Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Rework Sessions::Weird

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-10-14 12:37:46 -07:00
parent b1e517e863
commit a99b540e46
17 changed files with 130 additions and 128 deletions
Download patch file Download diff file Expand all files Collapse all files

10
testing/btest/Baseline/plugins.packet-protocol/output_orig
View file

@ -3,18 +3,18 @@
#empty_field (empty)
#unset_field -
#path conn
#open 2020-10-09-19-25-26
#open 2020-10-14-18-47-28
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
1599068759.619112 CHhAvVGS1DHFjwGM9 172.22.214.60 8 192.0.78.212 0 icmp - - - - OTH - - 0 - 1 28 0 0 -
#close 2020-10-09-19-25-26
#close 2020-10-14-18-47-28
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open 2020-10-09-19-25-26
#open 2020-10-14-18-47-28
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string
1599068759.647566 - - - - - truncated_IPv6 - F zeek
#close 2020-10-09-19-25-26
1599068759.647566 - 108.97.116.105 0 110.103.32.73 0 truncated_IPv6 - F zeek
#close 2020-10-14-18-47-28

4
testing/btest/Baseline/plugins.packet-protocol/output_raw
View file

@ -4,9 +4,9 @@ raw_layer_message (Message = 'I am encapsulating IP', Protocol = 4950)
#empty_field (empty)
#unset_field -
#path conn
#open 2020-09-03-17-54-45
#open 2020-10-14-18-47-51
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
1599068759.647566 ClEkJM2Vm5giqnMf4h 172.22.214.60 8 192.0.78.150 0 icmp - - - - OTH - - 0 - 1 28 0 0 -
1599068759.619112 CHhAvVGS1DHFjwGM9 172.22.214.60 8 192.0.78.212 0 icmp - - - - OTH - - 0 - 1 28 0 0 -
#close 2020-09-03-17-54-45
#close 2020-10-14-18-47-51