Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-1221: Add unknown_protocols.log for logging packet analyzer lookup failures

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-10-23 14:45:24 -07:00 • committed by Tim Wojtulewicz
parent efe42bc67b
commit c3cf36e135
19 changed files with 222 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

9
testing/btest/plugins/packet-protocol.zeek
View file

@ -1,6 +1,6 @@
# @TEST-EXEC: zeek -r $TRACES/raw_layer.pcap
# @TEST-EXEC: zeek -r $TRACES/raw_layer.pcap -e "@load policy/misc/unknown-protocols"
# @TEST-EXEC: cat conn.log > output_orig
# @TEST-EXEC: cat weird.log >> output_orig
# @TEST-EXEC: cat unknown_protocols.log > output_orig
# @TEST-EXEC: btest-diff output_orig
# @TEST-EXEC: rm -f *.log
#
@ -12,13 +12,15 @@
#
# @TEST-EXEC: ZEEK_PLUGIN_PATH=`pwd` zeek -r $TRACES/raw_layer.pcap %INPUT > output_raw
# @TEST-EXEC: cat conn.log >> output_raw
# @TEST-EXEC: test ! -e weird.log
# @TEST-EXEC: test ! -e unknown_protocols.log
# @TEST-EXEC: btest-diff output_raw
# @TEST-EXEC: rm -f *.log
#
# @TEST-EXEC: ZEEK_PLUGIN_PATH=`pwd` zeek -r $TRACES/raw_packets.trace %INPUT > output_llc
# @TEST-EXEC: btest-diff output_llc
@load policy/misc/unknown-protocols
event raw_layer_message(msg: string, protocol: count)
{
print fmt("raw_layer_message (Message = '%s', Protocol = %x)", msg, protocol);
@ -29,4 +31,3 @@ event llc_demo_message(dsap: count, ssap: count, control: count)
print fmt("llc_demo_message (DSAP = %x, SSAP = %x, Control = %x)",
dsap, ssap, control);
}