diff --git a/CHANGES b/CHANGES index 52bc4656a2..e928add3da 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,12 @@ +2.5-646 | 2018-06-05 11:31:43 -0500 + + * Add NCP::max_frame_size tuning option (Corelight) + + * Migrate NCP analyzer to use latest analyzer API (Corelight) + + * Fix read at invalid address in X509 extension parser (Johanna Amann) + 2.5-642 | 2018-06-04 13:52:46 -0500 * Make 0 be a valid packet source timestamp (Corelight) diff --git a/VERSION b/VERSION index 6de87095f8..a0572ad9b1 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.5-642 +2.5-646 diff --git a/scripts/base/init-bare.bro b/scripts/base/init-bare.bro index 1d64c7c0a3..4ef5d343a1 100644 --- a/scripts/base/init-bare.bro +++ b/scripts/base/init-bare.bro @@ -4810,6 +4810,12 @@ export { const max_frag_data = 30000 &redef; } +module NCP; +export { + ## The maximum number of bytes to allocate when parsing NCP frames. + const max_frame_size = 65536 &redef; +} + module Cluster; export { type Cluster::Pool: record {}; diff --git a/src/analyzer/protocol/ncp/CMakeLists.txt b/src/analyzer/protocol/ncp/CMakeLists.txt index bd06d4e426..1ec5cf2e67 100644 --- a/src/analyzer/protocol/ncp/CMakeLists.txt +++ b/src/analyzer/protocol/ncp/CMakeLists.txt @@ -5,6 +5,6 @@ include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DI bro_plugin_begin(Bro NCP) bro_plugin_cc(NCP.cc Plugin.cc) -bro_plugin_bif(events.bif) +bro_plugin_bif(events.bif consts.bif) bro_plugin_pac(ncp.pac) bro_plugin_end() diff --git a/src/analyzer/protocol/ncp/NCP.cc b/src/analyzer/protocol/ncp/NCP.cc index add7841908..f01c409429 100644 --- a/src/analyzer/protocol/ncp/NCP.cc +++ b/src/analyzer/protocol/ncp/NCP.cc @@ -9,6 +9,7 @@ #include "NCP.h" #include "events.bif.h" +#include "consts.bif.h" using namespace std; using namespace analyzer::ncp; @@ -105,13 +106,12 @@ void FrameBuffer::Reset() msg_len = 0; } -// Returns true if we have a complete frame -bool FrameBuffer::Deliver(int &len, const u_char* &data) +int FrameBuffer::Deliver(int &len, const u_char* &data) { ASSERT(buf_len >= hdr_len); if ( len == 0 ) - return false; + return -1; if ( buf_n < hdr_len ) { @@ -123,13 +123,16 @@ bool FrameBuffer::Deliver(int &len, const u_char* &data) } if ( buf_n < hdr_len ) - return false; + return -1; compute_msg_length(); if ( msg_len > buf_len ) { - buf_len = msg_len * 2; + if ( msg_len > BifConst::NCP::max_frame_size ) + return 1; + + buf_len = msg_len; u_char* new_buf = new u_char[buf_len]; memcpy(new_buf, msg_buf, buf_n); delete [] msg_buf; @@ -143,7 +146,13 @@ bool FrameBuffer::Deliver(int &len, const u_char* &data) ++buf_n; ++data; --len; } - return buf_n >= msg_len; + if ( buf_n < msg_len ) + return -1; + + if ( buf_n == msg_len ) + return 0; + + return 1; } void NCP_FrameBuffer::compute_msg_length() @@ -159,11 +168,7 @@ Contents_NCP_Analyzer::Contents_NCP_Analyzer(Connection* conn, bool orig, NCP_Se { session = arg_session; resync = true; - - tcp::TCP_Analyzer* tcp = static_cast(Parent())->TCP(); - if ( tcp ) - resync = (orig ? tcp->OrigState() : tcp->RespState()) != - tcp::TCP_ENDPOINT_ESTABLISHED; + resync_set = false; } Contents_NCP_Analyzer::~Contents_NCP_Analyzer() @@ -174,20 +179,23 @@ void Contents_NCP_Analyzer::DeliverStream(int len, const u_char* data, bool orig { tcp::TCP_SupportAnalyzer::DeliverStream(len, data, orig); - tcp::TCP_Analyzer* tcp = static_cast(Parent())->TCP(); + auto tcp = static_cast(Parent())->TCP(); + + if ( ! resync_set ) + { + resync_set = true; + resync = (IsOrig() ? tcp->OrigState() : tcp->RespState()) != + tcp::TCP_ENDPOINT_ESTABLISHED; + } if ( tcp && tcp->HadGap(orig) ) return; - DEBUG_MSG("NCP deliver: len = %d resync = %d buffer.empty = %d\n", - len, resync, buffer.empty()); - if ( buffer.empty() && resync ) { // Assume NCP frames align with packet boundary. if ( (IsOrig() && len < 22) || (! IsOrig() && len < 16) ) { // ignore small fragmeents - DEBUG_MSG("NCP discard small pieces: %d\n", len); return; } @@ -204,10 +212,27 @@ void Contents_NCP_Analyzer::DeliverStream(int len, const u_char* data, bool orig resync = false; } - while ( buffer.Deliver(len, data) ) + for ( ; ; ) { - session->Deliver(IsOrig(), buffer.Len(), buffer.Data()); - buffer.Reset(); + auto result = buffer.Deliver(len, data); + + if ( result < 0 ) + break; + + if ( result == 0 ) + { + session->Deliver(IsOrig(), buffer.Len(), buffer.Data()); + buffer.Reset(); + } + else + { + // The rest of the data available in this delivery will + // be discarded and will need to resync to a new frame header. + Weird("ncp_large_frame"); + buffer.Reset(); + resync = true; + break; + } } } @@ -224,13 +249,13 @@ NCP_Analyzer::NCP_Analyzer(Connection* conn) { session = new NCP_Session(this); o_ncp = new Contents_NCP_Analyzer(conn, true, session); + AddSupportAnalyzer(o_ncp); r_ncp = new Contents_NCP_Analyzer(conn, false, session); + AddSupportAnalyzer(r_ncp); } NCP_Analyzer::~NCP_Analyzer() { delete session; - delete o_ncp; - delete r_ncp; } diff --git a/src/analyzer/protocol/ncp/NCP.h b/src/analyzer/protocol/ncp/NCP.h index 713eca756d..bdf5d8bffe 100644 --- a/src/analyzer/protocol/ncp/NCP.h +++ b/src/analyzer/protocol/ncp/NCP.h @@ -54,8 +54,9 @@ public: explicit FrameBuffer(int header_length); virtual ~FrameBuffer(); - // Returns true if a frame is ready - bool Deliver(int& len, const u_char* &data); + // Returns -1 if frame is not ready, 0 if it else, and 1 if + // the frame would require too large of a buffer allocation. + int Deliver(int& len, const u_char* &data); void Reset(); @@ -68,9 +69,9 @@ protected: int hdr_len; u_char* msg_buf; - int msg_len; - int buf_n; // number of bytes in msg_buf - int buf_len; // size off msg_buf + uint64 msg_len; + size_t buf_n; // number of bytes in msg_buf + size_t buf_len; // size off msg_buf }; #define NCP_TCPIP_HEADER_LENGTH 8 @@ -97,6 +98,7 @@ protected: // Re-sync for partial connections (or after a content gap). bool resync; + bool resync_set; }; class NCP_Analyzer : public tcp::TCP_ApplicationAnalyzer { diff --git a/src/analyzer/protocol/ncp/consts.bif b/src/analyzer/protocol/ncp/consts.bif new file mode 100644 index 0000000000..452dd9a2b6 --- /dev/null +++ b/src/analyzer/protocol/ncp/consts.bif @@ -0,0 +1 @@ +const NCP::max_frame_size: count; diff --git a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log index 768eb520ea..46e287824a 100644 --- a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log +++ b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log @@ -3,7 +3,7 @@ #empty_field (empty) #unset_field - #path loaded_scripts -#open 2018-03-01-16-07-03 +#open 2018-06-05-16-19-04 #fields name #types string scripts/base/init-bare.bro @@ -93,6 +93,7 @@ scripts/base/init-bare.bro build/scripts/base/bif/plugins/Bro_Modbus.events.bif.bro build/scripts/base/bif/plugins/Bro_MySQL.events.bif.bro build/scripts/base/bif/plugins/Bro_NCP.events.bif.bro + build/scripts/base/bif/plugins/Bro_NCP.consts.bif.bro build/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro build/scripts/base/bif/plugins/Bro_NetBIOS.functions.bif.bro build/scripts/base/bif/plugins/Bro_NTLM.types.bif.bro @@ -175,4 +176,4 @@ scripts/base/init-bare.bro build/scripts/base/bif/plugins/Bro_SQLiteWriter.sqlite.bif.bro scripts/policy/misc/loaded-scripts.bro scripts/base/utils/paths.bro -#close 2018-03-01-16-07-03 +#close 2018-06-05-16-19-04 diff --git a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log index 5ca6cdd812..d37d9e6203 100644 --- a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log +++ b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log @@ -3,7 +3,7 @@ #empty_field (empty) #unset_field - #path loaded_scripts -#open 2018-05-17-23-49-59 +#open 2018-06-05-16-19-07 #fields name #types string scripts/base/init-bare.bro @@ -93,6 +93,7 @@ scripts/base/init-bare.bro build/scripts/base/bif/plugins/Bro_Modbus.events.bif.bro build/scripts/base/bif/plugins/Bro_MySQL.events.bif.bro build/scripts/base/bif/plugins/Bro_NCP.events.bif.bro + build/scripts/base/bif/plugins/Bro_NCP.consts.bif.bro build/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro build/scripts/base/bif/plugins/Bro_NetBIOS.functions.bif.bro build/scripts/base/bif/plugins/Bro_NTLM.types.bif.bro @@ -364,4 +365,4 @@ scripts/base/init-default.bro scripts/base/misc/find-filtered-trace.bro scripts/base/misc/version.bro scripts/policy/misc/loaded-scripts.bro -#close 2018-05-17-23-49-59 +#close 2018-06-05-16-19-07 diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output index 37a613347c..b01c46a6c7 100644 --- a/testing/btest/Baseline/plugins.hooks/output +++ b/testing/btest/Baseline/plugins.hooks/output @@ -264,7 +264,7 @@ 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])) -> -0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T])) -> +0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T])) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Broker::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Cluster::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Config::LOG)) -> @@ -441,7 +441,7 @@ 0.000000 MetaHookPost CallFunction(Log::create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])) -> -0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T])) -> +0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T])) -> 0.000000 MetaHookPost CallFunction(NetControl::check_plugins, , ()) -> 0.000000 MetaHookPost CallFunction(NetControl::init, , ()) -> 0.000000 MetaHookPost CallFunction(Notice::want_pp, , ()) -> @@ -522,6 +522,7 @@ 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_MIME.events.bif.bro) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_Modbus.events.bif.bro) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_MySQL.events.bif.bro) -> -1 +0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NCP.consts.bif.bro) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NCP.events.bif.bro) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NTLM.events.bif.bro) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NTLM.types.bif.bro) -> -1 @@ -1062,7 +1063,7 @@ 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])) -0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T])) +0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T])) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Broker::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Cluster::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Config::LOG)) @@ -1239,7 +1240,7 @@ 0.000000 MetaHookPre CallFunction(Log::create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])) -0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T])) +0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T])) 0.000000 MetaHookPre CallFunction(NetControl::check_plugins, , ()) 0.000000 MetaHookPre CallFunction(NetControl::init, , ()) 0.000000 MetaHookPre CallFunction(Notice::want_pp, , ()) @@ -1320,6 +1321,7 @@ 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_MIME.events.bif.bro) 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_Modbus.events.bif.bro) 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_MySQL.events.bif.bro) +0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NCP.consts.bif.bro) 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NCP.events.bif.bro) 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NTLM.events.bif.bro) 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NTLM.types.bif.bro) @@ -1859,7 +1861,7 @@ 0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=, ev=Weird::log_weird, path=weird]) 0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=, ev=X509::log_x509, path=x509]) 0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql]) -0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T]) +0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T]) 0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Config::LOG) @@ -2036,7 +2038,7 @@ 0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=, ev=Weird::log_weird, path=weird]) 0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=, ev=X509::log_x509, path=x509]) 0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql]) -0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T]) +0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T]) 0.000000 | HookCallFunction NetControl::check_plugins() 0.000000 | HookCallFunction NetControl::init() 0.000000 | HookCallFunction Notice::want_pp() @@ -2117,6 +2119,7 @@ 0.000000 | HookLoadFile .<...>/Bro_MIME.events.bif.bro 0.000000 | HookLoadFile .<...>/Bro_Modbus.events.bif.bro 0.000000 | HookLoadFile .<...>/Bro_MySQL.events.bif.bro +0.000000 | HookLoadFile .<...>/Bro_NCP.consts.bif.bro 0.000000 | HookLoadFile .<...>/Bro_NCP.events.bif.bro 0.000000 | HookLoadFile .<...>/Bro_NTLM.events.bif.bro 0.000000 | HookLoadFile .<...>/Bro_NTLM.types.bif.bro @@ -2387,7 +2390,7 @@ 0.000000 | HookLoadFile base<...>/x509 0.000000 | HookLoadFile base<...>/xmpp 0.000000 | HookLogInit packet_filter 1/1 {ts (time), node (string), filter (string), init (bool), success (bool)} -0.000000 | HookLogWrite packet_filter [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T] +0.000000 | HookLogWrite packet_filter [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T] 0.000000 | HookQueueEvent NetControl::init() 0.000000 | HookQueueEvent bro_init() 0.000000 | HookQueueEvent filter_change_tracking() diff --git a/testing/btest/Baseline/scripts.base.protocols.ncp.event/out b/testing/btest/Baseline/scripts.base.protocols.ncp.event/out new file mode 100644 index 0000000000..6374c60f5d --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ncp.event/out @@ -0,0 +1,468 @@ +ncp reply, 13107, 70, 0, 0, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 59, 89 +ncp reply, 13107, 2, 8738, 89, 255 +ncp request, 8738, 59, 89 +ncp reply, 13107, 2, 8738, 89, 255 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 66, 89 +ncp reply, 13107, 92, 8738, 89, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 66, 89 +ncp reply, 13107, 92, 8738, 89, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 46, 89 +ncp reply, 13107, 88, 8738, 89, 0 +ncp request, 8738, 40, 89 +ncp reply, 13107, 11, 8738, 89, 0 +ncp request, 8738, 40, 89 +ncp reply, 13107, 102, 8738, 89, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 6, 22338 +ncp reply, 13107, 10, 8738, 22338, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 163, 8738, 72, 0 +ncp request, 8738, 14, 72 diff --git a/testing/btest/Baseline/scripts.base.protocols.ncp.frame_size_tuning/out b/testing/btest/Baseline/scripts.base.protocols.ncp.frame_size_tuning/out new file mode 100644 index 0000000000..cfb805ee70 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ncp.frame_size_tuning/out @@ -0,0 +1,418 @@ +ncp reply, 13107, 70, 0, 0, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 59, 89 +ncp reply, 13107, 2, 8738, 89, 255 +ncp request, 8738, 59, 89 +ncp reply, 13107, 2, 8738, 89, 255 +ncp request, 8738, 79, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp reply, 13107, 86, 8738, 72, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 66, 89 +ncp reply, 13107, 92, 8738, 89, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 66, 89 +ncp reply, 13107, 92, 8738, 89, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 46, 89 +ncp reply, 13107, 88, 8738, 89, 0 +ncp request, 8738, 40, 89 +ncp reply, 13107, 11, 8738, 89, 0 +ncp request, 8738, 40, 89 +ncp reply, 13107, 102, 8738, 89, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 6, 22338 +ncp reply, 13107, 10, 8738, 22338, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 8, 66 +ncp reply, 13107, 2, 8738, 66, 0 +ncp request, 8738, 72, 89 +ncp reply, 13107, 70, 8738, 89, 0 +ncp request, 8738, 7, 22306 +ncp reply, 13107, 2, 8738, 22306, 0 +ncp request, 8738, 14, 72 +ncp request, 8738, 14, 72 diff --git a/testing/btest/Traces/ncp.pcap b/testing/btest/Traces/ncp.pcap new file mode 100644 index 0000000000..d8c61b3683 Binary files /dev/null and b/testing/btest/Traces/ncp.pcap differ diff --git a/testing/btest/scripts/base/protocols/ncp/event.bro b/testing/btest/scripts/base/protocols/ncp/event.bro new file mode 100644 index 0000000000..acb4bf0a0c --- /dev/null +++ b/testing/btest/scripts/base/protocols/ncp/event.bro @@ -0,0 +1,20 @@ +# @TEST-EXEC: bro -C -r $TRACES/ncp.pcap %INPUT >out +# @TEST-EXEC: btest-diff out + +redef likely_server_ports += { 524/tcp }; + +event bro_init() + { + const ports = { 524/tcp }; + Analyzer::register_for_ports(Analyzer::ANALYZER_NCP, ports); + } + +event ncp_request(c: connection, frame_type: count, length: count, func: count) + { + print "ncp request", frame_type, length, func; + } + +event ncp_reply(c: connection, frame_type: count, length: count, req_frame: count, req_func: count, completion_code: count) + { + print "ncp reply", frame_type, length, req_frame, req_func, completion_code; + } diff --git a/testing/btest/scripts/base/protocols/ncp/frame_size_tuning.bro b/testing/btest/scripts/base/protocols/ncp/frame_size_tuning.bro new file mode 100644 index 0000000000..46ad87e752 --- /dev/null +++ b/testing/btest/scripts/base/protocols/ncp/frame_size_tuning.bro @@ -0,0 +1,20 @@ +# @TEST-EXEC: bro -C -r $TRACES/ncp.pcap %INPUT NCP::max_frame_size=150 >out +# @TEST-EXEC: btest-diff out + +redef likely_server_ports += { 524/tcp }; + +event bro_init() + { + const ports = { 524/tcp }; + Analyzer::register_for_ports(Analyzer::ANALYZER_NCP, ports); + } + +event ncp_request(c: connection, frame_type: count, length: count, func: count) + { + print "ncp request", frame_type, length, func; + } + +event ncp_reply(c: connection, frame_type: count, length: count, req_frame: count, req_func: count, completion_code: count) + { + print "ncp reply", frame_type, length, req_frame, req_func, completion_code; + }