Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Updates the files event api and brings file reassembly up to master.

Browse source
This commit is contained in:
Seth Hall 2014-09-26 00:40:37 -04:00
parent 42b2d56279
commit cafd35e746
47 changed files with 515 additions and 637 deletions
Download patch file Download diff file Expand all files Collapse all files

8
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/a.out
View file

@ -1,15 +1,15 @@
FILE_NEW
file #0, 0, 0
FILE_BOF_BUFFER
%PDF-1.4^J%\xd0
MIME_TYPE
application/pdf
FILE_OVER_NEW_CONNECTION
FILE_OVER_NEW_CONNECTION
FILE_STATE_REMOVE
file #0, 555523, 0
[orig_h=10.101.84.70, orig_p=10978/tcp, resp_h=129.174.93.161, resp_p=80/tcp]
[orig_h=10.101.84.70, orig_p=10977/tcp, resp_h=129.174.93.161, resp_p=80/tcp]
FILE_BOF_BUFFER
%PDF-1.4^J%\xd0
MIME_TYPE
application/pdf
total bytes: 555523
source: HTTP
MD5: 5a484ada9c816c0e8b6d2d3978e3f503

14
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/b.out
View file

@ -1,22 +1,24 @@
FILE_NEW
file #0, 0, 0
FILE_BOF_BUFFER
MZ\x90\0^C\0\0\0^D\0\0
MIME_TYPE
application/x-dosexec
FILE_OVER_NEW_CONNECTION
FILE_STATE_REMOVE
file #0, 1022920, 0
[orig_h=192.168.72.14, orig_p=3254/tcp, resp_h=65.54.95.206, resp_p=80/tcp]
FILE_BOF_BUFFER
MZ\x90\0^C\0\0\0^D\0\0
MIME_TYPE
application/x-dosexec
total bytes: 1022920
source: HTTP
MD5: fc13fee1d44ef737a3133f1298b21d28
SHA1: 7d99803eaf3b6e8dfa3581348bc694089579d25a
SHA256: dcb87a62a2b5d449abc138776000fd1b14edc690e9da6ea325b8f352ab033202
FILE_TIMEOUT
FILE_NEW
file #1, 0, 0
FILE_OVER_NEW_CONNECTION
FILE_TIMEOUT
FILE_STATE_REMOVE
file #0, 0, 0
file #1, 0, 0
[orig_h=192.168.72.14, orig_p=3257/tcp, resp_h=65.54.95.14, resp_p=80/tcp]
total bytes: 1022920
source: HTTP

8
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/c.out
View file

@ -1,15 +1,15 @@
FILE_NEW
file #0, 0, 0
FILE_BOF_BUFFER
%PDF-1.4^M%\xe2
MIME_TYPE
application/pdf
FILE_OVER_NEW_CONNECTION
FILE_OVER_NEW_CONNECTION
FILE_STATE_REMOVE
file #0, 498668, 0
[orig_h=10.45.179.94, orig_p=19950/tcp, resp_h=129.174.93.170, resp_p=80/tcp]
[orig_h=10.45.179.94, orig_p=19953/tcp, resp_h=129.174.93.170, resp_p=80/tcp]
FILE_BOF_BUFFER
%PDF-1.4^M%\xe2
MIME_TYPE
application/pdf
total bytes: 498668
source: HTTP
MD5: 94046a5fb1c5802d0f1e6d704cf3e10e