    return None
+
+
+def get_access_level(perm):
+    """Returns the access level for a given user/team as shown on the access
+    settings page of a repo, based on the given set of permissions. This returns
+    an AccessLevel, or None when no access level was identifiable.
+    """
+    # This is a bit messy because permissions are presented differently in
+    # different corners of the API. Sometimes it's a string, sometimes an
+    # object with individual permission bits. For now just check if it's a
+    # string and handle that separately.
+    if isinstance(perm, str):
+        return access_level_from_github(perm)
+
+    try:
+        if perm.admin:
+            return AccessLevel.ADMIN
+        if perm.maintain:
+            return AccessLevel.MAINTAIN
+        if perm.push:
+            return AccessLevel.WRITE
+        if perm.triage:
+            return AccessLevel.TRIAGE
+        if perm.pull:
+            return AccessLevel.READ
+    except AttributeError:
+        pass
+
+    return None
+
+
+def get_all_repos(api):
+    """Returns a list of all repos in the GITHUB_ORG, sorted by name."""
+    repos = []
+
+    for page in paged(api.repos.list_for_org, org=GITHUB_ORG, per_page=100):
+        repos.extend(page)
+
+    repos.sort(key=lambda repo: repo.name)
+    return repos
+
+
+def cmd_repos_list_access(api, args):
+    result = []
+
+    for repo in get_all_repos(api):
+        teams = api.repos.list_teams(repo.name)
+        teams_results = []
+        for team in sorted(teams, key=lambda t: t.name):
+            teams_results.append(
+                {
+                    "name": team.name,
+                    "access": get_access_level_string(team.permissions),
+                }
+            )
+
+        # "direct" here means we don't list each individual member of teams that
+        # also have access to the repo:
+        users = api.repos.list_collaborators(repo.name, affiliation="direct")
+        users_results = []
+        for user in sorted(users, key=lambda u: u.login):
+            users_results.append(
+                {
+                    "name": user.login,
+                    "access": get_access_level_string(user.permissions),
+                }
+            )
+
+        result.append(
+            {
+                "repo": repo.name,
+                "teams": teams_results,
+                "users": users_results,
+            }
+        )
+
+    print(json.dumps(result, sort_keys=True))
+    return True
+
+
+def cmd_repos_list_redundant_users(api, args):
+    result = []
+
+    for repo in get_all_repos(api):
+        teams = api.repos.list_teams(repo.name)
+        teams_data = {}
+
+        for team in teams:
+            teams_data[team.name] = {
+                "permission": team.permission,
+                "users": [
+                    member.login
+                    for member in api.teams.list_members_in_org(GITHUB_ORG, team.slug)
+                ],
+            }
+
+        # "direct" here means we don't list each individual member of teams that
+        # also have access to the repo:
+        users = api.repos.list_collaborators(repo.name, affiliation="direct")
+
+        for user in sorted(users, key=lambda u: u.login):
+            for team, data in teams_data.items():
+                if user.login not in data["users"]:
+                    continue
+                # This repo gives access to a team that already includes the
+                # explicitly listed user. See if the user is added with
+                # greater permissions, otherwise this user is redundant.
+                team_access = get_access_level(data["permission"])
+                user_access = get_access_level(user.permissions)
+
+                if user_access <= team_access:
+                    result.append(
+                        {
+                            "repo": repo.name,
+                            "user": user.login,
+                            "redundancy": team,
+                        }
+                    )
+
+    print(json.dumps(result, sort_keys=True))
+    return True
+
+
+def cmd_repos_remove_redundant_users(api, args):
+    result = []
+    outcome = True
+
+    for repo in get_all_repos(api):
+        teams = api.repos.list_teams(repo.name)
+        teams_data = {}
+
+        for team in teams:
+            teams_data[team.name] = {
+                "permission": team.permission,
+                "users": [
+                    member.login
+                    for member in api.teams.list_members_in_org(GITHUB_ORG, team.slug)
+                ],
+            }
+
+        # "direct" here means we don't list each individual member of teams that
+        # also have access to the repo:
+        users = api.repos.list_collaborators(repo.name, affiliation="direct")
+
+        for user in sorted(users, key=lambda u: u.login):
+            for team, data in teams_data.items():
+                if user.login not in data["users"]:
+                    continue
+                # This repo gives access to a team that already includes the
+                # explicitly listed user. See if the user is added with
+                # greater permissions, otherwise this user is redundant.
+                team_access = get_access_level(data["permission"])
+                user_access = get_access_level(user.permissions)
+
+                if user_access <= team_access:
+                    try:
+                        if not args.dry_run:
+                            api.repos.remove_collaborator(repo.name, user.login)
+                        result.append(
+                            {
+                                "repo": repo.name,
+                                "user": user.login,
+                                "success": True,
+                            }
+                        )
+                    except HTTPError as err:
+                        result.append(
+                            {
+                                "repo": repo.name,
+                                "user": user.login,
+                                "success": False,
+                                "code": err.code,
+                                "reason": err.reason,
+                            }
+                        )
+                        outcome = False
+
+    print(json.dumps(result, sort_keys=True))
+    return outcome
+
+
+def cmd_repos_add_team(api, args):
+    if args.access_level not in [level.name.lower() for level in AccessLevel]:
+        print_err(
+            f"The given access level '{args.access_level}' is not valid. See --help.\n"
+        )
+        return False
+
+    access_level = access_level_to_github(AccessLevel[args.access_level.upper()])
+
+    # Resolve the given team name to a slug:
+    team_slug = None
+    teams = sorted(api.teams.list(GITHUB_ORG), key=lambda t: t.name)
+    for team in teams:
+        if (
+            team.name.lower() == args.team.lower()
+            or team.slug.lower() == args.team.lower()
+        ):
+            team_slug = team.slug
+            break
+
+    if not team_slug:
+        print_err(
+            f"Team '{args.team}' is not valid for the '{GITHUB_ORG}' organization."
+        )
+        print_err(f"Must be one of {', '.join(["'" + t.name + "'" for t in teams])}.")
+        return False
+
+    result = []
+    outcome = True
+
+    for repo in get_all_repos(api):
+        try:
+            if not args.dry_run:
+                api.teams.add_or_update_repo_permissions_in_org(
+                    GITHUB_ORG, team_slug, repo.name, access_level
+                )
+            result.append(
+                {
+                    "repo": repo.name,
+                    "success": True,
+                }
+            )
+        except HTTPError as err:
+            result.append(
+                {
+                    "repo": repo.name,
+                    "success": False,
+                    "code": err.code,
+                    "reason": err.reason,
+                }
+            )
+            outcome = False
+
+    print(json.dumps(result, sort_keys=True))
+    return outcome
+
+
+def main():
+    top_parser = argparse.ArgumentParser(
+        description="Helpers for automated Zeek repo administration on Github."
+    )
+
+    top_parser.add_argument(
+        "--auth-token",
+        default=None,
+        help="Your Github API token. You can also use the GITHUB_TOKEN environment "
+        "variable to provide this. As a fallback, this script tries to use your "
+        "gh configuration, if available.",
+    )
+
+    cmd_parser = top_parser.add_subparsers(
+        title="commands",
+        dest="command",
+        help="See `%(prog)s <command> -h` for per-command usage info.",
+    )
+
+    repos_parser = cmd_parser.add_parser(
+        "repos", help="Do something for every repo in the Zeek organization."
+    )
+
+    repos_cmd_parser = repos_parser.add_subparsers(
+        title="commands",
+        dest="command",
+        help="See `%(prog)s <command> -h` for per-command usage info.",
+    )
+
+    repos_list_access_cmd_parser = repos_cmd_parser.add_parser(
+        "list-access",
+        help="List all users and teams that have access to a repo, along with the access level.",
+    )
+    repos_list_access_cmd_parser.set_defaults(run_cmd=cmd_repos_list_access)
+
+    repos_list_redundant_users_cmd_parser = repos_cmd_parser.add_parser(
+        "list-redundant-users",
+        help="List users already covered via teams providing at least the same access level.",
+    )
+    repos_list_redundant_users_cmd_parser.set_defaults(
+        run_cmd=cmd_repos_list_redundant_users
+    )
+
+    repos_remove_redundant_user_cmd_parser = repos_cmd_parser.add_parser(
+        "remove-redundant-users",
+        help="Remove users already included via a team that provides at least the same access level.",
+    )
+    repos_remove_redundant_user_cmd_parser.set_defaults(
+        run_cmd=cmd_repos_remove_redundant_users
+    )
+    repos_remove_redundant_user_cmd_parser.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Don't make any changes, just pretend API calls succeed",
+    )
+
+    repos_add_team_cmd_parser = repos_cmd_parser.add_parser(
+        "add-team",
+        help="Add the given team to each repository at the given access level. Teams that already have access are updated to the provided level.",
+    )
+    repos_add_team_cmd_parser.set_defaults(run_cmd=cmd_repos_add_team)
+
+    repos_add_team_cmd_parser.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Don't make any changes, just pretend API calls succeed",
+    )
+    repos_add_team_cmd_parser.add_argument(
+        "--team", required=True, help="The name or slug of the team. Case-insensitive."
+    )
+    repos_add_team_cmd_parser.add_argument(
+        "--access-level",
+        required=True,
+        help=f"The access level. One of {', '.join(["'" + level.name.lower() + "'" for level in AccessLevel])}.",
+    )
+
+    if "argcomplete" in sys.modules:
+        argcomplete.autocomplete(top_parser)
+
+    args = top_parser.parse_args()
+    api = GhApi(owner=GITHUB_ORG, token=get_api_token(args))
+
+    try:
+        return args.run_cmd(api, args)
+    except HTTPError as err:
+        sys.stderr.write(f"API error at {err.url}: {err.code}, {err.reason}\n")
+        return False
+    except KeyboardInterrupt:
+        return False
+
+
+if __name__ == "__main__":
+    sys.exit(0 if main() else 1)
--- a/auxil/zeek-aux/devel-tools/make-release
+++ b/auxil/zeek-aux/devel-tools/make-release
@ -0,0 +1,129 @@
+#! /usr/bin/env bash
+#
+# Makes release tarballs for the repository in the current directory;
+# and if --recursive is given, also for all submodules.
+
+DEST="$(pwd)/build/dist" # Where to put the TGZs.
+LOGS="$DEST/.log"        # Where to put build logs.
+
+dists=""
+
+function usage() {
+    echo "Usage: $(basename $0) [--recursive]"
+}
+
+function release() {
+    mod=$1
+    tmp="$LOGS/make-release.$(basename $mod).log"
+
+    cat </dev/null >$tmp
+
+    echo "--- Building distribution for $mod" >&2
+    echo "Log in $tmp." >&2
+
+    make dist >$tmp 2>&1
+
+    cat $tmp | awk '/CPack:.*generated/ {print $4} /^Package: / {print $2}' | while read tgz; do
+        if echo $tgz | grep -qv ^/; then
+            tgz="$(pwd)/$tgz"
+        fi
+
+        version=$(git tag --contains HEAD | grep -E '^(release|beta)$')
+
+        if [ "$version" == "" ]; then
+            version="git"
+        fi
+
+        echo "Distribution in $tgz ($version)" >&2
+        ls -al $tgz | awk '{print "    ", $0; }' >&2
+
+        echo "$tgz#$version"
+    done
+}
+
+if [ "$1" == "--recursive" ]; then
+    submodules=1
+    shift
+fi
+
+if [ "$submodules" == "1" ]; then
+    mods=$(git submodule foreach -q --recursive pwd | grep -v /cmake)
+fi
+
+if [ -e $DEST ]; then
+    echo
+    echo "$DEST exists already, proceeding will delete it."
+    echo ">> Continue? (y/n)"
+    read line
+    if [ "$line" != "y" ]; then
+        exit 1
+    fi
+fi
+
+rm -rf $DEST
+install -d $DEST
+install -d $LOGS
+
+mods="$mods ."
+
+build=
+
+for mod in $mods; do
+    cwd=$(pwd)
+    cd $mod
+
+    if [ "$mod" = "." ]; then
+        mod=$(pwd)
+        mod=$(basename $mod)
+    fi
+
+    if [ ! '(' -e CMakeLists.txt -o -e Makefile ')' ]; then
+        echo "No CMakeLists.txt or Makefile in $mod, skipping."
+        cd $cwd
+        continue
+    fi
+
+    ignore=1
+
+    if [ "$(git describe HEAD)" = "$(git describe release 2>/dev/null)" ]; then
+        ignore=0
+    fi
+
+    if [ "$(git describe HEAD)" = "$(git describe beta 2>/dev/null)" ]; then
+        ignore=0
+    fi
+
+    if [ "$ignore" = "1" ]; then
+        echo "Module $mod is not tagged for release or beta, skipping."
+        cd $cwd
+        continue
+    fi
+
+    dist=$(release $mod)
+    (echo $dist | grep -qv "^ *$") || echo "No distribution found for $mod."
+
+    dists="$dists $dist"
+    echo
+
+    cd $cwd
+done
+
+for dist in $dists; do
+    tgz=$(echo $dist | cut -d '#' -f 1)
+    version=$(echo $dist | cut -d '#' -f 2)
+    dst=$(basename $tgz)
+    dst="$DEST/$version/$(echo $dst | sed 's/\.tgz/.tar.gz/g')"
+
+    install -d $DEST/$version
+    mv $tgz $dst
+
+    echo Signing $dst ...
+    sign-file $dst
+
+done
+
+echo "--- All distributions in $DEST:"
+
+all=$(find $DEST -path '*gz*')
+test "$all" != "" && ls -rl $all || echo "None."
+echo
--- a/auxil/zeek-aux/devel-tools/perf-benchmark
+++ b/auxil/zeek-aux/devel-tools/perf-benchmark
@ -0,0 +1,230 @@
+#!/bin/sh
+
+ZEEK_BUILD=""
+DATA_FILE=""
+MODE="intf"
+INTERFACE=""
+SEED_FILE=""
+
+# Path where flamegraph is installed
+FLAMEGRAPH_PATH=""
+FLAMEGRAPH_PREFIX="benchmark"
+
+usage() {
+    usage="\
+Usage: $0 -z [zeek binary path] -d [data file path]
+
+  Options:
+    -b, --build PATH        The path to a Zeek binary to benchmark
+    -d, --data-file PATH    The path to a data file to read from for replay
+    -m, --mode MODE         This can be one of three possible values:
+                            intf, read, or flamegraph. This controls what
+                            mode is used for the benchmark run, and defaults
+                            to intf if not passed. The modes are described
+                            below.
+    -i, --interface INTF    The network interface to use for capturing data.
+                            This interface should be completely idle, since
+                            tcpreplay will be using it to replay the data.
+                            This argument is ignored if the mode is 'file'.
+    -f, --flamegraph PATH   The path to the directory where Flamegraph is
+                            installed. This argument is required if the mode
+                            is 'flamegraph', but is ignored otherwise.
+    -o, --output FILE       The file prefix to use as output for Flamegraph.
+                            This defaults to 'benchmark'. This argument is ignored
+                            if the mode is not 'flamegraph'.
+    -s, --seed FILE         (optional) A path to a Zeek random seed file.
+                            This is used control the generation of connection
+                            IDs and other data so it is consistent between
+                            benchmarking runs.
+
+    By default or when 'intf' is passed for the mode argument, the output will
+    include CPU, memory, etc statistics from Zeek processing all of the data
+    in the data file as if it was reading it live from the network. This mode
+    requires an interface to be passed using the -i argument.
+
+    When 'file' is passed for the mode (-m) argument, the output will include
+    the runtime and maximum memory usage of Zeek when reading the data file
+    directly from disk.
+
+    When 'flamegraph' is passed for the mode (-m) argument, this script will
+    output two flamegraphs for the process runtime in svg format. The first
+    flamegraph is a standard graph showing the time spent in functions,
+    stacked in the normal manner. The second graph is 'stack-reversed'.
+
+    Symbols in Flamegraph outputs may not correctly stack unless the various
+    libraries linked into Zeek are built with frame pointers. This includes
+    glibc, libpcap, and openssl. Rebuilding those libraries with the
+    -fno-omit-frame-pointer compiler flag may provide more accurate output.
+    You can set libraries that get preloaded by setting the PRELOAD_LIBS
+    variable in the script.
+
+    This script assumes that it is being run on a system with a large number
+    of CPU cores. If being used on a smaller system, modify this script and
+    set the ZEEK_CPU and TCPREPLAY_CPU variables to smaller values.
+"
+
+    echo "${usage}"
+    exit 1
+}
+
+while ( ("$#")); do
+    case "$1" in
+        -d | --data-file)
+            DATA_FILE=$2
+            shift 2
+            ;;
+        -b | --build)
+            ZEEK_BUILD=$2
+            shift 2
+            ;;
+        -m | --mode)
+            MODE=$2
+            shift 2
+            ;;
+        -i | --interface)
+            INTERFACE=$2
+            shift 2
+            ;;
+        -f | --flamegraph)
+            FLAMEGRAPH_PATH=$2
+            shift 2
+            ;;
+        -o | --output)
+            FLAMEGRAPH_PREFIX=$2
+            shift 2
+            ;;
+        -s | --seed)
+            SEED_FILE=$2
+            shift 2
+            ;;
+    esac
+done
+
+if [ "${MODE}" != "intf" -a "${MODE}" != "file" -a "${MODE}" != "flamegraph" ]; then
+    echo "Error: -m argument should be one of 'intf', 'file', or 'flamegraph'"
+    echo
+    usage
+fi
+
+if [ -z "${ZEEK_BUILD}" ]; then
+    echo "Error: -b argument is required and should point at a Zeek binary"
+    echo
+    usage
+fi
+
+if [ -z "${DATA_FILE}" ]; then
+    echo "Error: -d argument is required and should point at a pcap file to replay"
+    echo
+    usage
+fi
+
+if [ "${MODE}" != "file" -a -z "${INTERFACE}" ]; then
+    echo "Error: -i argument is required for the ${MODE} mode and should point to an idle network interface"
+    echo
+    usage
+fi
+
+# Various run-time options
+ZEEK_CPU=10
+TCPREPLAY_CPU=11
+PRELOAD_LIBS=""
+
+ZEEK_ARGS=""
+if [ "${MODE}" != "file" ]; then
+    ZEEK_ARGS="-i af_packet::${INTERFACE}"
+fi
+
+if [ -n "${SEED_FILE}" ]; then
+    ZEEK_ARGS="${ZEEK_ARGS} -G ${SEED_FILE}"
+fi
+
+if [ "${MODE}" = "intf" ]; then
+
+    TIME_FILE=$(mktemp)
+
+    echo "####### Testing reading data file from a network interface #######"
+    echo "Running '${ZEEK_BUILD} ${ZEEK_ARGS}' against ${DATA_FILE}"
+    # Start zeek, find it's PID, then wait 10s to let it reach a steady state
+    taskset --cpu-list $ZEEK_CPU time -f "%M" -o $TIME_FILE $ZEEK_BUILD $ZEEK_ARGS &
+    TIME_PID=$!
+
+    sleep 5
+    ZEEK_PID=$(ps -ef | awk -v timepid="${TIME_PID}" '{ if ($3 == timepid) { print $2 } }')
+    renice -20 -p $ZEEK_PID >/dev/null
+    sleep 5
+    echo "Zeek running on PID ${ZEEK_PID}"
+
+    # Start perf stat on the zeek process
+    perf stat -p $ZEEK_PID &
+    PERF_PID=$!
+
+    # Start replaying the data
+    echo "Starting replay"
+    taskset --cpu-list $TCPREPLAY_CPU tcpreplay -i $INTERFACE -q $DATA_FILE
+
+    # Capture the average CPU usage of the process
+    CPU_USAGE=$(ps -p $ZEEK_PID -o %cpu=)
+
+    # Kill everything
+    echo
+    kill -2 $ZEEK_PID
+    wait $TIME_PID
+    wait $PERF_PID
+
+    echo "Maximum memory usage (max_rss): $(head -n 1 ${TIME_FILE}) bytes"
+    echo "Average CPU usage: ${CPU_USAGE}%"
+
+    rm $TIME_FILE
+
+elif [ "${MODE}" = "file" ]; then
+
+    TIME_FILE=$(mktemp)
+
+    echo "####### Testing reading the file directly from disk #######"
+    taskset --cpu-list $ZEEK_CPU time -f "%e %M" -o $TIME_FILE $ZEEK_BUILD $ZEEK_ARGS -r $DATA_FILE
+    TIME_PID=$!
+    ZEEK_PID=$(ps -ef | awk -v timepid="${TIME_PID}" '{ if ($3 == timepid) { print $2 } }')
+    renice -20 -p $ZEEK_PID >/dev/null
+    awk '{print "Time spent: " $1 " seconds\nMax memory usage: " $2 " bytes"}' $TIME_FILE
+
+    rm $TIME_FILE
+
+elif [ "${MODE}" = "flamegraph" ]; then
+
+    echo "####### Generating flamegraph data #######"
+
+    PERF_RECORD_FILE=$(mktemp)
+    PERF_COLLAPSED_FILE=$(mktemp)
+
+    # Start zeek under perf record, then sleep for a few seconds to let it actually start up. For runs with
+    # shorter amounts of data or with slower traffic, you can add '-c 499' here to get finer-grained results.
+    # With big data sets, it just results in the graph getting blown out by waits in the IO loop.
+    LD_PRELOAD=${PRELOAD_LIBS} perf record -g -o $PERF_RECORD_FILE -- $ZEEK_BUILD $ZEEK_ARGS &
+    PERF_PID=$!
+
+    sleep 5
+
+    ZEEK_PID=$(ps -ef | awk -v perfpid="${PERF_PID}" '{ if ($3 == perfpid) { print $2 } }')
+    echo "Zeek running on PID ${ZEEK_PID}"
+
+    # Start replaying the data
+    echo "Starting replay"
+    taskset --cpu-list $TCPREPLAY_CPU tcpreplay -i $INTERFACE -q $DATA_FILE
+
+    # Kill everything
+    echo
+    kill -2 $ZEEK_PID
+    wait $PERF_PID
+
+    echo
+    echo "####### Collapsing perf stack data #######"
+    perf script -i $PERF_RECORD_FILE | ${FLAMEGRAPH_PATH}/stackcollapse-perf.pl >$PERF_COLLAPSED_FILE
+    echo "####### Building normal flamegraph, writing to ${FLAMEGRAPH_PREFIX}.svg #######"
+    cat $PERF_COLLAPSED_FILE | ${FLAMEGRAPH_PATH}/flamegraph.pl >"${FLAMEGRAPH_PREFIX}.svg"
+    echo "####### Building reverse flamegraph, writing to ${FLAMEGRAPH_PREFIX}-reversed.svg #######"
+    cat $PERF_COLLAPSED_FILE | ${FLAMEGRAPH_PATH}/flamegraph.pl --reverse >"${FLAMEGRAPH_PREFIX}-reversed.svg"
+
+    rm $PERF_RECORD_FILE
+    rm $PERF_COLLAPSED_FILE
+
+fi
--- a/auxil/zeek-aux/devel-tools/repo-status
+++ b/auxil/zeek-aux/devel-tools/repo-status
@ -0,0 +1,18 @@
+#! /usr/bin/env bash
+#
+# Helper for check-release.
+
+repo=$(basename $(git config --get remote.origin.url) | sed 's/^[^:]*://')
+head=$(basename $(git symbolic-ref -q HEAD))
+
+update_changes="$(dirname $0)/update-changes"
+
+printf "%20s    " "$repo"
+printf "%-10s " "$head"
+printf "%-8s " $($update_changes -c | grep -q NOT && echo 'old!' || echo ok)
+printf "%-8s " $(git log --oneline $head ^origin/$head | wc -l | awk '$1==0{printf("%s",$1)} $1!=0{printf("%s!",$1)}')
+printf "%-7s " $(git status --porcelain | awk 'NF!=1' | grep -q '.' && echo 'Mod!' || echo ok)
+printf "%-5s " $(git submodule status --recursive | sed 's/^\(\.\).*/\1/g' | grep -q '^ $' && echo 'Mod!' || echo ok)
+printf "%-15s " $(cat VERSION | awk '/-/{printf("%s!", $1); next} {printf("%s", $1)}')
+printf "%s" $(git tag -l --contains HEAD | sort -r | paste -sd ',' | awk '/release|beta/{printf("%s",$1); next;} {printf("%s!",$1)}')
+echo
--- a/auxil/zeek-aux/devel-tools/sign-file
+++ b/auxil/zeek-aux/devel-tools/sign-file
@ -0,0 +1,29 @@
+#! /usr/bin/env bash
+#
+# Signs $1 with the Zeek GPG key. Signature will be written to $1.asc.
+#
+# GPG agent needs to be running.
+#
+# Needs gpg2.
+
+GPG=$(which gpg2)
+KEY=F8CB8019
+
+if [ "$GPG" == "" ]; then
+    echo "Can't find gpg2."
+    exit 1
+fi
+
+if [ "$#" != 1 ]; then
+    echo "usage: $(basename $0) <file>"
+    exit 1
+fi
+
+if ! gpg-agent -q; then
+    echo "GPG agent not running."
+    exit 1
+fi
+
+FILE=$1
+
+$GPG --detach-sign -a -u $KEY --openpgp -o $FILE.asc $FILE
--- a/auxil/zeek-aux/devel-tools/update-changes
+++ b/auxil/zeek-aux/devel-tools/update-changes
@ -0,0 +1,630 @@
+#! /usr/bin/env bash
+#
+# Assembles a draft CHANGES entry out of revisions committed since the last
+# entry was added. The entry is prepended to the current CHANGES file, and the
+# user then gets a chance to further edit it in the editor before it gets
+# committed.
+#
+# The script also maintains and updates a VERSION file.
+#
+# If the script finds a file called .update-changes.cfg it sources it at the
+# beginning. That script can define a function "new_version_hook" that will be
+# called with the new version number. It may use any of the replace_version_*
+# functions defined below to update other files as necessary.
+#
+# If $1 is given, it's interpreted as a release version and a corresponding
+# tag is created.
+#
+# To start using update-changes in a new project, proceed as follows:
+#
+# (1) Run "update-changes -I". This will initialize the CHANGES file and, if
+#     needed, establish suitable git tags that update-changes requires in order
+#     to start enumerating commits after a release. You can also prepare the
+#     initial version number in the VERSION file if you prefer that approach.
+#
+# (2) If you're planning to use an .update-changes.cfg file, add it as well as
+#     any corresponding changes it requires. Continue regular development, and
+#     when ready, run update-changes to reflect the first actual changeset in
+#     the CHANGES file.
+#
+file_changes="CHANGES"                         # The CHANGES file.
+file_version="VERSION"                         # The VERSION file.
+file_config=".update-changes.cfg"              # This will be sourced if available.
+new_version_hook="new_version_hook"            # Function that will be called with new version number.
+new_commit_msg="Updating CHANGES and VERSION." # Commit message when creating a new commit.
+init_commit_msg="Starting CHANGES."            # Commit message when we initialize CHANGES
+show_authors=1                                 # Include author names with commit.
+
+# The command line used to generate a revision's version string, such as
+# v1.0.0-23-gabcdef. This relies on tags to work, which update-changes checks
+# for. By default this only finds annotated tags; to allow lightweight ones as
+# well, add --tags.
+git_describe="git describe --tags" # {rev} will be added.
+
+# The command line used to generate a revision's date. The revision will be
+# appended.  Not used with Zeek-style CHANGES file.
+git_rev_date="git show -s --pretty=tformat:%ci"
+
+# The command line used to generate the list of revisions between old and new
+# state.
+git_rev_list="git rev-list --topo-order HEAD" # ^{past-rev} will be added.
+
+# The command line used to show the one-line summary of a revision before
+# editing.
+git_rev_summary="git show -s '--pretty=tformat: %h | %aN | %s'" # {rev} will be added.
+
+# The command line used to get a revision's author.
+git_author="git show -s --pretty=format:%aN"       # {rev} will be added.
+git_author_email="git show -s --pretty=format:%aE" # {rev} will be added.
+
+# The command line used to get a revision's message.
+git_msg=default_format_msg # {rev} will be added.
+
+# Portable access to ERE, see e.g. https://unix.stackexchange.com/a/131940
+if [ $(uname) == "Linux" ]; then
+    sed="sed -r"
+else
+    sed="sed -E"
+fi
+
+function usage {
+    echo "usage: $(basename $0) [options]"
+    echo
+    echo "    -p <rev>    Explicitly name the past revision to compare with."
+    echo "    -R <tag>    Tag the current revision as a release. Update VERSION to use that."
+    echo "    -B <tag>    Tag the current revision as a beta release. Update VERSION to use that."
+    echo "    -r          Tag the current revision as a release, using the next point version as version tag."
+    echo "    -I          Initialize a new, initially empty CHANGES file."
+    echo "    -c          Check whether CHANGES is up to date."
+    echo "    -n          Do not amend the HEAD commit when feasible, create a new one."
+    echo
+    exit 1
+}
+
+# Takes a version string as input and turns it into a Python-styled one. For
+# example, input "1.2-23" becomes "1.2.dev23". Other formats remain
+# unchanged. See: https://peps.python.org/pep-0440/#version-scheme
+function pythonic_version {
+    echo "$1" | $sed "s#-#.dev#"
+}
+
+### Functions that can be used to replace version strings in other files.
+### To use them, create a file $file_config and define a function
+### "new_version_hook" in there that does whatever is necessary, like calling
+### any of these.
+
+# Function that looks for lines of the form 'VERSION="1.2.3"' in $1. It will
+# replace the version number with $2 and then git-adds the change.
+function replace_version_in_script {
+    file=$1
+    version=$2
+
+    cat $file | $sed "s#^([[:blank:]]*VERSION[[:blank:]]*=[[:blank:]]*)\"([0-9.-]+)\"#\1\"$version\"#g" >$file.tmp
+    cat $file.tmp >$file
+    rm -f $file.tmp
+    git add $file
+}
+
+# Function that looks for lines of the form '.. |version| replace:: 0.3' in $1.
+# It will replace the version number with $2 and then git-adds the change.
+function replace_version_in_rst {
+    file=$1
+    version=$2
+
+    cat $file | $sed "s#^([[:blank:]]*\.\.[[:blank:]]*\|version\|[[:blank:]]*replace::[[:blank:]]*)([0-9a-zA-Z.-]+)#\1$version#g" >$file.tmp
+    cat $file.tmp >$file
+    rm -f $file.tmp
+    git add $file
+}
+
+# Function that checks file $1 for lines starting with 'version =
+# "<version>"', where the version string can be of release form (e.g. "1.2.3")
+# or a development one, expressed as "1.2-23" or the Python-styled "1.2.dev23".
+# It will replace the version number with a Python-styled form of $2, then
+# git-add the change.
+function replace_version_in_setup_py {
+    file=$1
+    version=$(pythonic_version $2)
+
+    # The version string can be a sequence of digits and dots, optionally
+    # followed by either "-" or ".dev" plus at least one digit.
+    cat $file | $sed "s#^([[:blank:]]*version[[:blank:]]*=[[:blank:]]*)\"[0-9.]+((-|\.dev)[0-9]+)?\"#\1\"$version\"#g" >$file.tmp
+    cat $file.tmp >$file
+    rm -f $file.tmp
+    git add $file
+}
+
+# Function that checks file $1 for lines starting with '__version__ =
+# "<version>"', where the version string can be of release form (e.g. "1.2.3")
+# or a development one, expressed as "1.2-23" or the Python-styled "1.2.dev23".
+# It will replace the version number with a Python-styled form of $2, then
+# git-add the change.
+function replace_version_in_python_package {
+    file=$1
+    version=$(pythonic_version $2)
+
+    # The version string can be a sequence of digits and dots, optionally
+    # followed by either "-" or ".dev" plus at least one digit.
+    cat $file | $sed "s#^([[:blank:]]*__version__[[:blank:]]*=[[:blank:]]*)\"[0-9.]+((-|\.dev)[0-9]+)?\"#\1\"$version\"#g" >$file.tmp
+    cat $file.tmp >$file
+    rm -f $file.tmp
+    git add $file
+}
+
+# Function that looks for lines of the form "#define .*VERSION "0.3"", with the
+# number being "version * 100". It will replace the version with $2 and then
+# git-adds the change.
+function replace_version_in_c_header {
+    file=$1
+    version=$2
+
+    cat $file | $sed "s#([[:blank:]]*\#define[[:blank:]]*[_A-Za-z0-9]*_VERSION[[:blank:]]*)\"[0-9.-]+\"#\1\"$version\"#g" >$file.tmp
+    mv $file.tmp $file
+    git add $file
+}
+
+# Default function for preparing commit message. This scans the message for
+# GitHub issue references to include.
+function default_format_msg {
+    if command -v gawk &>/dev/null; then
+        # We need gawk for the match().
+        git show -s --pretty=format:%B $1 |
+            gawk '
+                match($0, "([Ii]ssue|[Gg][Hh]|#)[ _-]?([0-9]+)", x) { issues[x[2]] = 1; }
+                                                                    { msg = msg $0 "\n"; }
+                END {
+                    if ( ! match(msg, "^GH-[0-9]+") ) {
+                        for ( i in issues )
+                            printf("GH-%s: ", i);
+                    }
+
+                    print msg;
+                }'
+    else
+        git show -s --pretty=format:%B $1
+    fi
+}
+
+###
+
+function version {
+    rev=$1
+    $git_describe $rev --match "v*" 2>/dev/null | $sed 's/^v//g' | $sed 's/-g.*//g' | $sed 's/-([[:alnum:]]+)-([0-9]+)$/-\1.\2/g'
+}
+
+function start_changes_entry {
+    version=$1
+    dst=$2
+
+    if [ "$zeek_style" == "0" ]; then
+        date=$($git_rev_date HEAD)
+        printf '%s | %s\n' "$version" "$date" >>$dst
+    else
+        date=$(date)
+        printf '%s %s\n' "$version" "$date" >>$dst
+    fi
+}
+
+function add_to_changes_entry {
+    rev=$1
+    dst=$2
+    msg=$3
+
+    author=""
+
+    if [ "$msg" == "" ]; then
+        if [ "$show_authors" == "1" ]; then
+            author_email=$($git_author_email $rev)
+            author=$($git_author $rev)
+
+            if [[ "$author_email" == *@corelight.com ]]; then
+                author=" ($author, Corelight)"
+            else
+                author=" ($author)"
+            fi
+        fi
+
+        msg=$($git_msg $rev)
+    fi
+
+    if [ "$msg" == "" ]; then
+        return 1
+    fi
+
+    if echo $msg | grep -q "^$new_commit_msg\$"; then
+        # Ignore our own automated commits.
+        return 1
+    fi
+
+    if [[ $(git show --no-patch --format='%P' "$rev" | wc -w) -gt 1 ]]; then
+        # Ignore merge commits, i.e., commits with more than one parent.
+        return 1
+    fi
+
+    echo >>$dst
+
+    if [ "$zeek_style" == "0" ]; then
+        bullet="  *"
+    else
+        bullet="-"
+    fi
+
+    echo -n "$msg" |
+        awk -v bullet="$bullet" -v author="$author" 'NR==1{printf "%s %s%s\n", bullet, $0, author; next }{printf "    %s\n", $0}' |
+        $sed 's/[[:blank:]]*$//' >>$dst
+
+    return 0
+}
+
+function init_changes {
+    for rev in $(git rev-list HEAD); do
+        version=$(version $rev)
+        [ -n "$version" ] && break
+    done
+
+    git_version=$version
+
+    if [ "$version" == "" ] && [ -f $file_version ]; then
+        # git doesn't offer version info, but there's a VERSION file.
+        # Consider it if the user's okay with it.
+        version=$(cat $file_version | head -1)
+        if [ -n "$version" ]; then
+            echo "This git repo doesn't yet offer suitable version tags."
+            read -p "Use '$version' from $file_version? Y/n " -n 1 -r
+            echo
+            if [ -n "$REPLY" ] && [[ $REPLY != [Yy] ]]; then
+                version=
+            fi
+        fi
+    fi
+
+    if [ "$version" == "" ]; then
+        read -p "No initial version available, please provide one (e.g. 0.1, 1.0.0): " -r version
+        if [[ "$version" == v* ]]; then
+            # We don't need a "v" prefix here, it only exists in the git tags.
+            version=${version:1}
+        fi
+    fi
+
+    # Subtle: if we're basing this CHANGES intro on a git tag, then we have a
+    # chicken-and-egg problem with correct numbering of the commit introducing
+    # CHANGES. It is itself going to be the _next_ commit. We could increment
+    # the git-derived version number arithmetically, but it's easier to just
+    # commit an empty CHANGES and then augment that below.
+    if [ -n "$git_version" ]; then
+        touch $file_changes
+        git add $file_changes
+        git commit -m "$init_commit_msg"
+        version=$(version HEAD)
+        flags="--amend"
+    fi
+
+    start_changes_entry $version $file_changes
+    echo >>$file_changes
+    echo "  * Starting $file_changes." >>$file_changes
+
+    git add $file_changes
+    git commit $flags -m "$init_commit_msg"
+
+    if [ -z "$git_version" ]; then
+        git tag "v$version"
+    fi
+}
+
+function get_last_rev {
+    version=$(cat $file_changes | grep -E '^[0-9a-zA-Z.-]+  *\|' | head -1 | awk '{print $1}')
+
+    if echo $version | grep -q -- '-'; then
+        # version is now e.g. 1.0.4-14 -- find the revision with that number.
+        for rev in $(git rev-list HEAD); do
+            v=$(version $rev)
+
+            if [ "$v" == "$version" ]; then
+                echo $rev
+                return
+            fi
+        done
+
+        echo "Cannot determine revision for version $version." >/dev/stderr
+        exit 1
+
+    else
+        # A tag.
+        echo "v$version"
+    fi
+}
+
+function check_release_tag {
+    if [ "$release" != "" ]; then
+        git tag -d $release 2>/dev/null
+        git tag -a $release -m "Version tag"
+        echo "Tagged with new tag $release."
+        echo
+        echo "Push with: "
+        echo
+        echo "    git push origin && git push origin $release"
+        echo
+    fi
+}
+
+function check_beta_tag {
+    if [ "$beta" != "" ]; then
+        git tag -d $beta 2>/dev/null
+        git tag -a $beta -m "Beta version tag"
+        echo "Tagged with new tag $beta."
+        echo
+        echo "Push with: "
+        echo
+        echo "    git push origin && git push origin $beta"
+        echo
+    fi
+}
+
+function check_submodules {
+    if git submodule status --recursive | grep ^+; then
+        cat <<EOF
+
+The revision recorded for the module(s) above does not
+match the one currently checked out in the respective
+subdirs.
+
+Please either update or checkout the recorded revision(s).
+
+Aborting.
+EOF
+
+        exit 1
+    fi
+}
+
+function get_release_version {
+    # If $1 is provided, return that. Otherwise look for most recent release
+    # version in CHANGES and increase its point version.
+    test -n "$1" && echo "$1" && return
+    old=$(cat $file_changes | grep -E '^[0-9]+\.[0-9]+\.[0-9]+(-(dev\.)?[0-9]+)? ' | cut -d ' ' -f 1 | head -1)
+    test -z "${old}" && echo "" && return
+    point=$(echo ${old} | cut -d - -f 1 | cut -d . -f 3)
+    point=$((${point} + 1))
+    new="$(echo ${old} | cut -d . -f 1-2).${point}"
+    echo v${new}
+}
+
+######
+
+last_rev=""
+release=""
+beta=""
+init=0
+check=0
+quiet=0
+no_amends=0
+
+while getopts "hp:rR:B:Icn" opt; do
+    case "$opt" in
+        p) last_rev="$OPTARG" ;;
+        R) release="$OPTARG" ;;
+        r)
+            release=$(get_release_version)
+            if [ -z "${release}" ]; then
+                echo "Cannot determine release version."
+                exit 1
+            fi
+            ;;
+        B) beta="$OPTARG" ;;
+        I) init=1 ;;
+        c)
+            check=1
+            quiet=1
+            ;;
+        n) no_amends=1 ;;
+        *) usage ;;
+    esac
+done
+
+if [ -e $file_config ]; then
+    if [ "$quiet" != "1" ]; then
+        echo Reading $file_config ...
+    fi
+    source ./$file_config
+fi
+
+if [ "$release" != "" -a "$beta" != "" ]; then
+    echo "Cannot tag as both beta and release."
+    exit 1
+fi
+
+if [ "$release" == "VERSION" ]; then
+    release="v$(cat VERSION)"
+fi
+
+if [ "$beta" == "VERSION" ]; then
+    beta="v$(cat VERSION)"
+fi
+
+zeek_style=0 # If 1, we use a slightly different format.
+
+if [ "$init" != "0" ]; then
+    if [ -e $file_changes ]; then
+        echo "$file_changes already exists, remove it first."
+        exit 1
+    else
+        echo "Initializing $file_changes ..."
+        init_changes
+        exit 0
+    fi
+else
+    if [ ! -e $file_changes ]; then
+        echo "$file_changes does not exist, initialize it with '-I'."
+        exit 1
+    else
+        # If we find this marker, it's Zeek-style CHANGES file.
+        grep -vq -- '-+-+-+-+-+-+-+-+-+-' $file_changes
+        zeek_style=$?
+    fi
+fi
+
+if [ "$release" != "" ]; then
+    if ! echo $release | grep -E -q '^v[0-9]+\.[0-9]+'; then
+        echo "Release tag must be of the form vX.Y[.Z]"
+        exit 1
+    fi
+
+    check_submodules
+fi
+
+if [ "$beta" != "" ]; then
+    if ! echo $beta | grep -E -q '^v[0-9]+\.[0-9]+(\.[0-9]+)?-(beta|rc)'; then
+        echo "Release tag must be of the form vX.Y[.Z]-(beta|rc)*"
+        exit 1
+    fi
+
+    check_submodules
+fi
+
+if [ "$last_rev" == "" ]; then
+    last_rev=$(get_last_rev)
+fi
+
+if [ "$last_rev" == "" ]; then
+    echo 'Cannot determine previous revision to compare with, specify with "-p <rev>".'
+    exit 1
+fi
+
+auto_version=$(version HEAD)
+
+if [ "$auto_version" == "" ]; then
+    echo "Cannot determine version, checking HEAD did not return anything."
+    exit 1
+fi
+
+tmp=${file_changes}.$$.tmp
+trap "rm -f $tmp" EXIT
+rm -f $tmp
+
+found=0
+
+new_version=$auto_version
+version=$(version $rev)
+
+if [ "$version" == "" ]; then
+    echo "Cannot determine version for $rev."
+    exit 1
+fi
+
+if [ "$release" != "" ]; then
+    new_version=$(echo $release | sed 's/v//g')
+fi
+
+if [ "$beta" != "" ]; then
+    new_version=$(echo $beta | sed 's/v//g')
+fi
+
+if [ "$quiet" != "1" ]; then
+    echo "New version is $new_version."
+    echo "Listing revisions committed since $(version $last_rev) ($last_rev) ... "
+    echo
+fi
+
+start_changes_entry $new_version $tmp
+
+for rev in $($git_rev_list ^$last_rev); do
+
+    version=$(version $rev)
+
+    if [ "$version" == "" ]; then
+        version="<no-version>"
+    fi
+
+    # printf "%15s |" $version
+
+    if add_to_changes_entry $rev $tmp; then
+        found=1
+
+        if [ "$quiet" != "1" ]; then
+            eval "$git_rev_summary $rev | grep -v '^$' | cat"
+        fi
+    fi
+
+done
+
+if [ "$found" == "0" ]; then
+    if [ "$check" == "1" ]; then
+        echo "CHANGES is up to date."
+        exit 0
+    fi
+
+    echo "  None."
+    echo
+
+    if [ "$release" != "" -o "$beta" != "" ]; then
+        add_to_changes_entry head $tmp "Release $new_version."
+    else
+        exit 0
+    fi
+fi
+
+if [ "$check" == "1" ]; then
+    echo "CHANGES is NOT up to date."
+    exit 1
+fi
+
+echo >>$tmp
+
+cat $file_changes >>$tmp
+
+# If we are ahead of origin, we can amend. If not, we need to create a new
+# commit even if the user wants otherwise. If the user requested -n (no
+# amendments), we skip all of this.
+amend=0
+
+if [ $no_amends == "0" ] &&
+    git remote | grep -q origin &&
+    git rev-list origin/$(git rev-parse --abbrev-ref HEAD)..HEAD | grep -q .; then
+    amend=1
+fi
+
+echo
+
+if [ "$amend" == "0" ]; then
+    echo Update to $file_changes will become a new commit.
+else
+    echo Update to $file_changes will be amended to last commit.
+fi
+
+echo
+echo Type Enter to edit new $file_changes, or CTRL-C to abort without any modifications.
+read
+
+# Run editor.
+if [ -z "$EDITOR" ]; then
+    EDITOR=vi
+fi
+eval $EDITOR $tmp
+
+# Put changes in place.
+mv $tmp $file_changes
+echo "Updated $file_changes."
+
+if [ "$file_version" != "" ]; then
+    echo $new_version >$file_version
+    echo "Updated $version to $new_version."
+fi
+
+# Call hook function if it exists.
+if type $new_version_hook >/dev/null 2>&1; then
+    $new_version_hook $new_version
+fi
+
+# Commit changes.
+git add $file_changes $file_version
+
+if [ "$amend" == "1" ]; then
+    git commit --amend
+else
+    git commit -m "$new_commit_msg"
+fi
+
+echo "Updates committed."
+
+check_release_tag
+check_beta_tag
--- a/auxil/zeek-aux/devel-tools/zeek_lldb_utils.py
+++ b/auxil/zeek-aux/devel-tools/zeek_lldb_utils.py
@ -0,0 +1,57 @@
+import lldb
+from ansi.color import fg
+from ansi.color.fx import reset
+from linereader import getline
+
+# Cache script lines and files so that we don't have to load files repeatedly
+script_lines = {}
+
+# TODO: make this check that the thread is actually stopped and return an error if not
+
+
+@lldb.command("btz")
+def backtrace_zeek(debugger, command, exe_ctx, result, d):
+    selected_thread = exe_ctx.GetProcess().GetSelectedThread()
+    thread = exe_ctx.GetThread()
+
+    # I'd prefer to retrieve this from LLDB somehow, but the earlier versions
+    # don't have SDDebugger.GetSetting(), and I'm not really sure we could use
+    # the output from that anyways.
+    thread_format = f"{'*' if selected_thread.idx == thread.idx else ' '} thread #{thread.idx}, name = '{thread.name}', queue = {fg.green}'{thread.queue}'{reset}, stop reason = {fg.red}{thread.GetStopDescription(100)}{reset}"
+    print(thread_format)
+
+    selected_frame = thread.GetSelectedFrame().idx
+
+    for frame in thread.get_thread_frames():
+        frame_output = f"  {'*' if frame.idx == selected_frame else ' '} "
+        frame_output += f"{frame}"
+
+        this = frame.FindVariable("this")
+        if this:
+            loc_ptr = this.GetChildMemberWithName("location")
+            if loc_ptr and loc_ptr.GetType().GetName() == "zeek::detail::Location *":
+                if loc_ptr.GetValueAsUnsigned() != 0:
+                    loc = frame.EvaluateExpression("*(this->location)")
+                    fname = (
+                        loc.GetChildMemberWithName("filename").GetSummary().strip('"')
+                    )
+                    line_no = loc.GetChildMemberWithName(
+                        "first_line"
+                    ).GetValueAsUnsigned()
+                    frame_output += f"\n        {fg.green}zeek script:{reset} {fname}"
+
+                    fileinfo = f"{fname}:{line_no}"
+                    if fileinfo in script_lines:
+                        line = script_lines[fileinfo]
+                    else:
+                        line = getline(fname, line_no)
+                        line = line.strip()
+                        script_lines[fileinfo] = line
+
+                    if line:
+                        line_hdr = f"line {line_no}"
+                        frame_output += (
+                            f"\n        {fg.green}{line_hdr: >11}:{reset} {line}"
+                        )
+
+        print(frame_output)
--- a/auxil/zeek-aux/plugin-support/README
+++ b/auxil/zeek-aux/plugin-support/README
@ -0,0 +1,4 @@
+The init-plugin script instantiates a plugin template to provide you with a good
+starting point for your next Zeek plugin. Use this only if you want to develop
+a "pure" Zeek plugin -- if you're looking to start a Zeek package for the zkg
+package manager, then use the "zkg create" command instead.
--- a/auxil/zeek-aux/plugin-support/init-plugin
+++ b/auxil/zeek-aux/plugin-support/init-plugin
@ -0,0 +1,96 @@
+#! /usr/bin/env bash
+
+function abspath {
+    (
+        cd "$1"
+        pwd
+    )
+}
+
+function relpath {
+    echo "$1" | sed "s#$(pwd)/\{0,1\}##g"
+}
+
+function lower {
+    echo "$1" | tr A-Z a-z
+}
+
+function upper {
+    echo "$1" | tr a-z A-Z
+}
+
+function init-skeleton {
+    for i in $(cd ${skeleton} && find * -type d); do
+        mkdir -p $(echo ${plugin_src}/$i)
+    done
+
+    for i in $(cd ${skeleton} && find * .??* -type f); do
+        src=${skeleton}/$i
+        dst=$(echo ${plugin_src}/$i)
+        dst=$(echo $dst | sed "s#%NS_LOWER#${plugin_ns_lower}#g")
+        dst=$(echo $dst | sed "s#%NAME_LOWER#${plugin_name_lower}#g")
+        dst=$(echo $dst | sed "s#%NS#${plugin_ns}#g")
+        dst=$(echo $dst | sed "s#%NAME#${plugin_name}#g")
+        dst=$(echo $dst | sed "s#@#/#g")
+
+        tmp=$dst.$$.tmp
+
+        mkdir -p $(dirname ${dst})
+        cp -p ${src} ${tmp} # Copy first to preserve permissions.
+        cat ${src} |
+            sed "s/@PLUGIN_NAME@/${plugin_name}/g" |
+            sed "s/@PLUGIN_NAMESPACE@/${plugin_ns}/g" |
+            sed "s/@PLUGIN_NAME_UPPER@/${plugin_name_upper}/g" |
+            sed "s/@PLUGIN_NAMESPACE_UPPER@/${plugin_ns_upper}/g" |
+            sed "s/@PLUGIN_NAME_LOWER@/${plugin_name_lower}/g" |
+            sed "s/@PLUGIN_NAMESPACE_LOWER@/${plugin_ns_lower}/g" \
+                >${tmp}
+
+        if [ -e ${dst} ]; then
+            cmp -s ${tmp} ${dst} || echo "$(relpath ${dst}) exists, not installing new version"
+            rm -f ${tmp}
+            continue
+        fi
+
+        echo Installing $(relpath ${dst}) ...
+        mv ${tmp} ${dst}
+
+    done
+}
+
+update=0
+
+if [ "$1" == "-u" ]; then
+    update=1
+    shift
+fi
+
+if [ $# != 3 ]; then
+    echo "Usage: $(basename $0) [-u] <dst-dir> <namespace> <plugin name>"
+    exit 1
+fi
+
+dstdir=$1
+
+if [ -e "${dstdir}" -a ${update} != 1 ]; then
+    echo "error: ${dstdir} already exists, use -u if you want to update skeleton files in there."
+    exit 1
+fi
+
+mkdir -p ${dstdir}
+dstdir=$(abspath ${dstdir})
+
+basedir=$(dirname $0)
+skeleton=$(abspath ${basedir})/skeleton
+plugin_ns=$2
+plugin_name=$3
+plugin_ns_lower=$(lower $2)
+plugin_name_lower=$(lower $3)
+plugin_ns_upper=$(upper $2)
+plugin_name_upper=$(upper $3)
+plugin_src=${dstdir}
+plugin_build=${dstdir}/dylib
+
+init-skeleton
+
+which git >/dev/null 2>&1 && (cd ${dstdir} && git init . && git add .)
--- a/auxil/zeek-aux/plugin-support/skeleton/.gitignore
+++ b/auxil/zeek-aux/plugin-support/skeleton/.gitignore
@ -0,0 +1,3 @@
+build
+*.log
+.state
--- a/auxil/zeek-aux/plugin-support/skeleton/CHANGES
+++ b/auxil/zeek-aux/plugin-support/skeleton/CHANGES
--- a/auxil/zeek-aux/plugin-support/skeleton/CMakeLists.txt
+++ b/auxil/zeek-aux/plugin-support/skeleton/CMakeLists.txt
@ -0,0 +1,21 @@
+cmake_minimum_required(VERSION 3.15 FATAL_ERROR)
+
+project(ZeekPlugin@PLUGIN_NAME@)
+
+include(ZeekPlugin)
+
+zeek_plugin_begin(@PLUGIN_NAMESPACE@ @PLUGIN_NAME@ ${ZEEK_PLUGIN_BEGIN_OPTS})
+zeek_plugin_cc(src/Plugin.cc)
+zeek_plugin_bif(src/@PLUGIN_NAME_LOWER@.bif)
+zeek_plugin_dist_files(README CHANGES COPYING VERSION)
+zeek_plugin_scripts(scripts/__load__.zeek scripts/__preload__.zeek scripts/types.zeek
+                    scripts/@PLUGIN_NAMESPACE@/@PLUGIN_NAME@/__load__.zeek)
+zeek_plugin_end()
+
+file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/VERSION" VERSION LIMIT_COUNT 1)
+
+if ("${PROJECT_SOURCE_DIR}" STREQUAL "${CMAKE_SOURCE_DIR}")
+    # Allows building rpm/deb packages via "make package" in build dir.
+    include(ConfigurePackaging)
+    ConfigurePackaging(${VERSION})
+endif ()
--- a/auxil/zeek-aux/plugin-support/skeleton/COPYING.edit-me
+++ b/auxil/zeek-aux/plugin-support/skeleton/COPYING.edit-me
@ -0,0 +1,35 @@
+###
+### This is a BSD-style license. If you're happy with it, just edit
+### the XXX parts below and remove this comment.  Otherwise, put in
+### your own license instead.
+###
+
+Copyright (c) 2018 by <XXX YOU or YOUR ORGANIZATION XXX>
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+(1) Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+
+(2) Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in
+    the documentation and/or other materials provided with the
+    distribution.
+
+(3) Neither the name of <XXX YOU and/or YOUR ORGANIZATION XXX>, nor
+    the names of contributors may be used to endorse or promote
+    products derived from this software without specific prior written
+    permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
--- a/auxil/zeek-aux/plugin-support/skeleton/Makefile
+++ b/auxil/zeek-aux/plugin-support/skeleton/Makefile
@ -0,0 +1,29 @@
+#
+# Convenience Makefile providing a few common top-level targets.
+#
+
+cmake_build_dir=build
+arch=`uname -s | tr A-Z a-z`-`uname -m`
+
+all: build-it
+
+build-it:
+	@test -e $(cmake_build_dir)/config.status || ./configure
+	-@test -e $(cmake_build_dir)/CMakeCache.txt && \
+      test $(cmake_build_dir)/CMakeCache.txt -ot `cat $(cmake_build_dir)/CMakeCache.txt | grep ZEEK_DIST | cut -d '=' -f 2`/build/CMakeCache.txt && \
+      echo Updating stale CMake cache && \
+      touch $(cmake_build_dir)/CMakeCache.txt
+
+	( cd $(cmake_build_dir) && make )
+
+install:
+	( cd $(cmake_build_dir) && make install )
+
+clean:
+	( cd $(cmake_build_dir) && make clean )
+
+distclean:
+	rm -rf $(cmake_build_dir)
+
+test:
+	make -C tests
--- a/auxil/zeek-aux/plugin-support/skeleton/README
+++ b/auxil/zeek-aux/plugin-support/skeleton/README
@ -0,0 +1,5 @@
+
+@PLUGIN_NAMESPACE@::@PLUGIN_NAME@
+=================================
+
+<Insert plugin documentation here.>
--- a/auxil/zeek-aux/plugin-support/skeleton/VERSION
+++ b/auxil/zeek-aux/plugin-support/skeleton/VERSION
@ -0,0 +1 @@
+0.1.0
--- a/auxil/zeek-aux/plugin-support/skeleton/configure
+++ b/auxil/zeek-aux/plugin-support/skeleton/configure
@ -0,0 +1,190 @@
+#!/bin/sh
+#
+# Wrapper for viewing/setting options that the plugin's CMake
+# scripts will recognize.
+#
+# Don't edit this. Edit configure.plugin to add plugin-specific options.
+#
+
+set -e
+command="$0 $*"
+
+if [ -e $(dirname $0)/configure.plugin ]; then
+    # Include custom additions.
+    . $(dirname $0)/configure.plugin
+fi
+
+usage() {
+
+    cat 1>&2 <<EOF
+Usage: $0 [OPTIONS]
+
+  Plugin Options:
+    --cmake=PATH               Path to CMake binary
+    --zeek-dist=DIR            Path to Zeek source tree
+    --install-root=DIR         Path where to install plugin into
+    --with-binpac=DIR          Path to BinPAC installation root
+    --with-broker=DIR          Path to Broker installation root
+    --with-bifcl=PATH          Path to bifcl executable
+    --enable-debug             Compile in debugging mode
+    --disable-cpp-tests        Don't build C++ unit tests
+EOF
+
+    if type plugin_usage >/dev/null 2>&1; then
+        plugin_usage 1>&2
+    fi
+
+    echo
+
+    exit 1
+}
+
+# Function to append a CMake cache entry definition to the
+# CMakeCacheEntries variable
+#   $1 is the cache entry variable name
+#   $2 is the cache entry variable type
+#   $3 is the cache entry variable value
+append_cache_entry() {
+    CMakeCacheEntries="$CMakeCacheEntries -D $1:$2=$3"
+}
+
+# set defaults
+builddir=build
+zeekdist=""
+installroot="default"
+zeek_plugin_begin_opts=""
+CMakeCacheEntries=""
+
+while [ $# -ne 0 ]; do
+    case "$1" in
+        -*=*) optarg=$(echo "$1" | sed 's/[-_a-zA-Z0-9]*=//') ;;
+        *) optarg= ;;
+    esac
+
+    case "$1" in
+        --help | -h)
+            usage
+            ;;
+
+        --cmake=*)
+            CMakeCommand=$optarg
+            ;;
+
+        --zeek-dist=*)
+            zeekdist=$(cd $optarg && pwd)
+            ;;
+
+        --install-root=*)
+            installroot=$optarg
+            ;;
+
+        --with-binpac=*)
+            append_cache_entry BinPAC_ROOT_DIR PATH $optarg
+            binpac_root=$optarg
+            ;;
+
+        --with-broker=*)
+            append_cache_entry BROKER_ROOT_DIR PATH $optarg
+            broker_root=$optarg
+            ;;
+
+        --with-bifcl=*)
+            append_cache_entry BifCl_EXE PATH $optarg
+            ;;
+
+        --enable-debug)
+            append_cache_entry BRO_PLUGIN_ENABLE_DEBUG BOOL true
+            ;;
+
+        --disable-cpp-tests)
+            zeek_plugin_begin_opts="DISABLE_CPP_TESTS;$zeek_plugin_begin_opts"
+            ;;
+
+        *)
+            if type plugin_option >/dev/null 2>&1; then
+                plugin_option $1 && shift && continue
+            fi
+
+            echo "Invalid option '$1'.  Try $0 --help to see available options."
+            exit 1
+            ;;
+    esac
+    shift
+done
+
+if [ -z "$CMakeCommand" ]; then
+    # prefer cmake3 over "regular" cmake (cmake == cmake2 on RHEL)
+    if command -v cmake3 >/dev/null 2>&1; then
+        CMakeCommand="cmake3"
+    elif command -v cmake >/dev/null 2>&1; then
+        CMakeCommand="cmake"
+    else
+        echo "This plugin requires CMake, please install it first."
+        echo "Then you may use this script to configure the CMake build."
+        echo "Note: pass --cmake=PATH to use cmake in non-standard locations."
+        exit 1
+    fi
+fi
+
+if [ -z "$zeekdist" ]; then
+    if type zeek-config >/dev/null 2>&1; then
+        zeek_config="zeek-config"
+    else
+        echo "Either 'zeek-config' must be in PATH or '--zeek-dist=<path>' used"
+        exit 1
+    fi
+
+    append_cache_entry BRO_CONFIG_PREFIX PATH $(${zeek_config} --prefix)
+    append_cache_entry BRO_CONFIG_INCLUDE_DIR PATH $(${zeek_config} --include_dir)
+    append_cache_entry BRO_CONFIG_PLUGIN_DIR PATH $(${zeek_config} --plugin_dir)
+    append_cache_entry BRO_CONFIG_LIB_DIR PATH $(${zeek_config} --lib_dir)
+    append_cache_entry BRO_CONFIG_CMAKE_DIR PATH $(${zeek_config} --cmake_dir)
+    append_cache_entry CMAKE_MODULE_PATH PATH $(${zeek_config} --cmake_dir)
+
+    build_type=$(${zeek_config} --build_type)
+
+    if [ "$build_type" = "debug" ]; then
+        append_cache_entry BRO_PLUGIN_ENABLE_DEBUG BOOL true
+    fi
+
+    if [ -z "$binpac_root" ]; then
+        append_cache_entry BinPAC_ROOT_DIR PATH $(${zeek_config} --binpac_root)
+    fi
+
+    if [ -z "$broker_root" ]; then
+        append_cache_entry BROKER_ROOT_DIR PATH $(${zeek_config} --broker_root)
+    fi
+else
+    if [ ! -e "$zeekdist/zeek-path-dev.in" ]; then
+        echo "$zeekdist does not appear to be a valid Zeek source tree."
+        exit 1
+    fi
+
+    append_cache_entry ZEEK_DIST PATH $zeekdist
+    append_cache_entry CMAKE_MODULE_PATH PATH $zeekdist/cmake
+fi
+
+if [ "$installroot" != "default" ]; then
+    mkdir -p $installroot
+    append_cache_entry BRO_PLUGIN_INSTALL_ROOT PATH $installroot
+fi
+
+if [ -n "$zeek_plugin_begin_opts" ]; then
+    append_cache_entry ZEEK_PLUGIN_BEGIN_OPTS STRING "$zeek_plugin_begin_opts"
+fi
+
+if type plugin_addl >/dev/null 2>&1; then
+    plugin_addl
+fi
+
+echo "Build Directory        : $builddir"
+echo "Zeek Source Directory   : $zeekdist"
+
+mkdir -p $builddir
+cd $builddir
+
+"$CMakeCommand" $CMakeCacheEntries ..
+
+echo "# This is the command used to configure this build" >config.status
+echo $command >>config.status
+chmod u+x config.status
--- a/auxil/zeek-aux/plugin-support/skeleton/configure.plugin
+++ b/auxil/zeek-aux/plugin-support/skeleton/configure.plugin
@ -0,0 +1,31 @@
+#!/bin/sh
+#
+# Hooks to add custom options to the configure script.
+#
+
+plugin_usage()
+{
+    : # Do nothing
+#    cat <<EOF
+#    --with-foo=DIR          Path to foo
+# EOF
+}
+
+plugin_option()
+{
+    case "$1" in
+#        --with-foo=*)
+#            append_cache_entry FOO_DIR PATH $optarg
+#            return 0
+#            ;;
+
+        *)
+            return 1;
+            ;;
+    esac
+}
+
+plugin_addl()
+{
+    : # Do nothing
+}
--- a/auxil/zeek-aux/plugin-support/skeleton/scripts/%NS@%NAME@load.zeek
+++ b/auxil/zeek-aux/plugin-support/skeleton/scripts/%NS@%NAME@load.zeek
@ -0,0 +1,9 @@
+#
+# This is processed when a user explicitly loads the plugin's script module
+# through `@load <plugin-namespace>/<plugin-name>`. Include code here that
+# should execute at that point. This is the most common entry point to
+# your plugin's accompanying scripts.
+#
+
+# @load ./bar
+
--- a/auxil/zeek-aux/plugin-support/skeleton/scripts/load.zeek
+++ b/auxil/zeek-aux/plugin-support/skeleton/scripts/load.zeek
@ -0,0 +1,10 @@
+#
+# This is loaded automatically at Zeek startup once the plugin gets activated
+# and its BiF elements have become available. Include code here that should
+# always execute unconditionally at that time. 
+# 
+# Note that often you may want your plugin's accompanying scripts not here, but
+# in scripts/<plugin-namespace>/<plugin-name>/__load__.zeek. That's processed
+# only on explicit `@load <plugin-namespace>/<plugin-name>`.
+#
+
--- a/auxil/zeek-aux/plugin-support/skeleton/scripts/preload.zeek
+++ b/auxil/zeek-aux/plugin-support/skeleton/scripts/preload.zeek
@ -0,0 +1,11 @@
+#
+# This is loaded automatically at Zeek startup once the plugin gets activated,
+# but before any of the BiFs that the plugin defines become available.
+#
+# This is primarily for defining types that BiFs already depend on.  If you
+# need to do any other unconditional initialization, that should go into
+# __load__.zeek instead.
+#
+
+@load ./types
+
--- a/auxil/zeek-aux/plugin-support/skeleton/scripts/types.zeek
+++ b/auxil/zeek-aux/plugin-support/skeleton/scripts/types.zeek
@ -0,0 +1 @@
+
--- a/auxil/zeek-aux/plugin-support/skeleton/src/%NAME_LOWER.bif
+++ b/auxil/zeek-aux/plugin-support/skeleton/src/%NAME_LOWER.bif
@ -0,0 +1 @@
+
--- a/auxil/zeek-aux/plugin-support/skeleton/src/Plugin.cc
+++ b/auxil/zeek-aux/plugin-support/skeleton/src/Plugin.cc
@ -0,0 +1,17 @@
+
+#include "Plugin.h"
+
+namespace plugin { namespace @PLUGIN_NAMESPACE@_@PLUGIN_NAME@ { Plugin plugin; } }
+
+using namespace plugin::@PLUGIN_NAMESPACE@_@PLUGIN_NAME@;
+
+zeek::plugin::Configuration Plugin::Configure()
+	{
+	zeek::plugin::Configuration config;
+	config.name = "@PLUGIN_NAMESPACE@::@PLUGIN_NAME@";
+	config.description = "<Insert description>";
+	config.version.major = 0;
+	config.version.minor = 1;
+	config.version.patch = 0;
+	return config;
+	}
--- a/auxil/zeek-aux/plugin-support/skeleton/src/Plugin.h
+++ b/auxil/zeek-aux/plugin-support/skeleton/src/Plugin.h
@ -0,0 +1,19 @@
+
+#pragma once
+
+#include <zeek/plugin/Plugin.h>
+
+namespace plugin {
+namespace @PLUGIN_NAMESPACE@_@PLUGIN_NAME@ {
+
+class Plugin : public zeek::plugin::Plugin
+{
+protected:
+	// Overridden from zeek::plugin::Plugin.
+	zeek::plugin::Configuration Configure() override;
+};
+
+extern Plugin plugin;
+
+}
+}
--- a/auxil/zeek-aux/plugin-support/skeleton/tests/%NAME_LOWER@show-plugin.zeek
+++ b/auxil/zeek-aux/plugin-support/skeleton/tests/%NAME_LOWER@show-plugin.zeek
@ -0,0 +1,2 @@
+# @TEST-EXEC: zeek -NN @PLUGIN_NAMESPACE@::@PLUGIN_NAME@ |sed -e 's/version.*)/version)/g' >output
+# @TEST-EXEC: btest-diff output
--- a/auxil/zeek-aux/plugin-support/skeleton/tests/.gitignore
+++ b/auxil/zeek-aux/plugin-support/skeleton/tests/.gitignore
@ -0,0 +1,2 @@
+.btest.failed.dat
+.tmp
--- a/auxil/zeek-aux/plugin-support/skeleton/tests/Baseline@%NAME_LOWER.show-plugin@output
+++ b/auxil/zeek-aux/plugin-support/skeleton/tests/Baseline@%NAME_LOWER.show-plugin@output
@ -0,0 +1,2 @@
+@PLUGIN_NAMESPACE@::@PLUGIN_NAME@ - <Insert description> (dynamic, version)
+
--- a/auxil/zeek-aux/plugin-support/skeleton/tests/Makefile
+++ b/auxil/zeek-aux/plugin-support/skeleton/tests/Makefile
@ -0,0 +1,3 @@
+
+test:
+	@btest
--- a/auxil/zeek-aux/plugin-support/skeleton/tests/Scripts/diff-remove-timestamps
+++ b/auxil/zeek-aux/plugin-support/skeleton/tests/Scripts/diff-remove-timestamps
@ -0,0 +1,13 @@
+#! /usr/bin/env bash
+#
+# Replace anything which looks like timestamps with XXXs (including the #start/end markers in logs).
+
+# Get us "modern" regexps with sed.
+if [ $(uname) == "Linux" ]; then
+    sed="sed -r"
+else
+    sed="sed -E"
+fi
+
+$sed 's/(0\.000000)|([0-9]{9,10}\.[0-9]{2,8})/XXXXXXXXXX.XXXXXX/g' |
+    $sed 's/^ *#(open|close).(19|20)..-..-..-..-..-..$/#\1 XXXX-XX-XX-XX-XX-XX/g'
--- a/auxil/zeek-aux/plugin-support/skeleton/tests/Scripts/get-zeek-env
+++ b/auxil/zeek-aux/plugin-support/skeleton/tests/Scripts/get-zeek-env
@ -0,0 +1,36 @@
+#! /bin/sh
+#
+# BTest helper for getting values for Zeek-related environment variables.
+
+base=$(dirname $0)
+zeek_dist=$(cat ${base}/../../build/CMakeCache.txt | grep ZEEK_DIST | cut -d = -f 2)
+
+if [ -n "${zeek_dist}" ]; then
+    if [ "$1" = "zeekpath" ]; then
+        ${zeek_dist}/build/zeek-path-dev
+    elif [ "$1" = "zeek_plugin_path" ]; then
+        (cd ${base}/../.. && pwd)
+    elif [ "$1" = "path" ]; then
+        echo ${zeek_dist}/build/src:${zeek_dist}/aux/btest:${zeek_dist}/auxil/btest:${base}/:${zeek_dist}/aux/zeek-cut:${zeek_dist}/auxil/zeek-cut:$PATH
+    else
+        echo "usage: $(basename $0) <var>" >&2
+        exit 1
+    fi
+else
+    # Use Zeek installation for testing. In this case zeek-config must be in PATH.
+    if ! which zeek-config >/dev/null; then
+        echo "zeek-config not found" >&2
+        exit 1
+    fi
+
+    if [ "$1" = "zeekpath" ]; then
+        zeek-config --zeekpath
+    elif [ "$1" = "zeek_plugin_path" ]; then
+        (cd ${base}/../.. && pwd)
+    elif [ "$1" = "path" ]; then
+        echo ${PATH}
+    else
+        echo "usage: $(basename $0) <var>" >&2
+        exit 1
+    fi
+fi
--- a/auxil/zeek-aux/plugin-support/skeleton/tests/btest.cfg
+++ b/auxil/zeek-aux/plugin-support/skeleton/tests/btest.cfg
@ -0,0 +1,17 @@
+[btest]
+TestDirs    = @PLUGIN_NAME_LOWER@
+TmpDir      = %(testbase)s/.tmp
+BaselineDir = %(testbase)s/Baseline
+IgnoreDirs  = .svn CVS .tmp
+IgnoreFiles = *.tmp *.swp #* *.trace .DS_Store
+
+[environment]
+ZEEKPATH=`%(testbase)s/Scripts/get-zeek-env zeekpath`
+ZEEK_PLUGIN_PATH=`%(testbase)s/Scripts/get-zeek-env zeek_plugin_path`
+ZEEK_SEED_FILE=%(testbase)s/random.seed
+PATH=`%(testbase)s/Scripts/get-zeek-env path`
+TZ=UTC
+LC_ALL=C
+TRACES=%(testbase)s/Traces
+TMPDIR=%(testbase)s/.tmp
+TEST_DIFF_CANONIFIER=%(testbase)s/Scripts/diff-remove-timestamps
--- a/auxil/zeek-aux/plugin-support/skeleton/tests/random.seed
+++ b/auxil/zeek-aux/plugin-support/skeleton/tests/random.seed
@ -0,0 +1,21 @@
+2983378351
+1299727368
+0
+310447
+0
+1409073626
+3975311262
+34130240
+1450515018
+1466150520
+1342286698
+1193956778
+2188527278
+3361989254
+3912865238
+3596260151
+517973768
+1462428821
+0
+2278350848
+32767
--- a/auxil/zeek-aux/rst/CMakeLists.txt
+++ b/auxil/zeek-aux/rst/CMakeLists.txt
@ -0,0 +1,5 @@
+set(rst_SRCS rst.c)
+
+add_executable(rst ${rst_SRCS})
+
+AddAuxInstallTarget(rst)
--- a/auxil/zeek-aux/rst/rst.c
+++ b/auxil/zeek-aux/rst/rst.c
@ -0,0 +1,408 @@
+/* Derived from traceroute, which has the following copyright:
+ *
+ * Copyright (c) 1999, 2002
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ */
+#ifndef lint
+static const char copyright[] =
+    "@(#) Copyright (c) 1999, 2002\nThe Regents of the University of California.  All rights reserved.\n";
+#endif
+
+/* need this due to linux's funny idea of a tcphdr */
+#if defined(__linux__)
+#define _DEFAULT_SOURCE
+#define _BSD_SOURCE /* Deprecated, but still needed by older Linux. */
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in_systm.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <netinet/tcp.h>
+
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "config.h"
+
+/* Forwards */
+void gripe(const char *, const char *);
+void pgripe(const char *);
+uint16_t in_cksum(register uint16_t *, register int);
+int ones_complement_checksum(const void *, int, uint32_t);
+int tcp_checksum(const struct ip *, const struct tcphdr *, int);
+void send_pkt(int, struct in_addr, int, uint32_t, struct in_addr,
+    int, uint32_t, int, int, int, int, const char *);
+void terminate(int, const char *, int, uint32_t, const char *,
+    int, uint32_t, int, int, int, int, const char *);
+void usage(void);
+int main(int, char **);
+
+const char *prog_name;
+
+void gripe(const char *fmt, const char *arg)
+{
+	fprintf(stderr, "%s: ", prog_name);
+	fprintf(stderr, fmt, arg);
+	fprintf(stderr, "\n");
+}
+
+void pgripe(const char *msg)
+{
+	fprintf(stderr, "%s: %s (%s)\n", prog_name, msg, strerror(errno));
+	exit(1);
+}
+
+/*
+ * Checksum routine for Internet Protocol family headers (C Version)
+ */
+uint16_t
+in_cksum(register uint16_t *addr, register int len)
+{
+	register int nleft = len;
+	register uint16_t *w = addr;
+	register uint16_t answer;
+	register int sum = 0;
+
+	/*
+	 *  Our algorithm is simple, using a 32 bit accumulator (sum),
+	 *  we add sequential 16 bit words to it, and at the end, fold
+	 *  back all the carry bits from the top 16 bits into the lower
+	 *  16 bits.
+	 */
+	while (nleft > 1)  {
+		sum += *w++;
+		nleft -= 2;
+	}
+
+	/* mop up an odd byte, if necessary */
+	if (nleft == 1)
+		sum += *(u_char *)w;
+
+	/*
+	 * add back carry outs from top 16 bits to low 16 bits
+	 */
+	sum = (sum >> 16) + (sum & 0xffff);	/* add hi 16 to low 16 */
+	sum += (sum >> 16);			/* add carry */
+	answer = ~sum;				/* truncate to 16 bits */
+	return (answer);
+}
+
+// - adapted from tcpdump
+// Returns the ones-complement checksum of a chunk of b short-aligned bytes.
+int ones_complement_checksum(const void *p, int b, uint32_t sum)
+{
+	const uint16_t *sp = (uint16_t *) p;	// better be aligned!
+
+	b /= 2;	// convert to count of short's
+
+	/* No need for endian conversions. */
+	while ( --b >= 0 )
+		sum += *sp++;
+
+	while ( sum > 0xffff )
+		sum = (sum & 0xffff) + (sum >> 16);
+
+	return sum;
+}
+
+int tcp_checksum(const struct ip *ip, const struct tcphdr *tp, int len)
+{
+	int tcp_len = tp->th_off * 4 + len;
+	uint32_t sum = 0;
+
+	// There's a weird bug in some versions of GCC where building with -O2 or
+	// higher will cause the initialization here to get optimized away, and
+	// lead to the compiler warning that this variable is used uninitialized.
+	// Using 'volatile' here short-circuits that optimization and fixes the
+	// warning.
+	volatile uint32_t addl_pseudo = 0;
+
+	if ( len % 2 == 1 )
+		// Add in pad byte.
+		sum = htons(((const u_char*) tp)[tcp_len - 1] << 8);
+	else
+		sum = 0;
+
+	sum = ones_complement_checksum((void*) &ip->ip_src.s_addr, 4, sum);
+	sum = ones_complement_checksum((void*) &ip->ip_dst.s_addr, 4, sum);
+
+	addl_pseudo = (htons(IPPROTO_TCP) << 16) | htons((unsigned short) tcp_len);
+
+	sum = ones_complement_checksum((void*) &addl_pseudo, 4, sum);
+	sum = ones_complement_checksum((void*) tp, tcp_len, sum);
+
+	return sum;
+}
+
+void send_pkt(int s, struct in_addr from, int from_port, uint32_t from_seq,
+		struct in_addr to, int to_port, uint32_t to_seq,
+		int size, int redundancy, int delay, int flags,
+		const char *inject)
+{
+	int cc;
+	int pktlen = 40 + size;
+	const int max_injection_size = 4096;
+	char *pkt = malloc(pktlen + max_injection_size + 1024 /* slop */);
+	struct ip *ip = (struct ip *) pkt;
+	struct tcphdr *tcp = (struct tcphdr *) &pkt[20];
+
+	if ( ! pkt )
+		pgripe("couldn't malloc memory");
+
+	if ( inject && *inject ) {
+		size = strlen(inject);
+
+		if ( size > max_injection_size )
+			gripe("injection text too large%s", "");
+
+		pktlen = 40 + size;
+	}
+
+	memset(pkt, 0, pktlen);
+
+	ip->ip_v = IPVERSION;
+	ip->ip_len = pktlen;	/* on FreeBSD, don't use htons(); YMMV */
+	ip->ip_off = 0;
+	ip->ip_src = from;
+	ip->ip_dst = to;
+	ip->ip_hl = 5;
+	ip->ip_p = IPPROTO_TCP;
+	ip->ip_ttl = 255;
+	ip->ip_id = 0;
+
+	ip->ip_sum = in_cksum((uint16_t *) ip, sizeof(*ip));
+
+	if (ip->ip_sum == 0)
+		ip->ip_sum = 0xffff;
+
+	tcp->th_sport = htons(from_port);
+	tcp->th_dport = htons(to_port);
+	tcp->th_seq = htonl(from_seq);
+	tcp->th_ack = htonl(to_seq);
+	tcp->th_off = 5;
+	tcp->th_flags = flags;
+	tcp->th_win = 0;
+	tcp->th_urp = 0;
+	tcp->th_sum = 0;
+
+	if ( inject && *inject ) {
+		char *payload = &pkt[40];
+		strcpy(payload, inject);
+
+	} else if ( size > 0 )
+		{
+		const char *fill_string =
+			(inject && *inject) ? inject : "BRO-RST\n";
+		char *payload = &pkt[40];
+		int n = strlen(fill_string);
+		int i;
+		for ( i = size; i > n + 1; i -= n )
+			{
+			strcpy(payload, fill_string);
+			payload += n;
+			}
+
+		for ( ; i > 0; --i )
+			*(payload++) = '\n';
+		}
+
+	tcp->th_sum = ~tcp_checksum(ip, tcp, size);
+
+	while ( redundancy-- > 0 )
+		{
+		cc = send(s, (char *) ip, pktlen, 0);
+		if (cc < 0 || cc != pktlen)
+			pgripe("problem in sendto()");
+		usleep(delay * 1000);
+		}
+
+	free(pkt);
+}
+
+void terminate(int s, const char *from_addr, int from_port, uint32_t from_seq,
+		const char *to_addr, int to_port, uint32_t to_seq,
+		int num, int redundancy, int stride, int delay,
+		const char *inject)
+{
+	struct sockaddr_in where_from, where_to;
+	struct sockaddr_in *from = (struct sockaddr_in *) &where_from;
+	struct sockaddr_in *to = (struct sockaddr_in *) &where_to;
+
+	memset(from, 0, sizeof(*from));
+	memset(to, 0, sizeof(*to));
+#ifdef SIN_LEN
+	from->sin_len = to->sin_len = sizeof(*to);
+#endif /* SIN_LEN */
+	from->sin_family = to->sin_family = AF_INET;
+
+	if ( inet_aton(from_addr, (struct in_addr *) &from->sin_addr) == 0 )
+		gripe("bad from address %s", from_addr);
+	if ( inet_aton(to_addr, (struct in_addr *) &to->sin_addr) == 0 )
+		gripe("bad to address %s", to_addr);
+
+	if ( connect(s, (struct sockaddr *) &where_to, sizeof(where_to)) < 0 )
+		pgripe("can't connect");
+
+	while ( num-- > 0 )
+		{
+		send_pkt(s, from->sin_addr, from_port, from_seq,
+			to->sin_addr, to_port, to_seq, 0, redundancy, delay,
+			(*inject ? 0 : TH_RST) | TH_ACK, inject);
+
+		if ( num > 0 && stride > 1 )
+			send_pkt(s, from->sin_addr, from_port, from_seq,
+				to->sin_addr, to_port, to_seq, stride,
+				redundancy, delay, TH_ACK, inject);
+
+		from_seq += stride;
+		}
+}
+
+void usage()
+{
+#if defined(__linux__)
+	fprintf(stderr, "%s [-R] [-I text-to-inject] [-i interface] [-d delay-msec] [-n num] [-r redundancy] [-s stride] from_addr from_port from_seq to_addr to_port to_seq\n", prog_name);
+#else
+	fprintf(stderr, "%s [-R] [-I text-to-inject] [-d delay-msec] [-n num] [-r redundancy] [-s stride] from_addr from_port from_seq to_addr to_port to_seq\n", prog_name);
+#endif
+	exit(0);
+}
+
+int main(int argc, char **argv)
+{
+	extern char* optarg;
+	extern int optind, opterr;
+	const char *from_addr, *to_addr;
+	char inject[8192];
+	int from_port, to_port;
+	uint32_t from_seq, to_seq;
+	int delay = 0.0;
+	int redundancy = 1;
+	int num = 1;
+	int stride = 1;
+	int reverse = 0;
+	int s;
+	int on = 1;
+	int op;
+
+	prog_name = argv[0];
+
+	opterr = 0;
+
+	inject[0] = 0;
+
+#if defined(__linux__)
+	char *interface = NULL;
+
+	while ( (op = getopt(argc, argv, "RI:i:d:n:r:s:")) != EOF )
+#else
+	while ( (op = getopt(argc, argv, "RI:d:n:r:s:")) != EOF )
+#endif
+		switch ( op ) {
+		case 'R':
+			reverse = 1;
+			break;
+
+		case 'I':
+			{
+			char *ap = optarg;
+			char *ip;
+			for ( ip = inject; *ap; ++ip, ++ap ) {
+				if ( ap[0] == '\\' && ap[1] == 'n' )
+					*ip = '\n', ++ap;
+				else
+					*ip = *ap;
+			}
+			}
+			break;
+
+#if defined(__linux__)
+		case 'i':
+			interface = optarg;
+			break;
+#endif
+
+		case 'd':
+			delay = atoi(optarg);
+			break;
+
+		case 'n':
+			num = atoi(optarg);
+			break;
+
+		case 'r':
+			redundancy = atoi(optarg);
+			break;
+
+		case 's':
+			stride = atoi(optarg);
+			break;
+
+		default:
+			usage();
+			break;
+		}
+
+	if ( argc - optind != 6 )
+		usage();
+
+	s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
+	if ( s < 0 )
+		pgripe("couldn't create raw socket");
+
+	if ( setuid(getuid()) )
+		pgripe("couldn't lower privileges");
+
+	if ( setsockopt(s, 0, IP_HDRINCL, (char *) &on, sizeof(on)) < 0 )
+		pgripe("can't turn on IP_HDRINCL");
+
+#if defined(__linux__)
+	if ( interface ){
+		if ( setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, interface, strlen(interface)) < 0 )
+			pgripe("can't set interface");
+	}
+#endif
+
+	from_addr = argv[optind++];
+	from_port = atoi(argv[optind++]);
+	from_seq = strtoul(argv[optind++], 0, 10);
+
+	to_addr = argv[optind++];
+	to_port = atoi(argv[optind++]);
+	to_seq = strtoul(argv[optind++], 0, 10);
+
+	if ( reverse )
+		terminate(s, to_addr, to_port, to_seq,
+			from_addr, from_port, from_seq,
+			num, redundancy, stride, delay, inject);
+	else
+		terminate(s, from_addr, from_port, from_seq,
+			to_addr, to_port, to_seq,
+			num, redundancy, stride, delay, inject);
+
+	return 0;
+}
--- a/auxil/zeek-aux/testing/.gitignore
+++ b/auxil/zeek-aux/testing/.gitignore
@ -0,0 +1,3 @@
+.btest.failed.dat
+diag.log
+.tmp
--- a/auxil/zeek-aux/testing/Baseline/update-changes.replace-version-in-c-header/header.h
+++ b/auxil/zeek-aux/testing/Baseline/update-changes.replace-version-in-c-header/header.h
@ -0,0 +1,5 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#define   ZEEK_VERSION "1.0.0-2" /* with comment */
+#define   ZEEK_VERSION "1.0.0-2" /* with comment */
+  #define FOO_VERSION  "1.0.0-2" // another comment
+...
--- a/auxil/zeek-aux/testing/Baseline/update-changes.replace-version-in-python-package/init.py
+++ b/auxil/zeek-aux/testing/Baseline/update-changes.replace-version-in-python-package/init.py
@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+__version__ = "1.0.0.dev2",  # with comment
+__version__ = "1.0.0.dev2",  # another comment
+__version__ = "1.0.0.dev2",  # Python style
+__version__ = "0.0.1.nope"  # should not change
+version = "0.0.1"            # should not change
+print('Additional change')
--- a/auxil/zeek-aux/testing/Baseline/update-changes.replace-version-in-rst/test.rst
+++ b/auxil/zeek-aux/testing/Baseline/update-changes.replace-version-in-rst/test.rst
@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+.. |version| replace:: 1.0.0-2
+.. |version| replace:: 1.0.0-2
+.. |version| replace:: 1.0.0-2
+.. |version| replace:: 1.0.0-2
+.. |version| replace:: 1.0.0-2
+...
--- a/auxil/zeek-aux/testing/Baseline/update-changes.replace-version-in-script/test.pl
+++ b/auxil/zeek-aux/testing/Baseline/update-changes.replace-version-in-script/test.pl
@ -0,0 +1,8 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+VERSION="1.0.0-2"
+VERSION="1.0.0-2"
+VERSION="1.0.0-2"
+VERSION="1.0.0-2"
+  VERSION = "1.0.0-2"  # with some comment
+  VERSION = "2.0.0-nope"  # with some comment
+...
--- a/auxil/zeek-aux/testing/Baseline/update-changes.replace-version-in-setup-py/setup.py
+++ b/auxil/zeek-aux/testing/Baseline/update-changes.replace-version-in-setup-py/setup.py
@ -0,0 +1,8 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+version = "1.0.0.dev2",  # short
+version = "1.0.0.dev2",  # with dev update
+version = "1.0.0.dev2",  # long
+version = "1.0.0.dev2",  # long with dev update
+version = "1.0.0.dev2",  # Python style
+version = "0.0.1.nope"   # should not change, invalid suffix
+print('Additional change')
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/missing-fields-header
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/missing-fields-header
@ -0,0 +1,2 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+zeek-cut: bad log header (missing #fields line)
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/missing-sep-header
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/missing-sep-header
@ -0,0 +1,6 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+CjhGID4nQcgTWjvg4c	tcp
+CCvvfg3TEfuqmmG4bh	tcp
+CsRx2w45OKnoww6xl4	tcp
+CRJuHdVW0XPVINV8a	tcp
+CXWv6p3arKYeMETxOg	tcp
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/missing-separator
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/missing-separator
@ -0,0 +1,2 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+zeek-cut: bad log header (invalid #separator line)
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/no-header-column
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/no-header-column
@ -0,0 +1,6 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+
+
+
+
+
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/no-header-not-column
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/no-header-not-column
@ -0,0 +1,6 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+
+
+
+
+
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/no-header-show
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/no-header-show
@ -0,0 +1,6 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+
+
+
+
+
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/null-separator
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.bad-logs/null-separator
@ -0,0 +1,2 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+zeek-cut: bad log header (invalid #separator line)
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/all
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/all
@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+1329327783.316897	CjhGID4nQcgTWjvg4c	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49186	2001:470:4867:99::21
+1329327786.524332	CCvvfg3TEfuqmmG4bh	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49187	2001:470:4867:99::21
+1329327787.289095	CsRx2w45OKnoww6xl4	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49188	2001:470:4867:99::21
+1329327795.571921	CRJuHdVW0XPVINV8a	2001:470:4867:99::21	55785	2001:470:1f11:81f:c999:d94:aa7c:2e3e
+1329327777.822004	CXWv6p3arKYeMETxOg	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49185	2001:470:4867:99::21
+1329327800.017649	CPbrpk1qSsw6ESzHV4	2001:470:4867:99::21	55647	2001:470:1f11:81f:c999:d94:aa7c:2e3e
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/different-col-order
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/different-col-order
@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+1329843175.736107	CjhGID4nQcgTWjvg4c
+1329843179.871641	CCvvfg3TEfuqmmG4bh
+1329843194.151526	CsRx2w45OKnoww6xl4
+1329843197.783443	CRJuHdVW0XPVINV8a
+1329843161.968492	CXWv6p3arKYeMETxOg
+1329843175.736107	CjhGID4nQcgTWjvg4c
+1329843179.871641	CCvvfg3TEfuqmmG4bh
+1329843194.151526	CsRx2w45OKnoww6xl4
+1329843197.783443	CRJuHdVW0XPVINV8a
+1329843161.968492	CXWv6p3arKYeMETxOg
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/nondefault-separator
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/nondefault-separator
@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+tcp	CjhGID4nQcgTWjvg4c
+tcp	CCvvfg3TEfuqmmG4bh
+tcp	CsRx2w45OKnoww6xl4
+tcp	CRJuHdVW0XPVINV8a
+tcp	CXWv6p3arKYeMETxOg
+tcp,CNbXUV0IZ29or3MK6
+tcp,CJ8woc3c6CfBLdiyp5
+tcp,CXlgj54ftP8Yc2GSnb
+tcp,Czw8Gd1zEVn3Xz5x7i
+tcp,Cys4aQ15qDqHzsIk3l
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/one
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/one
@ -0,0 +1,6 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+CjhGID4nQcgTWjvg4c
+CCvvfg3TEfuqmmG4bh
+CsRx2w45OKnoww6xl4
+CRJuHdVW0XPVINV8a
+CXWv6p3arKYeMETxOg
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/one-nonexistent-1
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/one-nonexistent-1
@ -0,0 +1,12 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+CjhGID4nQcgTWjvg4c	tcp
+CCvvfg3TEfuqmmG4bh	tcp
+CsRx2w45OKnoww6xl4	tcp
+CRJuHdVW0XPVINV8a	tcp
+CXWv6p3arKYeMETxOg	tcp
+CjhGID4nQcgTWjvg4c	
+CCvvfg3TEfuqmmG4bh	
+CsRx2w45OKnoww6xl4	
+CRJuHdVW0XPVINV8a	
+CXWv6p3arKYeMETxOg	
+CPbrpk1qSsw6ESzHV4	
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/one-nonexistent-2
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/one-nonexistent-2
@ -0,0 +1,12 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+CjhGID4nQcgTWjvg4c	
+CCvvfg3TEfuqmmG4bh	
+CsRx2w45OKnoww6xl4	
+CRJuHdVW0XPVINV8a	
+CXWv6p3arKYeMETxOg	
+CPbrpk1qSsw6ESzHV4	
+CjhGID4nQcgTWjvg4c	tcp
+CCvvfg3TEfuqmmG4bh	tcp
+CsRx2w45OKnoww6xl4	tcp
+CRJuHdVW0XPVINV8a	tcp
+CXWv6p3arKYeMETxOg	tcp
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/only
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/only
@ -0,0 +1,2 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+79.26.245.236
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/swap-order
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.columns/swap-order
@ -0,0 +1,6 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+tcp	CjhGID4nQcgTWjvg4c
+tcp	CCvvfg3TEfuqmmG4bh
+tcp	CsRx2w45OKnoww6xl4
+tcp	CRJuHdVW0XPVINV8a
+tcp	CXWv6p3arKYeMETxOg
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.help/show-help
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.help/show-help
@ -0,0 +1,25 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+
+zeek-cut [options] [<columns>]
+
+Extracts the given columns from ASCII Zeek logs on standard input, and outputs
+them to standard output. If no columns are given, all are selected.
+By default, zeek-cut does not include format header blocks in the output.
+
+Example: cat conn.log | zeek-cut -d ts id.orig_h id.orig_p
+
+    -c       Include the first format header block in the output.
+    -C       Include all format header blocks in the output.
+    -m       Include the first format header blocks in the output in minimal view.
+    -M       Include all format header blocks in the output in minimal view.
+    -d       Convert time values into human-readable format.
+    -D <fmt> Like -d, but specify format for time (see strftime(3) for syntax).
+    -F <ofs> Sets a different output field separator character.
+    -h       Show help.
+    -n       Print all fields *except* those specified.
+    -u       Like -d, but print timestamps in UTC instead of local time.
+    -U <fmt> Like -D, but print timestamps in UTC instead of local time.
+
+For time conversion option -d or -u, the format string can be specified by
+setting an environment variable ZEEK_CUT_TIMEFMT.
+
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/both-c-m-opts-m
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/both-c-m-opts-m
@ -0,0 +1,13 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+uid	ts
+CjhGID4nQcgTWjvg4c	1329843175.736107
+CCvvfg3TEfuqmmG4bh	1329843179.871641
+CsRx2w45OKnoww6xl4	1329843194.151526
+CRJuHdVW0XPVINV8a	1329843197.783443
+CXWv6p3arKYeMETxOg	1329843161.968492
+CjhGID4nQcgTWjvg4c	1329327783.316897
+CCvvfg3TEfuqmmG4bh	1329327786.524332
+CsRx2w45OKnoww6xl4	1329327787.289095
+CRJuHdVW0XPVINV8a	1329327795.571921
+CXWv6p3arKYeMETxOg	1329327777.822004
+CPbrpk1qSsw6ESzHV4	1329327800.017649
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/both-m-c-opts-c
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/both-m-c-opts-c
@ -0,0 +1,20 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	conn
+#open	2014-04-01-23-15-49
+#fields	uid	ts
+#types	string	time
+CjhGID4nQcgTWjvg4c	1329843175.736107
+CCvvfg3TEfuqmmG4bh	1329843179.871641
+CsRx2w45OKnoww6xl4	1329843194.151526
+CRJuHdVW0XPVINV8a	1329843197.783443
+CXWv6p3arKYeMETxOg	1329843161.968492
+CjhGID4nQcgTWjvg4c	1329327783.316897
+CCvvfg3TEfuqmmG4bh	1329327786.524332
+CsRx2w45OKnoww6xl4	1329327787.289095
+CRJuHdVW0XPVINV8a	1329327795.571921
+CXWv6p3arKYeMETxOg	1329327777.822004
+CPbrpk1qSsw6ESzHV4	1329327800.017649
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/both-m-opts-all
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/both-m-opts-all
@ -0,0 +1,14 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+uid	ts
+CjhGID4nQcgTWjvg4c	1329843175.736107
+CCvvfg3TEfuqmmG4bh	1329843179.871641
+CsRx2w45OKnoww6xl4	1329843194.151526
+CRJuHdVW0XPVINV8a	1329843197.783443
+CXWv6p3arKYeMETxOg	1329843161.968492
+uid	ts
+CjhGID4nQcgTWjvg4c	1329327783.316897
+CCvvfg3TEfuqmmG4bh	1329327786.524332
+CsRx2w45OKnoww6xl4	1329327787.289095
+CRJuHdVW0XPVINV8a	1329327795.571921
+CXWv6p3arKYeMETxOg	1329327777.822004
+CPbrpk1qSsw6ESzHV4	1329327800.017649
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/both-m-opts-one
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/both-m-opts-one
@ -0,0 +1,13 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+uid	ts
+CjhGID4nQcgTWjvg4c	1329843175.736107
+CCvvfg3TEfuqmmG4bh	1329843179.871641
+CsRx2w45OKnoww6xl4	1329843194.151526
+CRJuHdVW0XPVINV8a	1329843197.783443
+CXWv6p3arKYeMETxOg	1329843161.968492
+CjhGID4nQcgTWjvg4c	1329327783.316897
+CCvvfg3TEfuqmmG4bh	1329327786.524332
+CsRx2w45OKnoww6xl4	1329327787.289095
+CRJuHdVW0XPVINV8a	1329327795.571921
+CXWv6p3arKYeMETxOg	1329327777.822004
+CPbrpk1qSsw6ESzHV4	1329327800.017649
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/different-col-order
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/different-col-order
@ -0,0 +1,13 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	service	duration	orig_bytes	resp_bytes	conn_state	local_orig	missed_bytes	history	orig_pkts	orig_ip_bytes	resp_pkts	resp_ip_bytes	tunnel_parents
+1329843175.736107	CjhGID4nQcgTWjvg4c	141.142.220.235	37604	199.233.217.249	56666	tcp	ftp-data	0.112432	0	342	SF	-	0	ShAdfFa	4	216	4	562	(empty)
+1329843179.871641	CCvvfg3TEfuqmmG4bh	141.142.220.235	59378	199.233.217.249	56667	tcp	ftp-data	0.111218	0	77	SF	-	0	ShAdfFa	4	216	4	297	(empty)
+1329843194.151526	CsRx2w45OKnoww6xl4	199.233.217.249	61920	141.142.220.235	33582	tcp	ftp-data	0.056211	342	0	SF	-	0	ShADaFf	5	614	3	164	(empty)
+1329843197.783443	CRJuHdVW0XPVINV8a	199.233.217.249	61918	141.142.220.235	37835	tcp	ftp-data	0.056005	77	0	SF	-	0	ShADaFf	5	349	3	164	(empty)
+1329843161.968492	CXWv6p3arKYeMETxOg	141.142.220.235	50003	199.233.217.249	21	tcp	ftp	38.055625	180	3146	SF	-	0	ShAdDfFa	38	2164	25	4458	(empty)
+uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	service	duration	orig_bytes	resp_bytes	conn_state	local_orig	missed_bytes	history	orig_pkts	orig_ip_bytes	resp_pkts	resp_ip_bytes	tunnel_parents	ts
+CjhGID4nQcgTWjvg4c	141.142.220.235	37604	199.233.217.249	56666	tcp	ftp-data	0.112432	0	342	SF	-	0	ShAdfFa	4	216	4	562	(empty)	1329843175.736107
+CCvvfg3TEfuqmmG4bh	141.142.220.235	59378	199.233.217.249	56667	tcp	ftp-data	0.111218	0	77	SF	-	0	ShAdfFa	4	216	4	297	(empty)	1329843179.871641
+CsRx2w45OKnoww6xl4	199.233.217.249	61920	141.142.220.235	33582	tcp	ftp-data	0.056211	342	0	SF	-	0	ShADaFf	5	614	3	164	(empty)	1329843194.151526
+CRJuHdVW0XPVINV8a	199.233.217.249	61918	141.142.220.235	37835	tcp	ftp-data	0.056005	77	0	SF	-	0	ShADaFf	5	349	3	164	(empty)	1329843197.783443
+CXWv6p3arKYeMETxOg	141.142.220.235	50003	199.233.217.249	21	tcp	ftp	38.055625	180	3146	SF	-	0	ShAdDfFa	38	2164	25	4458	(empty)	1329843161.968492
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/different-col-order-some
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/different-col-order-some
@ -0,0 +1,13 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+ts	uid
+1329843175.736107	CjhGID4nQcgTWjvg4c
+1329843179.871641	CCvvfg3TEfuqmmG4bh
+1329843194.151526	CsRx2w45OKnoww6xl4
+1329843197.783443	CRJuHdVW0XPVINV8a
+1329843161.968492	CXWv6p3arKYeMETxOg
+ts	uid
+1329843175.736107	CjhGID4nQcgTWjvg4c
+1329843179.871641	CCvvfg3TEfuqmmG4bh
+1329843194.151526	CsRx2w45OKnoww6xl4
+1329843197.783443	CRJuHdVW0XPVINV8a
+1329843161.968492	CXWv6p3arKYeMETxOg
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/nondefault-separator
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/nondefault-separator
@ -0,0 +1,13 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+proto	uid
+tcp	CjhGID4nQcgTWjvg4c
+tcp	CCvvfg3TEfuqmmG4bh
+tcp	CsRx2w45OKnoww6xl4
+tcp	CRJuHdVW0XPVINV8a
+tcp	CXWv6p3arKYeMETxOg
+proto,uid
+tcp,CNbXUV0IZ29or3MK6
+tcp,CJ8woc3c6CfBLdiyp5
+tcp,CXlgj54ftP8Yc2GSnb
+tcp,Czw8Gd1zEVn3Xz5x7i
+tcp,Cys4aQ15qDqHzsIk3l
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/one-all-nocols
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/one-all-nocols
@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	service	duration	orig_bytes	resp_bytes	conn_state	local_orig	missed_bytes	history	orig_pkts	orig_ip_bytes	resp_pkts	resp_ip_bytes	tunnel_parents
+1329843175.736107	CjhGID4nQcgTWjvg4c	141.142.220.235	37604	199.233.217.249	56666	tcp	ftp-data	0.112432	0	342	SF	-	0	ShAdfFa	4	216	4	562	(empty)
+1329843179.871641	CCvvfg3TEfuqmmG4bh	141.142.220.235	59378	199.233.217.249	56667	tcp	ftp-data	0.111218	0	77	SF	-	0	ShAdfFa	4	216	4	297	(empty)
+1329843194.151526	CsRx2w45OKnoww6xl4	199.233.217.249	61920	141.142.220.235	33582	tcp	ftp-data	0.056211	342	0	SF	-	0	ShADaFf	5	614	3	164	(empty)
+1329843197.783443	CRJuHdVW0XPVINV8a	199.233.217.249	61918	141.142.220.235	37835	tcp	ftp-data	0.056005	77	0	SF	-	0	ShADaFf	5	349	3	164	(empty)
+1329843161.968492	CXWv6p3arKYeMETxOg	141.142.220.235	50003	199.233.217.249	21	tcp	ftp	38.055625	180	3146	SF	-	0	ShAdDfFa	38	2164	25	4458	(empty)
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/two-1st-withcols
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/two-1st-withcols
@ -0,0 +1,13 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+uid	ts
+CjhGID4nQcgTWjvg4c	1329843175.736107
+CCvvfg3TEfuqmmG4bh	1329843179.871641
+CsRx2w45OKnoww6xl4	1329843194.151526
+CRJuHdVW0XPVINV8a	1329843197.783443
+CXWv6p3arKYeMETxOg	1329843161.968492
+CjhGID4nQcgTWjvg4c	1329327783.316897
+CCvvfg3TEfuqmmG4bh	1329327786.524332
+CsRx2w45OKnoww6xl4	1329327787.289095
+CRJuHdVW0XPVINV8a	1329327795.571921
+CXWv6p3arKYeMETxOg	1329327777.822004
+CPbrpk1qSsw6ESzHV4	1329327800.017649
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/two-1st-withcols-custom-sep
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/two-1st-withcols-custom-sep
@ -0,0 +1,13 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+uid,ts
+CjhGID4nQcgTWjvg4c,1329843175.736107
+CCvvfg3TEfuqmmG4bh,1329843179.871641
+CsRx2w45OKnoww6xl4,1329843194.151526
+CRJuHdVW0XPVINV8a,1329843197.783443
+CXWv6p3arKYeMETxOg,1329843161.968492
+CjhGID4nQcgTWjvg4c,1329327783.316897
+CCvvfg3TEfuqmmG4bh,1329327786.524332
+CsRx2w45OKnoww6xl4,1329327787.289095
+CRJuHdVW0XPVINV8a,1329327795.571921
+CXWv6p3arKYeMETxOg,1329327777.822004
+CPbrpk1qSsw6ESzHV4,1329327800.017649
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/two-all-withcols
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/two-all-withcols
@ -0,0 +1,14 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+uid	ts
+CjhGID4nQcgTWjvg4c	1329843175.736107
+CCvvfg3TEfuqmmG4bh	1329843179.871641
+CsRx2w45OKnoww6xl4	1329843194.151526
+CRJuHdVW0XPVINV8a	1329843197.783443
+CXWv6p3arKYeMETxOg	1329843161.968492
+uid	ts
+CjhGID4nQcgTWjvg4c	1329327783.316897
+CCvvfg3TEfuqmmG4bh	1329327786.524332
+CsRx2w45OKnoww6xl4	1329327787.289095
+CRJuHdVW0XPVINV8a	1329327795.571921
+CXWv6p3arKYeMETxOg	1329327777.822004
+CPbrpk1qSsw6ESzHV4	1329327800.017649
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/two-all-withcols-custom-sep
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.minimal-view/two-all-withcols-custom-sep
@ -0,0 +1,14 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+uid,ts
+CjhGID4nQcgTWjvg4c,1329843175.736107
+CCvvfg3TEfuqmmG4bh,1329843179.871641
+CsRx2w45OKnoww6xl4,1329843194.151526
+CRJuHdVW0XPVINV8a,1329843197.783443
+CXWv6p3arKYeMETxOg,1329843161.968492
+uid,ts
+CjhGID4nQcgTWjvg4c,1329327783.316897
+CCvvfg3TEfuqmmG4bh,1329327786.524332
+CsRx2w45OKnoww6xl4,1329327787.289095
+CRJuHdVW0XPVINV8a,1329327795.571921
+CXWv6p3arKYeMETxOg,1329327777.822004
+CPbrpk1qSsw6ESzHV4,1329327800.017649
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.no-options/no-opts
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.no-options/no-opts
@ -0,0 +1,6 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+1329843175.736107	CjhGID4nQcgTWjvg4c	141.142.220.235	37604	199.233.217.249	56666	tcp	ftp-data	0.112432	0	342	SF	-	0	ShAdfFa	4	216	4	562	(empty)
+1329843179.871641	CCvvfg3TEfuqmmG4bh	141.142.220.235	59378	199.233.217.249	56667	tcp	ftp-data	0.111218	0	77	SF	-	0	ShAdfFa	4	216	4	297	(empty)
+1329843194.151526	CsRx2w45OKnoww6xl4	199.233.217.249	61920	141.142.220.235	33582	tcp	ftp-data	0.056211	342	0	SF	-	0	ShADaFf	5	614	3	164	(empty)
+1329843197.783443	CRJuHdVW0XPVINV8a	199.233.217.249	61918	141.142.220.235	37835	tcp	ftp-data	0.056005	77	0	SF	-	0	ShADaFf	5	349	3	164	(empty)
+1329843161.968492	CXWv6p3arKYeMETxOg	141.142.220.235	50003	199.233.217.249	21	tcp	ftp	38.055625	180	3146	SF	-	0	ShAdDfFa	38	2164	25	4458	(empty)
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.no-options/tsv
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.no-options/tsv
@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+
+
+
+
+
+
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/different-col-order
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/different-col-order
@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+141.142.220.235	37604	199.233.217.249	56666	tcp	ftp-data	0.112432	0	342	SF	-	0	ShAdfFa	4	216	4	562	(empty)
+141.142.220.235	59378	199.233.217.249	56667	tcp	ftp-data	0.111218	0	77	SF	-	0	ShAdfFa	4	216	4	297	(empty)
+199.233.217.249	61920	141.142.220.235	33582	tcp	ftp-data	0.056211	342	0	SF	-	0	ShADaFf	5	614	3	164	(empty)
+199.233.217.249	61918	141.142.220.235	37835	tcp	ftp-data	0.056005	77	0	SF	-	0	ShADaFf	5	349	3	164	(empty)
+141.142.220.235	50003	199.233.217.249	21	tcp	ftp	38.055625	180	3146	SF	-	0	ShAdDfFa	38	2164	25	4458	(empty)
+141.142.220.235	37604	199.233.217.249	56666	tcp	ftp-data	0.112432	0	342	SF	-	0	ShAdfFa	4	216	4	562	(empty)
+141.142.220.235	59378	199.233.217.249	56667	tcp	ftp-data	0.111218	0	77	SF	-	0	ShAdfFa	4	216	4	297	(empty)
+199.233.217.249	61920	141.142.220.235	33582	tcp	ftp-data	0.056211	342	0	SF	-	0	ShADaFf	5	614	3	164	(empty)
+199.233.217.249	61918	141.142.220.235	37835	tcp	ftp-data	0.056005	77	0	SF	-	0	ShADaFf	5	349	3	164	(empty)
+141.142.220.235	50003	199.233.217.249	21	tcp	ftp	38.055625	180	3146	SF	-	0	ShAdDfFa	38	2164	25	4458	(empty)
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-all
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-all
@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+
+
+
+
+
+
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-none
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-none
@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+1329327783.316897	CjhGID4nQcgTWjvg4c	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49186	2001:470:4867:99::21
+1329327786.524332	CCvvfg3TEfuqmmG4bh	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49187	2001:470:4867:99::21
+1329327787.289095	CsRx2w45OKnoww6xl4	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49188	2001:470:4867:99::21
+1329327795.571921	CRJuHdVW0XPVINV8a	2001:470:4867:99::21	55785	2001:470:1f11:81f:c999:d94:aa7c:2e3e
+1329327777.822004	CXWv6p3arKYeMETxOg	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49185	2001:470:4867:99::21
+1329327800.017649	CPbrpk1qSsw6ESzHV4	2001:470:4867:99::21	55647	2001:470:1f11:81f:c999:d94:aa7c:2e3e
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-one
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-one
@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+1329327783.316897	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49186	2001:470:4867:99::21
+1329327786.524332	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49187	2001:470:4867:99::21
+1329327787.289095	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49188	2001:470:4867:99::21
+1329327795.571921	2001:470:4867:99::21	55785	2001:470:1f11:81f:c999:d94:aa7c:2e3e
+1329327777.822004	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49185	2001:470:4867:99::21
+1329327800.017649	2001:470:4867:99::21	55647	2001:470:1f11:81f:c999:d94:aa7c:2e3e
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-one-nonexistent
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-one-nonexistent
@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+1329327783.316897	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49186	2001:470:4867:99::21
+1329327786.524332	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49187	2001:470:4867:99::21
+1329327787.289095	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49188	2001:470:4867:99::21
+1329327795.571921	2001:470:4867:99::21	55785	2001:470:1f11:81f:c999:d94:aa7c:2e3e
+1329327777.822004	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49185	2001:470:4867:99::21
+1329327800.017649	2001:470:4867:99::21	55647	2001:470:1f11:81f:c999:d94:aa7c:2e3e
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-one-show-header
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-one-show-header
@ -0,0 +1,15 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	test
+#open	2014-04-01-23-15-51
+#fields	ts	id.orig_h	id.orig_p	id.resp_h
+#types	time	addr	port	addr
+1329327783.316897	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49186	2001:470:4867:99::21
+1329327786.524332	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49187	2001:470:4867:99::21
+1329327787.289095	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49188	2001:470:4867:99::21
+1329327795.571921	2001:470:4867:99::21	55785	2001:470:1f11:81f:c999:d94:aa7c:2e3e
+1329327777.822004	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49185	2001:470:4867:99::21
+1329327800.017649	2001:470:4867:99::21	55647	2001:470:1f11:81f:c999:d94:aa7c:2e3e
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-one-twice
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-one-twice
@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+1329327783.316897	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49186	2001:470:4867:99::21
+1329327786.524332	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49187	2001:470:4867:99::21
+1329327787.289095	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49188	2001:470:4867:99::21
+1329327795.571921	2001:470:4867:99::21	55785	2001:470:1f11:81f:c999:d94:aa7c:2e3e
+1329327777.822004	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49185	2001:470:4867:99::21
+1329327800.017649	2001:470:4867:99::21	55647	2001:470:1f11:81f:c999:d94:aa7c:2e3e
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-only
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-only
@ -0,0 +1,2 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-two-swapped
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.not-columns/not-two-swapped
@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+1329327783.316897	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49186
+1329327786.524332	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49187
+1329327787.289095	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49188
+1329327795.571921	2001:470:4867:99::21	55785
+1329327777.822004	2001:470:1f11:81f:c999:d94:aa7c:2e3e	49185
+1329327800.017649	2001:470:4867:99::21	55647
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.ofs/nondefault-separator
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.ofs/nondefault-separator
@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+tcp:CjhGID4nQcgTWjvg4c
+tcp:CCvvfg3TEfuqmmG4bh
+tcp:CsRx2w45OKnoww6xl4
+tcp:CRJuHdVW0XPVINV8a
+tcp:CXWv6p3arKYeMETxOg
+tcp:CNbXUV0IZ29or3MK6
+tcp:CJ8woc3c6CfBLdiyp5
+tcp:CXlgj54ftP8Yc2GSnb
+tcp:Czw8Gd1zEVn3Xz5x7i
+tcp:Cys4aQ15qDqHzsIk3l
--- a/auxil/zeek-aux/testing/Baseline/zeek-cut.ofs/only-column
+++ b/auxil/zeek-aux/testing/Baseline/zeek-cut.ofs/only-column
@ -0,0 +1,2 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+79.26.245.236
--- a/Show more
+++ b/Show more
				`@ -0,0 +1,2 @@`
				`@PLUGIN_NAMESPACE@::@PLUGIN_NAME@ - <Insert description> (dynamic, version)`
				`@ -0,0 +1,6 @@`
				`### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.`
				`@ -0,0 +1,7 @@`
				`### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.`