Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-1221: Add unknown_protocols.log for logging packet analyzer lookup failures

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-10-23 14:45:24 -07:00 • committed by Tim Wojtulewicz
parent efe42bc67b
commit c3cf36e135
19 changed files with 222 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

9
testing/btest/Baseline/plugins.packet-protocol/output_raw
View file

@ -1,12 +1,13 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
raw_layer_message (Message = 'I am encapsulating IP', Protocol = 4950)
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path conn
#open 2020-10-14-18-47-51
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
1599068759.647566 ClEkJM2Vm5giqnMf4h 172.22.214.60 8 192.0.78.150 0 icmp - - - - OTH - - 0 - 1 28 0 0 -
1599068759.619112 CHhAvVGS1DHFjwGM9 172.22.214.60 8 192.0.78.212 0 icmp - - - - OTH - - 0 - 1 28 0 0 -
#close 2020-10-14-18-47-51
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 172.22.214.60 8 192.0.78.150 0 icmp - - - - OTH - - 0 - 1 28 0 0 -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.22.214.60 8 192.0.78.212 0 icmp - - - - OTH - - 0 - 1 28 0 0 -
#close XXXX-XX-XX-XX-XX-XX