Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

MQTT Analyzer heavily updated and ported from the analyzer originally by Supriya Kumar

Browse source 
This analyzer generates three logs to fully display what is happening over the MQTT connection.
  - mqtt_connect.log
  - mqtt_subscribe.log
  - mqtt_publish.log

At this time it only supports MQTT 3.1 and 3.1.1
This commit is contained in:
Seth Hall 2018-10-25 09:45:35 -04:00
parent 486bf1e713
commit a42b3a1d63
34 changed files with 1302 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
testing/btest/Baseline/scripts.base.protocols.mqtt.mqtt/mqtt_connect.log Normal file
View file

@ -0,0 +1,11 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path mqtt_connect
#open 2019-07-29-16-44-12
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto_name proto_version client_id connect_status will_topic will_payload
#types time string addr port addr port string string string string string string
1461170590.509491 CHhAvVGS1DHFjwGM9 10.0.1.4 49327 198.41.30.241 1883 MQIsdp 3.1 paho/34AAE54A75D839566E Connection Accepted - -
1461170596.653525 ClEkJM2Vm5giqnMf4h 10.0.1.4 49330 198.41.30.241 1883 MQIsdp 3.1 paho/DDE4DDAF4108D3E363 Connection Accepted - -
#close 2019-07-29-16-44-12

12
testing/btest/Baseline/scripts.base.protocols.mqtt.mqtt/mqtt_publish.log Normal file
View file

@ -0,0 +1,12 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path mqtt_publish
#open 2019-07-29-16-44-12
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p from_client retain qos status topic payload
#types time string addr port addr port bool bool string string string string
1461170591.219981 CHhAvVGS1DHFjwGM9 10.0.1.4 49327 198.41.30.241 1883 F T at most once ok SampleTopic Hello from the Paho blocking client
1461170596.653674 ClEkJM2Vm5giqnMf4h 10.0.1.4 49330 198.41.30.241 1883 T F at most once ok SampleTopic Hello MQTT
1461170596.891281 CHhAvVGS1DHFjwGM9 10.0.1.4 49327 198.41.30.241 1883 F F at most once ok SampleTopic Hello MQTT
#close 2019-07-29-16-44-12

10
testing/btest/Baseline/scripts.base.protocols.mqtt.mqtt/mqtt_subscribe.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path mqtt_subscribe
#open 2019-07-29-16-44-12
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p action topic qos_level granted_qos_level ack
#types time string addr port addr port enum string count count bool
1461170590.745647 CHhAvVGS1DHFjwGM9 10.0.1.4 49327 198.41.30.241 1883 MQTT::SUBSCRIBE SampleTopic 0 0 T
#close 2019-07-29-16-44-12