Merge branch 'fastpath' of ssh://git.bro-ids.org/bro into fastpath

2025-10-02 06:38:20 +00:00 · 2011-05-13 08:07:23 -07:00 · 2011-05-13 08:07:23 -07:00 · cbf3390762
commit cbf3390762
parent c24f3391a3 70e14cb7d5
99 changed files with 933 additions and 1284 deletions
--- a/aux/broccoli
+++ b/aux/broccoli
@ -1 +1 @@
-Subproject commit 7c20b1a41016471eb03ee7a0fbfe1fb34bdc084a
+Subproject commit 54f3ff4e6627d4a44d1e014e8e581e4e9dfed8c3
--- a/aux/btest
+++ b/aux/btest
@ -1 +1 @@
-Subproject commit d0154a7e88cd1b6bccc11c042e451fcb9b5459bf
+Subproject commit f096c0e4088f2d92743e0c28077f086dff216cce
--- a/policy/conn.bro
+++ b/policy/conn.bro
@ -18,6 +18,10 @@ global have_SMTP = F;	# if true, we've loaded smtp.bro
 # TODO: Do we have a nicer way of defining this prototype?
 export { global FTP::is_ftp_data_conn: function(c: connection): bool; }

+# Whether to include connection state history in the logs generated
+# by record_connection.
+const record_state_history = F &redef;
+
 # Whether to add 4 more columns to conn.log with 
 # orig_packet orig_ip_bytes resp_packets resp_ip_bytes
 # Requires use_conn_size_analyzer=T
@ -311,6 +315,10 @@ function record_connection(f: file, c: connection)
 			conn_size(c$orig, trans), conn_size(c$resp, trans),
 			conn_state(c, trans), flags);

+	if ( record_state_history )
+		log_msg = fmt("%s %s", log_msg,
+				c$history == "" ? "X" : c$history);
+
 	if ( use_conn_size_analyzer && report_conn_size_analyzer )
 		log_msg = fmt("%s %s %s", log_msg, 
 				conn_size_from_analyzer(c$orig),  conn_size_from_analyzer(c$resp));
--- a/policy/pcap.bro
+++ b/policy/pcap.bro
@ -58,8 +58,13 @@ function build_default_pcap_filter(): string
 		return cmd_line_bpf_filter;

 	if ( all_packets )
+		{
 		# Return an "always true" filter.
-		return "ip or not ip";
+		if ( bro_has_ipv6() )
+			return "ip or not ip";
+		else
+			return "not ip6";
+		}

 	## Build filter dynamically.

@ -76,6 +81,10 @@ function build_default_pcap_filter(): string
 	# Finally, join them.
 	local filter = join_filters(cfilter, rfilter);

+	# Exclude IPv6 if we don't support it.
+	if ( ! bro_has_ipv6() )
+		filter = fmt("(not ip6) and (%s)", filter);
+
 	return filter;
 	}

--- a/src/POP3.cc
+++ b/src/POP3.cc
@ -576,9 +576,11 @@ void POP3_Analyzer::ProcessReply(int length, const char* line)
 	if ( multiLine == true )
 		{
 		bool terminator =
-			length > 1 && line[0] == '.' &&
-			(line[1] == '\n' ||
-			 (length > 2 && line[1] == '\r' && line[2] == '\n'));
+			line[0] == '.' &&
+			(length == 1 ||
+			 (length > 1 &&
+			  (line[1] == '\n' ||
+			  (length > 2 && line[1] == '\r' && line[2] == '\n'))));

 		if ( terminator )
 			{
--- a/src/SerializationFormat.cc
+++ b/src/SerializationFormat.cc
@ -21,6 +21,7 @@ void SerializationFormat::StartRead(char* data, uint32 arg_len)
 	input = data;
 	input_len = arg_len;
 	input_pos = 0;
+	bytes_read = 0;
 	}

 void SerializationFormat::EndRead()
@ -44,7 +45,6 @@ void SerializationFormat::StartWrite()

 	output_pos = 0;
 	bytes_written = 0;
-	bytes_read = 0;
 	}

 uint32 SerializationFormat::EndWrite(char** data)
--- a/src/Type.cc
+++ b/src/Type.cc
@ -848,8 +848,8 @@ void TypeDecl::DescribeReST(ODesc* d) const
 	}

 CommentedTypeDecl::CommentedTypeDecl(BroType* t, const char* i,
-			attr_list* attrs, std::list<std::string>* cmnt_list)
-	: TypeDecl(t, i, attrs)
+			attr_list* attrs, bool in_record, std::list<std::string>* cmnt_list)
+	: TypeDecl(t, i, attrs, in_record)
 	{
 	comments = cmnt_list;
 	}
--- a/src/Type.h
+++ b/src/Type.h
@ -420,7 +420,7 @@ public:
 class CommentedTypeDecl : public TypeDecl {
 public:
 	CommentedTypeDecl(BroType* t, const char* i, attr_list* attrs = 0,
-			std::list<std::string>* cmnt_list = 0);
+			bool in_record = false, std::list<std::string>* cmnt_list = 0);
 	virtual ~CommentedTypeDecl();

 	void DescribeReST(ODesc* d) const;
--- a/src/Val.cc
+++ b/src/Val.cc
@ -2866,7 +2866,7 @@ RecordVal::RecordVal(RecordType* t) : MutableVal(t)
 			else if ( tag == TYPE_TABLE )
 				def = new TableVal(type->AsTableType(), a);

-			else if ( t->Tag() == TYPE_VECTOR )
+			else if ( tag == TYPE_VECTOR )
 				def = new VectorVal(type->AsVectorType());
 			}

--- a/src/bro.bif
+++ b/src/bro.bif
@ -3106,7 +3106,13 @@ function lookup_location%(a: addr%) : geo_location
 		}

 #else
-	builtin_run_time("Bro was not configured for GeoIP support");
+	static int missing_geoip_reported = 0;
+
+	if ( ! missing_geoip_reported )
+		{
+		builtin_run_time("Bro was not configured for GeoIP support");
+		missing_geoip_reported = 1;
+		}
 #endif

 	// We can get here even if we have GeoIP support if we weren't
@ -3164,7 +3170,13 @@ function lookup_asn%(a: addr%) : count
 		return new Val(atoi(gir+2), TYPE_COUNT);
 		}
 #else
-	builtin_run_time("Bro was not configured for GeoIP ASN support");
+	static int missing_geoip_reported = 0;
+
+	if ( ! missing_geoip_reported )
+		{
+		builtin_run_time("Bro was not configured for GeoIP ASN support");
+		missing_geoip_reported = 1;
+		}
 #endif

 	// We can get here even if we have GeoIP support, if we weren't
@ -3327,3 +3339,12 @@ function entropy_test_finish%(index: any%): entropy_test_result
 	delete s;
 	return ent_result;
 	%}
+
+function bro_has_ipv6%(%) : bool
+    %{
+#ifdef BROv6
+	return new Val(1, TYPE_BOOL);
+#else
+	return new Val(0, TYPE_BOOL);
+#endif
+    %}
--- a/src/parse.y
+++ b/src/parse.y
@ -936,6 +936,7 @@ type_decl:

 			if ( generate_documentation )
 				{
+				// TypeDecl ctor deletes the attr list, so make a copy
 				attr_list* a = $5;
 				attr_list* a_copy = 0;

@ -947,7 +948,7 @@ type_decl:
 					}

 				last_fake_type_decl = new CommentedTypeDecl(
-					$4, $2, a_copy, concat_opt_docs($1, $7));
+					$4, $2, a_copy, (in_record > 0), concat_opt_docs($1, $7));
 				}

 			$$ = new TypeDecl($4, $2, $5, (in_record > 0));
--- a/testing/btest/Baseline/core.conn-id/counts
+++ b/testing/btest/Baseline/core.conn-id/counts
@ -1 +1 @@
-18
+62
--- a/testing/btest/Baseline/core.conn-id/output
+++ b/testing/btest/Baseline/core.conn-id/output
@ -1,34 +1,78 @@
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8
-[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
--- a/testing/btest/Baseline/core.conn-id/output.cc
+++ b/testing/btest/Baseline/core.conn-id/output.cc
@ -1,36 +1,80 @@
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8
-[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8
-[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8
-[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
--- a/testing/btest/Baseline/core.conn-id/output.cc2
+++ b/testing/btest/Baseline/core.conn-id/output.cc2
@ -1,34 +1,78 @@
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj
-[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8
-[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
--- a/testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log
+++ b/testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log
--- a/testing/btest/Baseline/core.print-bpf-filters-ipv4/output
+++ b/testing/btest/Baseline/core.print-bpf-filters-ipv4/output
@ -0,0 +1,4 @@
+not ip6
+not ip6
+(not ip6) and (tcp[13] & 7 != 0)
+port 42
--- a/testing/btest/Baseline/core.print-bpf-filters-ipv6/conn.log
+++ b/testing/btest/Baseline/core.print-bpf-filters-ipv6/conn.log
@ -0,0 +1 @@
+1128727435.450898 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X
--- a/testing/btest/Baseline/core.print-bpf-filters-ipv6/output
+++ b/testing/btest/Baseline/core.print-bpf-filters-ipv6/output
--- a/testing/btest/Baseline/language.cross-product-init/output
+++ b/testing/btest/Baseline/language.cross-product-init/output
@ -0,0 +1,6 @@
+{
+[bar, 1.2.0.0/19] ,
+[foo, 5.6.0.0/21] ,
+[bar, 5.6.0.0/21] ,
+[foo, 1.2.0.0/19] 
+}
--- a/testing/btest/Baseline/language.enum-scope/output
+++ b/testing/btest/Baseline/language.enum-scope/output
@ -0,0 +1 @@
+c
--- a/testing/btest/Baseline/language.match-test/output
+++ b/testing/btest/Baseline/language.match-test/output
@ -0,0 +1,3 @@
+default
+it's big
+it's really big
--- a/testing/btest/Baseline/language.match-test2/output
+++ b/testing/btest/Baseline/language.match-test2/output
@ -0,0 +1 @@
+2
--- a/testing/btest/Baseline/language.next-test/output
+++ b/testing/btest/Baseline/language.next-test/output
@ -0,0 +1,8 @@
+0
+1
+1
+MIDDLE
+0
+0
+1
+THE END
--- a/testing/btest/Baseline/language.rare-events/output
+++ b/testing/btest/Baseline/language.rare-events/output
@ -0,0 +1 @@
+1106953531.452525 DroppedPackets 2 packets dropped after filtering, 1109 received, 10000 on link
--- a/testing/btest/Baseline/language.rec-comp-init/output
+++ b/testing/btest/Baseline/language.rec-comp-init/output
@ -0,0 +1,5 @@
+[a={
+
+}, b={
+
+}, c=[]]
--- a/testing/btest/Baseline/language.rec-of-tbl/output
+++ b/testing/btest/Baseline/language.rec-of-tbl/output
@ -0,0 +1,3 @@
+[a={
+[5] = 3
+}]
--- a/testing/btest/Baseline/language.sizeof/output
+++ b/testing/btest/Baseline/language.sizeof/output
@ -0,0 +1,17 @@
+Address 1.2.3.4: 16909060
+Boolean T: 1
+Count 10: 10
+Double -1.23: 1.230000
+Enum ENUM3: 2
+File 21.000000
+Function add_interface: 2
+Integer -10: 10
+Interval -5.0 secs: 5.000000
+Net 192.168.0: 65536.000000
+Port 80/tcp: 65616
+Record [i=10, j=<uninitialized>, k=<uninitialized>]: 3
+Set: 3
+String 'Hello': 5
+Subnet 192.168.0.0/24: 256.000000
+Table 2
+Vector [Hello, , , , World]: 5
--- a/testing/btest/Baseline/language.smith-waterman-test/output
+++ b/testing/btest/Baseline/language.smith-waterman-test/output
@ -0,0 +1,32 @@
+abcdefgh - ijklmnop:
+AAAabcefghij - lmnopAAAqrst:
+tok 1: AAA (0/5, T)
+abcAAAefghij - lmnopAAAqrst:
+tok 1: AAA (3/5, T)
+abcefghijAAA - lmnopAAAqrst:
+tok 1: AAA (9/5, T)
+xxxAAAyyy - AAAaAAAbAAA:
+tok 1: AAA (3/0, T)
+tok 2: AAA (3/4, T)
+tok 3: AAA (3/8, T)
+AAAaAAAbAAA - xxxAAAyyy:
+tok 1: AAA (0/3, T)
+tok 2: AAA (4/3, T)
+tok 3: AAA (8/3, T)
+xxCDyABzCDyABzz - ABCD:
+tok 1: CD (2/2, T)
+tok 2: AB (5/0, T)
+tok 3: CD (8/2, F)
+tok 4: AB (11/0, T)
+ABCD - xxCDyABzCDyABzz:
+tok 1: CD (2/2, T)
+tok 2: AB (0/5, T)
+tok 3: CD (2/8, F)
+tok 4: AB (0/11, T)
+Cache-control: no-cache^M^JAccept: - Accept-: deflate^M^JAccept-: Accept-:
+tok 1: Accept (27/0, T)
+tok 2: e^M^JAccept (22/15, T)
+tok 3: Accept (27/29, T)
+xxAAxxAAxx - yyyyyAAyyyyy:
+tok 1: AA (2/5, T)
+tok 2: AA (6/5, T)
--- a/testing/btest/Baseline/language.strings/output
+++ b/testing/btest/Baseline/language.strings/output
@ -0,0 +1,25 @@
+Input string: broisaveryneatids
+
+String splitting
+----------------
+Splitting 'broisaveryneatids' at 6 points...
+bro
+is
+a
+very
+neat
+ids
+
+Substrings
+----------
+3@0: bro
+5@2: roisa
+7@4: isavery
+10@10: yneatids
+
+Finding strings
+---------------
+isa: 4
+very: 7
+ids: 15
+nono: 0
--- a/testing/btest/Baseline/language.wrong-delete-field/output
+++ b/testing/btest/Baseline/language.wrong-delete-field/output
@ -1 +1 @@
-/da/home/robin/bro/master/testing/btest/.tmp/language.wrong-delete-field/wrong-delete-field.bro, line 11 (delete x$a): error, illegal delete statement
+/da/home/robin/bro/master/testing/btest/.tmp/language.wrong-delete-field/wrong-delete-field.bro, line 10 (delete x$a): error, illegal delete statement
--- a/testing/btest/Baseline/logging.rotate-custom/out
+++ b/testing/btest/Baseline/logging.rotate-custom/out
@ -28,107 +28,56 @@
 2nd test2-11-03-07_12.00.05.log test2.log 11-03-07_12.00.05 11-03-07_12.59.55 0
 1st test-11-03-07_12.00.05.log test.log 11-03-07_12.00.05 11-03-07_12.59.55 1
 2nd test2-11-03-07_12.59.55.log test2.log 11-03-07_12.59.55 11-03-07_12.59.55 1
+# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
+1299466805.0	10.0.0.1	20	10.0.0.2	1024
+1299470395.0	10.0.0.2	20	10.0.0.3	0
+1299470405.0	10.0.0.1	20	10.0.0.2	1025
+1299473995.0	10.0.0.2	20	10.0.0.3	1
+1299474005.0	10.0.0.1	20	10.0.0.2	1026
+1299477595.0	10.0.0.2	20	10.0.0.3	2
+1299477605.0	10.0.0.1	20	10.0.0.2	1027
+1299481195.0	10.0.0.2	20	10.0.0.3	3
+1299481205.0	10.0.0.1	20	10.0.0.2	1028
+1299484795.0	10.0.0.2	20	10.0.0.3	4
+1299484805.0	10.0.0.1	20	10.0.0.2	1029
+1299488395.0	10.0.0.2	20	10.0.0.3	5
+1299488405.0	10.0.0.1	20	10.0.0.2	1030
+1299491995.0	10.0.0.2	20	10.0.0.3	6
+1299492005.0	10.0.0.1	20	10.0.0.2	1031
+1299495595.0	10.0.0.2	20	10.0.0.3	7
+1299495605.0	10.0.0.1	20	10.0.0.2	1032
+1299499195.0	10.0.0.2	20	10.0.0.3	8
+1299499205.0	10.0.0.1	20	10.0.0.2	1033
+1299502795.0	10.0.0.2	20	10.0.0.3	9
 > test-11-03-07_03.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299466805.0	10.0.0.1	20	10.0.0.2	1024
-1299470395.0	10.0.0.2	20	10.0.0.3	0
 > test-11-03-07_04.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299470405.0	10.0.0.1	20	10.0.0.2	1025
-1299473995.0	10.0.0.2	20	10.0.0.3	1
 > test-11-03-07_05.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299474005.0	10.0.0.1	20	10.0.0.2	1026
-1299477595.0	10.0.0.2	20	10.0.0.3	2
 > test-11-03-07_06.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299477605.0	10.0.0.1	20	10.0.0.2	1027
-1299481195.0	10.0.0.2	20	10.0.0.3	3
 > test-11-03-07_07.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299481205.0	10.0.0.1	20	10.0.0.2	1028
-1299484795.0	10.0.0.2	20	10.0.0.3	4
 > test-11-03-07_08.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299484805.0	10.0.0.1	20	10.0.0.2	1029
-1299488395.0	10.0.0.2	20	10.0.0.3	5
 > test-11-03-07_09.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299488405.0	10.0.0.1	20	10.0.0.2	1030
-1299491995.0	10.0.0.2	20	10.0.0.3	6
 > test-11-03-07_10.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299492005.0	10.0.0.1	20	10.0.0.2	1031
-1299495595.0	10.0.0.2	20	10.0.0.3	7
 > test-11-03-07_11.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299495605.0	10.0.0.1	20	10.0.0.2	1032
-1299499195.0	10.0.0.2	20	10.0.0.3	8
 > test-11-03-07_12.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299499205.0	10.0.0.1	20	10.0.0.2	1033
-1299502795.0	10.0.0.2	20	10.0.0.3	9
-> test2-11-03-07_03.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299466805.0	10.0.0.1	20	10.0.0.2	1024
-> test2-11-03-07_03.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299470395.0	10.0.0.2	20	10.0.0.3	0
-> test2-11-03-07_04.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299470405.0	10.0.0.1	20	10.0.0.2	1025
-> test2-11-03-07_04.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299473995.0	10.0.0.2	20	10.0.0.3	1
-> test2-11-03-07_05.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299474005.0	10.0.0.1	20	10.0.0.2	1026
-> test2-11-03-07_05.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299477595.0	10.0.0.2	20	10.0.0.3	2
-> test2-11-03-07_06.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299477605.0	10.0.0.1	20	10.0.0.2	1027
-> test2-11-03-07_06.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299481195.0	10.0.0.2	20	10.0.0.3	3
-> test2-11-03-07_07.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299481205.0	10.0.0.1	20	10.0.0.2	1028
-> test2-11-03-07_07.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299484795.0	10.0.0.2	20	10.0.0.3	4
-> test2-11-03-07_08.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299484805.0	10.0.0.1	20	10.0.0.2	1029
-> test2-11-03-07_08.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299488395.0	10.0.0.2	20	10.0.0.3	5
-> test2-11-03-07_09.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299488405.0	10.0.0.1	20	10.0.0.2	1030
-> test2-11-03-07_09.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299491995.0	10.0.0.2	20	10.0.0.3	6
-> test2-11-03-07_10.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299492005.0	10.0.0.1	20	10.0.0.2	1031
-> test2-11-03-07_10.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299495595.0	10.0.0.2	20	10.0.0.3	7
-> test2-11-03-07_11.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299495605.0	10.0.0.1	20	10.0.0.2	1032
-> test2-11-03-07_11.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299499195.0	10.0.0.2	20	10.0.0.3	8
-> test2-11-03-07_12.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299499205.0	10.0.0.1	20	10.0.0.2	1033
-> test2-11-03-07_12.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299502795.0	10.0.0.2	20	10.0.0.3	9
-> test2.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
 > test.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
+> test2-11-03-07_03.00.05.log
+> test2-11-03-07_03.59.55.log
+> test2-11-03-07_04.00.05.log
+> test2-11-03-07_04.59.55.log
+> test2-11-03-07_05.00.05.log
+> test2-11-03-07_05.59.55.log
+> test2-11-03-07_06.00.05.log
+> test2-11-03-07_06.59.55.log
+> test2-11-03-07_07.00.05.log
+> test2-11-03-07_07.59.55.log
+> test2-11-03-07_08.00.05.log
+> test2-11-03-07_08.59.55.log
+> test2-11-03-07_09.00.05.log
+> test2-11-03-07_09.59.55.log
+> test2-11-03-07_10.00.05.log
+> test2-11-03-07_10.59.55.log
+> test2-11-03-07_11.00.05.log
+> test2-11-03-07_11.59.55.log
+> test2-11-03-07_12.00.05.log
+> test2-11-03-07_12.59.55.log
+> test2.log
--- a/testing/btest/Makefile
+++ b/testing/btest/Makefile
@ -0,0 +1,14 @@
+
+all:
+    # Showing all tests.
+	@btest
+
+brief:
+    # Brief output showing only failed tests.
+	@btest -b
+
+brief-debug:
+    # Verbose output for failed tests, also recorded in test.log.
+	@rm -f test.log
+	@btest -b -d -f test.log
+	@echo Output in test.log
--- a/testing/btest/Scripts/diff-remove-abspath
+++ b/testing/btest/Scripts/diff-remove-abspath
@ -0,0 +1,5 @@
+#! /usr/bin/env bash
+#
+# Replace absolute paths with the basename.
+
+sed 's#/\([^/]\{1,\}/\)\{1,\}\([^/]\{1,\}\)#<...>/\2#g'
--- a/testing/btest/btest.cfg
+++ b/testing/btest/btest.cfg
@ -9,7 +9,7 @@ IgnoreFiles = *.tmp *.swp #* *.trace
 BROPATH=`bash -c %(testbase)s/../../build/bro-path-dev`
 BRO_SEED_FILE=%(testbase)s/random.seed
 TZ=UTC
-LOCALE=C
+LC_ALL=C
 PATH=%(testbase)s/../../build/src:%(testbase)s/../../aux/btest:%(default_path)s
 TEST_DIFF_CANONIFIER=%(testbase)s/Scripts/diff-canonifier
 TRACES=%(testbase)s/Traces
--- a/testing/btest/core/conn-id.bro
+++ b/testing/btest/core/conn-id.bro
@ -1,7 +1,7 @@
 #
 # In "normal" test mode, connection uids should be determistic.
 #
-# @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace %INPUT tcp >output
+# @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace %INPUT conn >output
 # @TEST-EXEC: btest-diff output
 #
 # Without a seed, they should differ each time:
--- a/testing/btest/core/print-bpf-filters-ipv4.bro
+++ b/testing/btest/core/print-bpf-filters-ipv4.bro
@ -1,3 +1,5 @@
+# @TEST-REQUIRES: bro -e 'print bro_has_ipv6()' | grep -q F
+#
 # @TEST-EXEC: bro print-filter >output 2>&1
 # @TEST-EXEC: bro tcp print-filter >>output
 # @TEST-EXEC: bro tcp print-filter all_packets=F >>output
--- a/testing/btest/core/print-bpf-filters-ipv6.bro
+++ b/testing/btest/core/print-bpf-filters-ipv6.bro
@ -0,0 +1,9 @@
+# @TEST-REQUIRES: bro -e 'print bro_has_ipv6()' | grep -q T
+#
+# @TEST-EXEC: bro print-filter >output 2>&1
+# @TEST-EXEC: bro tcp print-filter >>output
+# @TEST-EXEC: bro tcp print-filter all_packets=F >>output
+# @TEST-EXEC: bro -f "port 42" print-filter >>output
+# @TEST-EXEC: bro -C -f "port 50343" -r $TRACES/mixed-vlan-mpls.trace tcp
+# @TEST-EXEC: btest-diff output
+# @TEST-EXEC: btest-diff conn.log
--- a/testing/btest/doc/record-attr-check.bro
+++ b/testing/btest/doc/record-attr-check.bro
@ -0,0 +1,9 @@
+# @TEST-EXEC: bro --doc-scripts %INPUT
+
+type Tag: enum {
+    SOMETHING
+};
+
+type R: record {
+    field1: set[Tag] &default=set();
+};
--- a/testing/btest/language/cross-product-init.bro
+++ b/testing/btest/language/cross-product-init.bro
@ -0,0 +1,10 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+global my_subs = { 1.2.3.4/19, 5.6.7.8/21 };
+
+global x: set[string, subnet] &redef;
+
+redef x += { [["foo", "bar"], my_subs] };
+
+print x;
--- a/testing/btest/language/delete-field-set.bro
+++ b/testing/btest/language/delete-field-set.bro
@ -1,4 +1,3 @@
-
 # @TEST-EXEC: bro %INPUT >output 2>&1
 # @TEST-EXEC: btest-diff output

--- a/testing/btest/language/delete-field.bro
+++ b/testing/btest/language/delete-field.bro
@ -1,4 +1,3 @@
-
 # @TEST-EXEC: bro %INPUT >output 2>&1
 # @TEST-EXEC: btest-diff output

--- a/testing/btest/language/enum-scope.bro
+++ b/testing/btest/language/enum-scope.bro
@ -0,0 +1,10 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+type foo: enum { a, b } &redef;
+
+module test;
+
+redef enum foo += { c };
+
+print c;
--- a/testing/btest/language/match-test.bro
+++ b/testing/btest/language/match-test.bro
@ -0,0 +1,20 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+global match_stuff = {
+	[$pred(a: count) = { return a > 5; },
+	 $result = "it's big",
+	 $priority = 2],
+
+	[$pred(a: count) = { return a > 15; },
+	 $result = "it's really big",
+	 $priority = 3],
+
+	[$pred(a: count) = { return T; },
+	 $result = "default",
+	 $priority = 0],
+};
+
+print match 0 using match_stuff;
+print match 10 using match_stuff;
+print match 20 using match_stuff;
--- a/testing/btest/language/match-test2.bro
+++ b/testing/btest/language/match-test2.bro
@ -0,0 +1,51 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+type fakealert : record {
+     alert: string;
+};
+
+
+type match_rec : record {
+     result : count;
+     pred : function(rec : fakealert) : bool;
+     priority: count;
+};
+
+
+#global test_set : set[int] = 
+#{
+#1, 2, 3
+#};
+
+global match_set : set[match_rec] = 
+{
+  [$result = 1, $pred(a: fakealert) = { return T; }, $priority = 8 ],
+  [$result = 2, $pred(a: fakealert) = { return T; }, $priority = 9 ]
+};
+
+global al : fakealert;
+
+#global testset : set[fakealert] = 
+#{
+#       [$alert="hithere"]
+#};
+
+
+type nonalert: record {
+     alert : string;
+     pred : function(a : int) : int;
+};
+
+#global na : nonalert;
+#na$alert = "5";
+
+#al$alert = "hithere2";
+#if (al in testset)
+#   print 1;
+#else
+#   print 0;
+
+
+al$alert = "hi";
+print (match al using match_set);
--- a/testing/btest/language/next-test.bro
+++ b/testing/btest/language/next-test.bro
@ -0,0 +1,36 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+# This script tests "next" being called during the last iteration of a
+# for loop
+
+event bro_done()
+  {
+
+        local number_set: set[count];
+        local i: count;
+
+        add number_set[0];
+        add number_set[1];
+
+
+        for ( i in number_set )
+                {
+                print fmt ("%d", i);
+                if ( i == 0 )
+                        next;
+                print fmt ("%d", i);
+                }
+        print fmt ("MIDDLE");
+
+
+        for ( i in number_set )
+                {
+                print fmt ("%d", i);
+                if ( i == 1 )
+                        next;
+                print fmt ("%d", i);
+                }
+        print fmt ("THE END");
+
+        }
--- a/testing/btest/language/rare-events.bro
+++ b/testing/btest/language/rare-events.bro
@ -0,0 +1,37 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+# This is a test script whose job is to generate rarely-seen events
+# (i.e., events that test traces might not include) to ensure that they're
+# handled properly.
+
+# This is needed or else the output fails on the warning that
+# Drop::restore_dropped_address is never defined.
+redef check_for_unused_event_handlers = F;
+
+@load netstats
+
+function test_net_stats_update()
+    {
+    local t = current_time();
+
+    local s: net_stats;
+    s$pkts_recvd = 1234;
+    s$pkts_dropped = 123;
+    s$pkts_link = 9999;
+
+    event net_stats_update(t, s);
+
+    local s2: net_stats;
+    s2$pkts_recvd = 2341;
+    s2$pkts_dropped = 125;
+    s2$pkts_link = 19999;
+
+    event net_stats_update(t + 33 sec, s2);
+    }
+
+event bro_init()
+    {
+    test_net_stats_update();
+    }
+
--- a/testing/btest/language/rec-comp-init.bro
+++ b/testing/btest/language/rec-comp-init.bro
@ -0,0 +1,14 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+# Make sure composit types in records are initialized.
+
+type Foo: record {
+	a: set[count];
+	b: table[count] of string;
+	c: vector of string;
+};
+
+global f: Foo;
+
+print f;
--- a/testing/btest/language/rec-nested-opt.bro
+++ b/testing/btest/language/rec-nested-opt.bro
@ -1,4 +1,3 @@
-
 # @TEST-EXEC: bro %INPUT >output 2>&1
 # @TEST-EXEC: btest-diff output

--- a/testing/btest/language/rec-of-tbl.bro
+++ b/testing/btest/language/rec-of-tbl.bro
@ -0,0 +1,16 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+type x: record {
+	a: table[int] of count;
+};
+
+global y: x;
+
+global yy: table[int] of count;
+
+y$a = yy;
+
+y$a[+5] = 3;
+
+print y;
--- a/testing/btest/language/rec-table-default.bro
+++ b/testing/btest/language/rec-table-default.bro
@ -1,4 +1,3 @@
-
 # @TEST-EXEC: bro %INPUT >output 2>&1
 # @TEST-EXEC: btest-diff output

--- a/testing/btest/language/sizeof.bro
+++ b/testing/btest/language/sizeof.bro
@ -0,0 +1,119 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+# Demo policy for the sizeof operator "|x|".
+# ------------------------------------------
+#
+# This script creates various types and values and shows the result of the
+# sizeof operator on these values.
+#
+# For any types not covered in this script, the sizeof operator's semantics
+# are not defined and its application returns a count of 0. At the moment
+# the only type where this should happen is string patterns.
+
+type example_enum: enum { ENUM1, ENUM2, ENUM3 };
+
+type example_record: record {
+	i: int &optional;
+	j: int &optional;
+	k: int &optional;
+};
+
+global a:  addr = 1.2.3.4;
+global b:  bool = T;
+global c:  count = 10;
+global d:  double = -1.23;
+global f:  file = open_log_file("sizeof_demo");
+global i:  int = -10;
+global iv: interval = -5sec;
+global n:  net = 192.168.;
+global p:  port = 80/tcp;
+global r:  example_record [ $i = 10 ];
+global si: set[int];
+global s:  string = "Hello";
+global sn: subnet = 192.168.0.0/24;
+global t:  table[string] of string;
+global ti: time = current_time();
+global v:  vector of string;
+
+# Additional initialization
+#
+print f, "12345678901234567890";
+
+add si[1];
+add si[10];
+add si[100];
+
+t["foo"] = "Hello";
+t["bar"] = "World";
+
+v[0] = "Hello";
+v[4] = "World";
+
+# Print out the sizes of the various vals:
+#-----------------------------------------
+
+# Size of addr: returns integer representation for IPv4, 0 for IPv6.
+print fmt("Address %s: %d", a, |a|);
+
+# Size of boolean: returns 1 or 0.
+print fmt("Boolean %s: %d", b, |b|);
+
+# Size of count: identity.
+print fmt("Count %s: %d", c, |c|);
+
+# Size of double: returns absolute value.
+print fmt("Double %s: %f", d, |d|);
+
+# Size of enum: returns numeric value of enum constant.
+print fmt("Enum %s: %d", ENUM3, |ENUM3|);
+
+# Size of file: returns current file size.
+# Note that this is a double so that file sizes >> 4GB
+# can be expressed.
+print fmt("File %f", |f|);
+
+# Size of function: returns number of arguments.
+print fmt("Function add_interface: %d", |add_interface|);
+
+# Size of integer: returns absolute value.
+print fmt("Integer %s: %d", i, |i|);
+
+# Size of interval: returns double representation of the interval
+print fmt("Interval %s: %f", iv, |iv|);
+
+# Size of net: returns size of class N network as a double
+# (so that 2^32 can be expressed too).
+print fmt("Net %s: %f", n, |n|);
+
+# Size of port: returns port number as a count.
+print fmt("Port %s: %d", p, |p|);
+
+# Size of record: returns number of fields (assigned + unassigned)
+print fmt("Record %s: %d", r, |r|);
+
+# Size of set: returns number of elements in set.
+# Don't print the set, as its order depends on the seeding of the hash
+# fnction, and it's not worth the trouble to normalize it.
+print fmt("Set: %d", |si|);
+
+# Size of string: returns string length.
+print fmt("String '%s': %d", s, |s|);
+
+# Size of subnet: returns size of net as a double 
+# (so that 2^32 can be expressed too).
+print fmt("Subnet %s: %f", sn, |sn|);
+
+# Size of table: returns number of elements in table
+print fmt("Table %d", |t|);
+
+# Size of time: returns double representation of the time
+# print fmt("Time %s: %f", ti, |ti|);
+
+# Size of vector: returns largest assigned index.
+# Note that this is not the number of assigned values.
+# The following prints "5":
+#
+print fmt("Vector %s: %d", v, |v|);
+
+close(f);
--- a/testing/btest/language/smith-waterman-test.bro
+++ b/testing/btest/language/smith-waterman-test.bro
@ -0,0 +1,88 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+global params: sw_params = [ $min_strlen = 2, $sw_variant = 0 ];
+
+global min: vector of count;
+global mode: vector of count;
+global c: count = 0;
+
+# Alignment pairs:
+global s1: string_vec;
+global s2: string_vec;
+
+# Single alignment, no matches:
+s1[++c] = "abcdefgh";
+s2[c] = "ijklmnop";
+min[c] = 2;;
+mode[c] = 0;
+
+# Simple single match, beginning:
+s1[++c] = "AAAabcefghij";
+s2[c] = "lmnopAAAqrst";
+min[c] = 2;;
+mode[c] = 0;
+
+# Simple single match, middle:
+s1[++c] = "abcAAAefghij";
+s2[c] = "lmnopAAAqrst";
+min[c] = 2;;
+mode[c] = 0;
+
+# Simple single match, end:
+s1[++c] = "abcefghijAAA";
+s2[c] = "lmnopAAAqrst";
+min[c] = 2;;
+mode[c] = 0;
+
+# Repeated alignment:
+s1[++c] = "xxxAAAyyy";
+s2[c] = "AAAaAAAbAAA";
+min[c] = 2;;
+mode[c] = 1;
+
+# Repeated alignment, swapped input:
+s1[++c] = "AAAaAAAbAAA";
+s2[c] = "xxxAAAyyy";
+min[c] = 2;;
+mode[c] = 1;
+
+# Repeated alignment, split:
+s1[++c] = "xxCDyABzCDyABzz";
+s2[c] = "ABCD";
+min[c] = 2;;
+mode[c] = 1;
+
+# Repeated alignment, split, swapped:
+s1[++c] = "ABCD";
+s2[c] = "xxCDyABzCDyABzz";
+min[c] = 2;;
+mode[c] = 1;
+
+# Used to cause problems
+s1[++c] = "Cache-control: no-cache^M^JAccept:";
+s2[c] = "Accept-: deflate^M^JAccept-: Accept-";
+min[c] = 6;
+mode[c] = 1;
+
+# Repeated occurrences in shorter string
+s1[++c] = "xxAAxxAAxx";
+s2[c]   = "yyyyyAAyyyyy";
+min[c] = 2;
+mode[c] = 1;
+
+for ( i in s1 )
+	{
+	local ss: sw_substring_vec;
+
+	params$min_strlen = min[i];
+	params$sw_variant = mode[i];
+	ss = str_smith_waterman(s1[i], s2[i], params);
+
+	print fmt("%s - %s:", s1[i], s2[i]);
+
+	for ( j in ss )
+		print fmt("tok %d: %s (%d/%d, %s)",
+				j, ss[j]$str, ss[j]$aligns[1]$index,
+				ss[j]$aligns[2]$index, ss[j]$new);
+	}
--- a/testing/btest/language/strings.bro
+++ b/testing/btest/language/strings.bro
@ -0,0 +1,48 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+# Demo policy for string functions
+#
+
+event bro_init()
+{
+	local s1: string = "broisaveryneatids";
+
+	print fmt("Input string: %s", s1);
+	print fmt();
+	print fmt("String splitting");
+	print fmt("----------------");
+
+	local idx1: index_vec;
+
+	idx1[0] =  0; # We really need initializers for vectors ...
+	idx1[1] =  3;
+	idx1[2] =  5;
+	idx1[3] =  6;
+	idx1[4] = 10;
+	idx1[5] = 14;
+
+	print fmt("Splitting '%s' at %d points...", s1, |idx1|);
+	local res_split: string_vec = str_split(s1, idx1);
+
+	for ( i in res_split )
+		print res_split[i];
+
+	print fmt();
+	print fmt("Substrings");
+	print fmt("----------");
+	print fmt("3@0: %s", sub_bytes(s1, 0, 3));
+	print fmt("5@2: %s", sub_bytes(s1, 2, 5));
+	print fmt("7@4: %s", sub_bytes(s1, 4, 7));
+	print fmt("10@10: %s", sub_bytes(s1, 10, 10));
+	print fmt();
+
+
+	print fmt("Finding strings");
+	print fmt("---------------");
+	print fmt("isa: %d", strstr(s1, "isa"));
+	print fmt("very: %d", strstr(s1, "very"));
+	print fmt("ids: %d", strstr(s1, "ids"));
+	print fmt("nono: %d", strstr(s1, "nono"));
+}
+
--- a/testing/btest/language/wrong-delete-field.bro
+++ b/testing/btest/language/wrong-delete-field.bro
@ -1,4 +1,3 @@
-
 # @TEST-EXEC-FAIL: bro %INPUT  >output 2>&1
 # @TEST-EXEC: btest-diff output

--- a/testing/btest/logging/rotate-custom.bro
+++ b/testing/btest/logging/rotate-custom.bro
@ -1,6 +1,6 @@
 #
 # @TEST-EXEC: bro -r %DIR/rotation.trace %INPUT >out
-# @TEST-EXEC: for i in `ls test*.log | sort`; do printf '> %s\n' $i; cat $i; done >>out
+# @TEST-EXEC: for i in `ls test*.log | sort`; do printf '> %s\n' $i; cat $i; done | sort | uniq >>out
 # @TEST-EXEC: btest-diff out

 module Test;
--- a/testing/istate/README
+++ b/testing/istate/README
@ -1,11 +0,0 @@
-To run these tests, invoke:
-
-	./istate.py
-
-To see differences leading to test failures, invoke:
-
-	./istate.py -s
-
-Build a new test baseline using:
-
-	./istate.py -b
--- a/testing/istate/base/bro-ping/remote.log
+++ b/testing/istate/base/bro-ping/remote.log
@ -1,17 +0,0 @@
-xxxxxxxxxx.xxxxxx [info]  [parent] pipe's socket buffer size is 8192, setting to 1048576
-xxxxxxxxxx.xxxxxx [info]  [parent] communication started, parent 
-xxxxxxxxxx.xxxxxx [info]  [child]  listening on 0.0.0.0:47758 (clear)
-xxxxxxxxxx.xxxxxx [info]  [child]  [#10000/] accepted clear connection
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] added peer
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] peer connected
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] phase: version
-xxxxxxxxxx.xxxxxx [info]  [script] [#10000/] connection established
-xxxxxxxxxx.xxxxxx [info]  [script] [#10000/] requesting events matching /^?(ping)$?/
-xxxxxxxxxx.xxxxxx [info]  [script] [#10000/] accepting state
-xxxxxxxxxx.xxxxxx [info]  [script] [#10000/] requesting synchronized state
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] phase: handshake
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] registered for event pong
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] peer does not support 64bit PIDs; using compatibility mode
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] phase: sync (receiver)
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] phase: running
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] closing connection
--- a/testing/istate/base/bro-ping/stderr.log
+++ b/testing/istate/base/bro-ping/stderr.log
@ -1,3 +0,0 @@
-xxxxxxxxxx.xxxxxx processing suspended
-xxxxxxxxxx.xxxxxx processing continued
-xxxxxxxxxx.xxxxxx received termination signal
--- a/testing/istate/base/bro-ping/stdout.log
+++ b/testing/istate/base/bro-ping/stdout.log
--- a/testing/istate/base/broccoli-ping/stderr.log
+++ b/testing/istate/base/broccoli-ping/stderr.log
--- a/testing/istate/base/broccoli-ping/stdout.log
+++ b/testing/istate/base/broccoli-ping/stdout.log
@ -1,5 +0,0 @@
-pong event from 127.0.0.1: seq=0, 
-pong event from 127.0.0.1: seq=1, 
-pong event from 127.0.0.1: seq=2, 
-pong event from 127.0.0.1: seq=3, 
-pong event from 127.0.0.1: seq=4, 
--- a/testing/istate/base/events-display/stdout.log
+++ b/testing/istate/base/events-display/stdout.log
@ -1,36 +0,0 @@
-Event [xxxxxxxxxx.xxxxxx] bro_done()
-Event [xxxxxxxxxx.xxxxxx] connection_established([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=0, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.182510137557983, service={}, addl="", hot=0, history="Sh"])
-Event [xxxxxxxxxx.xxxxxx] connection_finished([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=5], resp=[size=9417, state=5], start_time=xxxxxxxxxx.xxxxxx, duration=1.73330307006836, service={}, addl="%events-send-1", hot=0, history="ShADdFaf"])
-Event [xxxxxxxxxx.xxxxxx] connection_pending([id=[orig_h=141.42.64.125, orig_p=56729/tcp, resp_h=125.190.109.199, resp_p=12345/tcp], orig=[size=0, state=1], resp=[size=0, state=6], start_time=xxxxxxxxxx.xxxxxx, duration=0.182432889938354, service={}, addl="", hot=0, history="Sr"])
-Event [xxxxxxxxxx.xxxxxx] connection_state_remove([id=[orig_h=141.42.64.125, orig_p=56729/tcp, resp_h=125.190.109.199, resp_p=12345/tcp], orig=[size=0, state=1], resp=[size=0, state=6], start_time=xxxxxxxxxx.xxxxxx, duration=0.182432889938354, service={}, addl="", hot=0, history="Sr"])
-Event [xxxxxxxxxx.xxxxxx] connection_state_remove([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=5], resp=[size=9417, state=5], start_time=xxxxxxxxxx.xxxxxx, duration=1.73330307006836, service={}, addl="%events-send-1", hot=0, history="ShADdFaf"])
-Event [xxxxxxxxxx.xxxxxx] http_begin_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1", hot=0, history="ShAD"]T)
-Event [xxxxxxxxxx.xxxxxx] http_begin_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F)
-Event [xxxxxxxxxx.xxxxxx] http_content_type([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"TEXT""PLAIN")
-Event [xxxxxxxxxx.xxxxxx] http_content_type([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"TEXT""HTML")
-Event [xxxxxxxxxx.xxxxxx] http_end_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T)
-Event [xxxxxxxxxx.xxxxxx] http_end_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=9417, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.73563814163208, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F)
-Event [xxxxxxxxxx.xxxxxx] http_entity_data([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=5792, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.551820039749146, service={}, addl="%events-send-1", hot=0, history="ShADd"]F4096"<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"^J"http://www.w3.org/TR/REC-html40/loose.dtd">^J<HEAD><TITLE>ICIR</TITLE></HEAD>^J<BODY bgcolor="#ffffff" text="#000000" link="#0000ff" vlink="#b20000">^J<img src=icir.gif alt="ICIR"><br>^J<p>^JICIR (The ICSI Center for Internet Research)^Jis a ^Jnon-profit^Jresearch institute at^J<a href="http://www.icsi.berkeley.edu">ICSI</a>^Jin ^J<a href="http://dir.yahoo.com/Regional/U_S__States/California/Cities/Berkeley/">Berkeley</a>, ^JCalifornia.<br>^JFor the three years from 1999 to 2001 we were named^JACIRI, the AT&T Center for Internet Research at ICSI, ^Jand were funded by <a href="http://www.att.com">AT&amp;T</a>.<br>^J^JThe goals of ICIR are to:^J<ul>^J<li>Pursue research on the Internet architecture and related networking issues,^J<li>^JParticipate actively in the research (<a href="http://www.acm.org/sigcomm/">SIGCOMM</a> and <a href="http://www.irtf.org/">IRTF</a>) and^Jstandards (<a href="http://www.ietf.org/">IETF</a>) communities,^J<li> Bridge the gap between the Internet research community and commercial ^Jinterests by providing a neutral forum where topics of mutual technical ^Jinterest can be addressed.^J</ul>^J<p>^J<!--^JICIR is now ^J<a href="jobs.html">^Jhiring</a> for both postdoctoral positions and summer interns.^J-->^J<hr>^J^J<DIV ALIGN="CENTER">^J^J<table width="100%" cellspacing=16 cellpadding=0>^J^J<tr>^J<td width="35%" valign=top>^J^J<h2>^JPeople^J</h2>^J<ul>^J<li>^J<a href="./shenker/">^JScott Shenker</a>, Group Leader<br> ^J<li><a href="http://www.icir.org/mallman/">Mark Allman</a>^J<li>^J<a href="./floyd/">Sally Floyd</a>^J<!--^J<li><a href="http://www.isi.edu/~govindan/">Ramesh Govindan</a>^J-->^J<li>^J<a href="./karp/papers.html">^JRichard Karp</a>  ^J<!-- (also with the ^J<a href="http://www.icsi.berkeley.edu/Theory/">ICSI Theory Group</a>, ^J<a href="http://www.msri.org/">MSRI</a>, and^J<a href="http://www.cs.berkeley.edu/">UC Berkeley</a>) -->^J<li>^J<a href="./vern/">^JVern Paxson</a>  ^J<li>^J<a href="http://www.icir.org/robin/">^JRobin Sommer</a>^J<li>^J<a href="http://www.cs.berkeley.edu/~nweaver/">^JNicholas Weaver</a>^J<li>^J<a href="http://www.icsi.berkeley.edu/~zhao/">^JJerry Zhao</a>^J<!-- </ul> &nbsp; &nbsp;<b>Group Members</b> <ul> -->^J<li><b><a href="pastvisitors.html">Past Group Members</a></b>,^J<br>including:^J<ul>^J<li>^J<a href="http://www.cs.ucl.ac.uk/staff/M.Handley/">^JMark Handley</a> (UCL)^J<li><a href="./kohler/">Eddie Kohler</a> (UCLA)^J</ul>^J<li><b>Affiliated <a href="http://www.xorp.org/">Xorp</a>^JResearchers</b>:^J  <ul>^J  <li><a href="./jcardona/">Javier Cardona</a>^J  <li><a href="./atanu/">Atanu Ghosh</a> ^J  <li><a href="./hodson/">Orion Hodson</a>^J  <li><a href="./pavlin/">Pavlin Radoslavov</a> ^J  <li><a href="http://www.iet.unipi.it/~luigi">Luigi Rizzo</a>^J  <li><a href="http://people.freebsd.org/~bms/">Bruce Simpson</a>^J</ul>^J<li><b>Affiliated UCB Researchers</b>:^J  <ul>^J  <li><a href="http://www.cs.berkeley.edu/~christos/">Christos Papadimitriou</a>^J  <li><a href="http://www.cs.berkeley.edu/~istoica/">Ion Stoica</a>^J  </ul>^J<li><b>Visitors</b>:^J  <ul>^J  <li><a href="http://grid.sjtu.edu.cn/teachers/dengqn/dengqn.htm">Professor Quin-Ni Deng</a>^J<!--^J  from Shanghai Jiaotong University^J-->^J  <li>Teemu Koponen^J<!--^J  , Helsinki Institute for Information Technology^J-->^J  </ul>^J<!--^J<li><a href="pastvisitors.html">Other researchers</a>^J-->^J<a name=Visitors></a>^J<li><b>Interns:</b>^J<ul>^J<li>Juan Caballero^J<li><a href="http://www.stanford.edu/~casado/">Martin Casado</a>^J<li><a href="http://www.cs.rice.edu/~scrosby/">Scott Crosby</a>^J<li><a href="http://bnrg.cs.berkeley.edu/~wdc/">Weidong Cui</a>^J<li><a href="http://www.cs.berkeley.edu/~chema">Chema Gonzalez</a>^J<li>Halldor Isak Gylfason^J<li><a href="http://www.cl.cam.ac.uk/~cpk25/">Christian Kreibich</a>^J<li><a href="http://www.cs.ucsd.edu/~braghava">Barath Raghavan</a>^J<!--^J<li><a href="newinterns.html">New Interns:</a> ^J-->^J</ul>^J<li><b>Undergraduate Interns:</b>^J<ul>^J<li>Michael Hoisie^J<li>Arthur Wayne Liao^J<li>Christopher Portka^J</ul>^J<li><b><a href="pastvisitors.html">Past Visitors and Interns:</a></b>^J</ul>^J^J</td>^J<td width="30%" vali")
-Event [xxxxxxxxxx.xxxxxx] http_entity_data([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=8688, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.552114009857178, service={}, addl="%events-send-1", hot=0, history="ShADd"]F4096"gn=top>^J^J<h2>^JPublications^J</h2>^J<ul>^J<li><a href="./rfcs.html">^JRFCs</a> with ICIR authors.^J<li>^J<a href="./internetdrafts.html">^JInternet drafts</a> with ICIR authors, 3/2004 ^J(or <a href="http://www.rfc-editor.org/idsearch.html">search</a>^Jthe current list).^J<!--^Jfor "Shenker OR Floyd OR Allman OR Paxson".^J(or the ^J<a^Jhref="^Jhttp://search.ietf.org:80/search/cgi-bin/BrokerQuery.pl.cgi?broker=internet-drafts&query=%28Author%3A+Shenker+OR+Floyd+OR+Handley+OR+Paxson+OR+Kohler%29&caseflag=on&wordflag=off&errorflag=0&maxlineflag=50&maxresultflag=1000&descflag=on&sort=by-NML&verbose=on&maxobjflag=25">current list</a>.)^J^Jhttp://search.ietf.org:80/search/cgi-bin/BrokerQuery.pl.cgi?broker=internet-drafts&query=(Shenker+OR+Floyd+OR+Handley+OR+Paxson+OR+Kohler)&descflag=on">current list</a>).^J-->^J<!--^Jfrom the ^J<a href="http://search.ietf.org/search/brokers/internet-drafts/query.html">^JInternet-Drafts Search Engine</a>).^J-->^J<li>Papers by ^J<a href="./shenker/papers.html">Scott Shenker</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Scott%20w/2%20Shenker%20or%20S%20w/2%20Shenker&co=Citations">RI</a>),^J^J<a href="./mallman/papers/">Mark Allman</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Mark%20w/2%20Allman%20or%20S%20w/2%20Allman&co=Citations">RI</a>),^J^J<a href="./floyd/papers.html">Sally Floyd</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Sally%20w/2%20Floyd%20or%20S%20w/2%20Floyd&co=Citations">RI</a>),^J^J<a href="./karp/papers.html">Richard Karp</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Richard%20w/2%20Karp%20or%20R%20w/2%20Karp&co=Citations">RI</a>),^J<a href="./kohler/pubs/">Eddie Kohler</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=eddie%20w/2%20kohler%20or%20e%20w/2%20kohler&co=Citations">RI</a>),^J<a href="./vern/papers.html">Vern Paxson</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Vern%20w/2%20Paxson%20or%20V%20w/2%20Paxson&co=Citations">RI</a>).^J<li>The <a href="http://citeseer.ist.psu.edu/">^JResearchIndex</a> (RI) and the ^J<a href="http://citeseer.ist.psu.edu/cs">Search</a>^Jand ^J<a href="http://citeseer.ist.psu.edu/Networking/">^JNetworking</a> pages. ^J</ul>^J^J<h2>^JProjects ^J</h2>^J<ul>^J<li>^J<a href="./vern/bro-info.html">Bro</a>^J(detecting network intruders). ^J<li>The <a href="http://www.isi.edu/newarch/">NewArch</a> Project:^JFuture-Generation Internet Architecture.^J<LI>The <a href="http://www.isi.edu/nsnam/ns/">NS</a>^Jnetwork simulator.^J<li> <a href="./tbit/">TBIT</a>^J(TCP Behavior Identification Tool).^J<li> <a href="http://www.xorp.org/">Xorp</a>^J(Extensible Open Router Platform).^J<li>^J<a href="./funded_projects.html">^JOther Funded Projects</a>.^J<li>^J<a href="./research.html">^JAdditional Research Links</a>.^J</ul>^J^J^J</td>^J^J<td width="35%" valign=top>^J    ^J<h2>Research</h2>^J&nbsp; &nbsp;<b>Transport and Congestion</b>^J<ul>^J<li>^J<a href="./kohler/dcp/">DCCP</a>^J(Datagram Congestion Control Protocol).^J<li>^J<a href="./floyd/ecn.html">ECN</a>^J(Explicit Congestion Notification).^J<li>^J<a href="http://www.ietf.org/html.charters/intserv-charter.html">^JIntegrated services</a>.^J<li>^J<a href="./floyd/red.html">RED</a> ^Jqueue management, and^J<a href="./red-pd/">RED-PD</a>.^J<li>^J<a href="./floyd/hstcp.html">HighSpeed TCP</a>.^J<li>^J<a^Jhref="http://www.ietf.cnri.reston.va.us/html.charters/OLD/tcpimpl-charter.html">^JTCP Implementation</a>.^J<li>^JReordering-Robust TCP ^J(<a href="./bkarp/RR-TCP/">RR-TCP</a>).^J<li>TCP^J<a href="./floyd/sacks.html">SACK</a> ^J(Selective Acknowledgment).^J<li>^J<a href="./tfrc/">TFRC</a> ^J(TCP-Friendly Rate Control).^J</ul>^J^J&nbsp; &nbsp;<b>Traffic and Topology</b>^J<ul>^J<LI>^J<a href="http://idmaps.eecs.umich.edu/">IDMaps</a> ^J(Internet Distance Mapping).^J<LI>The <a href="http://www.acm.org/sigcomm/ITA/">^JInternet Traffic Archive</a>.^J<li>^J<a href="http://www-net.cs.umass.edu/minc/">MINC</a>^J(Multicast-based Inference of Network-internal Characteristics).^J<li>^J<a href="http://www.psc.edu/networking/nimi/">NIMI</a>^J(N")
-Event [xxxxxxxxxx.xxxxxx] http_entity_data([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=9417, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.73563814163208, service={}, addl="%events-send-1", hot=0, history="ShADd"]F938"ational Internet Measurement Infrastructure).^J</ul>^J^J<h2>^J<a href="./collaborators.html">^JCollaborators</a>^J</h2>^J^J<!--^J&nbsp; &nbsp;<b>Multicast and Multimedia</b>^J<ul>^J<LI><A href="/malloc/">MALLOC</a>^J(Multicast Address Allocation).^J<LI><a href="http://www.cs.columbia.edu/~hgs/sip/">SIP</a>^J(Session Initiation Protocol).^J<li> <a href="yoid"> Yoid</a> (host-based content distribution). ^J</ul>^J-->^J^J</td>^J^J</tr>^J</table>^J</DIV>^J^J<hr>^J<h2>Information for <a href="./abouticir.html">visitors</a> and <a href="/sysdocs/">local users</a>.</h2>^J<hr>^JLast modified: June 2004. <a href="./COPYRIGHTS">Copyright notice</a>.^J<a href="http://web.archive.org/web/*/http://www.aciri.org/">^JOlder versions</a> of this web page, in its ACIRI incarnation..^J<BR>^JFor more information about this server, mail <I>www@aciri.org</I>.  ^J<BR>^JTo report <a href="scanning.html">unusual activity</a> by any of our hosts, mail <I>abuse@aciri.org</I>.^J</BODY>^J")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"ACCEPT""*/*")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"CONNECTION""Keep-Alive")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"HOST""www.icir.org")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"USER-AGENT""Wget/1.10")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"ACCEPT-RANGES""bytes")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"CONNECTION""Keep-Alive")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"CONTENT-LENGTH""9130")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"CONTENT-TYPE""text/html")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"DATE""Fri, 07 Oct 2005 23:23:55 GMT")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"ETAG"""2c96c-23aa-4346a0e5"")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"KEEP-ALIVE""timeout=15, max=100")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"LAST-MODIFIED""Fri, 07 Oct 2005 16:23:01 GMT")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"SERVER""Apache/1.3.33 (Unix)")
-Event [xxxxxxxxxx.xxxxxx] http_message_done([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T[start=xxxxxxxxxx.xxxxxx, interrupted=F, finish_msg="message ends normally", body_length=0, content_gap_length=0, header_length=86])
-Event [xxxxxxxxxx.xxxxxx] http_message_done([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=9417, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.73563814163208, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F[start=xxxxxxxxxx.xxxxxx, interrupted=F, finish_msg="message ends normally", body_length=9130, content_gap_length=0, header_length=265])
-Event [xxxxxxxxxx.xxxxxx] http_reply([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1", hot=0, history="ShADd"]"1.1"200"OK")
-Event [xxxxxxxxxx.xxxxxx] http_request([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="", hot=0, history="ShAD"]"GET""/""/""1.0")
-Event [xxxxxxxxxx.xxxxxx] net_done(xxxxxxxxxx.xxxxxx)
-Event [xxxxxxxxxx.xxxxxx] new_connection([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=0, state=0], resp=[size=0, state=0], start_time=xxxxxxxxxx.xxxxxx, duration=0.0, service={}, addl="", hot=0, history=""])
-Event [xxxxxxxxxx.xxxxxx] new_connection([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=0, state=1], resp=[size=0, state=0], start_time=xxxxxxxxxx.xxxxxx, duration=0.0, service={}, addl="cc=1", hot=0, history=""])
-Event [xxxxxxxxxx.xxxxxx] protocol_confirmation([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="", hot=0, history="ShAD"]165)
--- a/testing/istate/base/events-rcv/conn.log
+++ b/testing/istate/base/events-rcv/conn.log
@ -1,2 +0,0 @@
-xxxxxxxxxx.xxxxxx 0.182433 141.42.64.125 125.190.109.199 other 56729 12345 tcp ? ? REJ X
-xxxxxxxxxx.xxxxxx 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X %events-send-1
--- a/testing/istate/base/events-rcv/http.log
+++ b/testing/istate/base/events-rcv/http.log
@ -1,18 +0,0 @@
-xxxxxxxxxx.xxxxxx %events-rcv-1 start 141.42.64.125:56730 > 125.190.109.199:80
-xxxxxxxxxx.xxxxxx %events-rcv-1 > USER-AGENT: Wget/1.10
-xxxxxxxxxx.xxxxxx %events-rcv-1 > ACCEPT: */*
-xxxxxxxxxx.xxxxxx %events-rcv-1 > HOST: www.icir.org
-xxxxxxxxxx.xxxxxx %events-rcv-1 > CONNECTION: Keep-Alive
-xxxxxxxxxx.xxxxxx %events-rcv-1 < DATE: Fri, 07 Oct 2005 23:23:55 GMT
-xxxxxxxxxx.xxxxxx %events-rcv-1 < SERVER: Apache/1.3.33 (Unix)
-xxxxxxxxxx.xxxxxx %events-rcv-1 < LAST-MODIFIED: Fri, 07 Oct 2005 16:23:01 GMT
-xxxxxxxxxx.xxxxxx %events-rcv-1 < ETAG: "2c96c-23aa-4346a0e5"
-xxxxxxxxxx.xxxxxx %events-rcv-1 < ACCEPT-RANGES: bytes
-xxxxxxxxxx.xxxxxx %events-rcv-1 < CONTENT-LENGTH: 9130
-xxxxxxxxxx.xxxxxx %events-rcv-1 < KEEP-ALIVE: timeout=15, max=100
-xxxxxxxxxx.xxxxxx %events-rcv-1 < CONNECTION: Keep-Alive
-xxxxxxxxxx.xxxxxx %events-rcv-1 < CONTENT-TYPE: text/html
-xxxxxxxxxx.xxxxxx %events-rcv-1 <= 4096 bytes: "<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML ..."
-xxxxxxxxxx.xxxxxx %events-rcv-1 <= 4096 bytes: "gn=top>^J^J<h2>^JPublications^J</h2>^J<ul>^J<l..."
-xxxxxxxxxx.xxxxxx %events-rcv-1 <= 938 bytes: "ational Internet Measurement Infrastruct..."
-xxxxxxxxxx.xxxxxx %events-rcv-1 GET / (200 "OK" [9130] www.icir.org)
--- a/testing/istate/base/events-rcv/stderr.log
+++ b/testing/istate/base/events-rcv/stderr.log
@ -1,3 +0,0 @@
-xxxxxxxxxx.xxxxxx processing suspended
-xxxxxxxxxx.xxxxxx processing continued
-xxxxxxxxxx.xxxxxx received termination signal
--- a/testing/istate/base/events-rcv/stdout.log
+++ b/testing/istate/base/events-rcv/stdout.log
--- a/testing/istate/base/events-send/conn.log
+++ b/testing/istate/base/events-send/conn.log
@ -1,3 +0,0 @@
-xxxxxxxxxx.xxxxxx 0.182433 141.42.64.125 125.190.109.199 other 56729 12345 tcp ? ? REJ X
-xxxxxxxxxx.xxxxxx 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X %events-send-1
-xxxxxxxxxx.xxxxxx ? 141.42.64.125 125.190.109.199 http 56730 80 tcp ? ? OTH X
--- a/testing/istate/base/events-send/http.log
+++ b/testing/istate/base/events-send/http.log
@ -1,18 +0,0 @@
-xxxxxxxxxx.xxxxxx %events-send-1 start 141.42.64.125:56730 > 125.190.109.199:80
-xxxxxxxxxx.xxxxxx %events-send-1 > USER-AGENT: Wget/1.10
-xxxxxxxxxx.xxxxxx %events-send-1 > ACCEPT: */*
-xxxxxxxxxx.xxxxxx %events-send-1 > HOST: www.icir.org
-xxxxxxxxxx.xxxxxx %events-send-1 > CONNECTION: Keep-Alive
-xxxxxxxxxx.xxxxxx %events-send-1 < DATE: Fri, 07 Oct 2005 23:23:55 GMT
-xxxxxxxxxx.xxxxxx %events-send-1 < SERVER: Apache/1.3.33 (Unix)
-xxxxxxxxxx.xxxxxx %events-send-1 < LAST-MODIFIED: Fri, 07 Oct 2005 16:23:01 GMT
-xxxxxxxxxx.xxxxxx %events-send-1 < ETAG: "2c96c-23aa-4346a0e5"
-xxxxxxxxxx.xxxxxx %events-send-1 < ACCEPT-RANGES: bytes
-xxxxxxxxxx.xxxxxx %events-send-1 < CONTENT-LENGTH: 9130
-xxxxxxxxxx.xxxxxx %events-send-1 < KEEP-ALIVE: timeout=15, max=100
-xxxxxxxxxx.xxxxxx %events-send-1 < CONNECTION: Keep-Alive
-xxxxxxxxxx.xxxxxx %events-send-1 < CONTENT-TYPE: text/html
-xxxxxxxxxx.xxxxxx %events-send-1 <= 4096 bytes: "<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML ..."
-xxxxxxxxxx.xxxxxx %events-send-1 <= 4096 bytes: "gn=top>^J^J<h2>^JPublications^J</h2>^J<ul>^J<l..."
-xxxxxxxxxx.xxxxxx %events-send-1 <= 938 bytes: "ational Internet Measurement Infrastruct..."
-xxxxxxxxxx.xxxxxx %events-send-1 GET / (200 "OK" [9130] www.icir.org)
--- a/testing/istate/base/events-send/stderr.log
+++ b/testing/istate/base/events-send/stderr.log
--- a/testing/istate/base/events-send/stdout.log
+++ b/testing/istate/base/events-send/stdout.log
--- a/testing/istate/base/persistence-read/stderr.log
+++ b/testing/istate/base/persistence-read/stderr.log
--- a/testing/istate/base/persistence-read/stdout.log
+++ b/testing/istate/base/persistence-read/stdout.log
--- a/testing/istate/base/persistence-read/vars.log
+++ b/testing/istate/base/persistence-read/vars.log
@ -1,33 +0,0 @@
-42
-42
-Hallihallo
-1.2.3.4
-1.2.0.0/16
-3.14
-131.159
-42.0 secs
-{
-[1] = qwerty,
-[2] = uiop
-}
-file "test" of string
-/^?(12345)$?/
-{
-3,
-5,
-4,
-1,
-2
-}
-{
-[2, DEF] = 102,
-[1, ABC] = 101,
-[3, GHI] = 103
-}
-{
-[12345] = /^?(12345)$?/,
-[12346] = /^?(12345)$?/
-}
-42/udp
-[1, 2, 3]
-[a=yuyuyu, b=[a=rec1, b=100, c=1.24], c=[a=rec2, b=200, c=2.24], d=7.77]
--- a/testing/istate/base/persistence-write/stderr.log
+++ b/testing/istate/base/persistence-write/stderr.log
--- a/testing/istate/base/persistence-write/stdout.log
+++ b/testing/istate/base/persistence-write/stdout.log
--- a/testing/istate/base/persistence-write/vars.log
+++ b/testing/istate/base/persistence-write/vars.log
@ -1,33 +0,0 @@
-42
-42
-Hallihallo
-1.2.3.4
-1.2.0.0/16
-3.14
-131.159
-42.0 secs
-{
-[1] = qwerty,
-[2] = uiop
-}
-file "test" of string
-/^?(12345)$?/
-{
-3,
-5,
-4,
-1,
-2
-}
-{
-[2, DEF] = 102,
-[1, ABC] = 101,
-[3, GHI] = 103
-}
-{
-[12345] = /^?(12345)$?/,
-[12346] = /^?(12345)$?/
-}
-42/udp
-[1, 2, 3]
-[a=yuyuyu, b=[a=rec1, b=100, c=1.24], c=[a=rec2, b=200, c=2.24], d=7.77]
--- a/testing/istate/base/python-bro/stdout.log
+++ b/testing/istate/base/python-bro/stdout.log
@ -1,14 +0,0 @@
-==== atomic
-10
-2
-xxxxxxxxxx.xxxxxx
-2.0 mins
-F
-1.5
-Servus
-5555/tcp
-6.7.6.5
-0.0
-192.168.0.0/16
-==== record
-42, 6.6.7.7
--- a/testing/istate/base/python-script/stdout.log
+++ b/testing/istate/base/python-script/stdout.log
@ -1,44 +0,0 @@
-==== atomic a 1 ====
-4 -4
-42 42
-xxxxxxxxxx.xxxxxx xxxxxxxxxx.xxxxxx
-60.0 60.0
-True True
-3.1400000000000001 3.14
-'Hurz' Hurz
-'12345/udp' 12345/udp
-'1.2.3.4' 1.2.3.4
-'X.X.X' X.X.X
-'X.X.X' 22.33.44.0/24
-==== atomic a 2 ====
-10 -10
-2 2
-xxxxxxxxxx.xxxxxx xxxxxxxxxx.xxxxxx
-120.0 120.0
-False False
-1.5 1.5
-'Servus' Servus
-'5555/tcp' 5555/tcp
-'6.7.6.5' 6.7.6.5
-'X.X.X' X.X.X
-'X.X.X' 192.168.0.0/16
-==== atomic b 2 ====
-10 -10
-<broccoli.count instance at > 2
-<broccoli.time instance at > xxxxxxxxxx.xxxxxx
-<broccoli.interval instance at > 120.0
-False False
-1.5 1.5
-'Servus' Servus
-<broccoli.port instance at > 5555/tcp
-<broccoli.addr instance at > 6.7.6.5
-<broccoli.net instance at > X.X.X
-<broccoli.net instance at > 192.168.0.0/16
-==== record 1 ====
-<broccoli.record instance at >
-42 42
-'6.6.7.7' 6.6.7.7
-==== record 2 ====
-<broccoli.record instance at >
-99 99
-'3.4.5.1' 3.4.5.1
--- a/testing/istate/base/sync-rcv/remote.log
+++ b/testing/istate/base/sync-rcv/remote.log
@ -1,21 +0,0 @@
-xxxxxxxxxx.xxxxxx [info]  [parent] raised pipe's socket buffer size from 126K to 1024K
-xxxxxxxxxx.xxxxxx [info]  [parent] communication started, parent 
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] added peer
-xxxxxxxxxx.xxxxxx [info]  [child]  [#1/127.0.0.1:47757] connected
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] peer connected
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] phase: version
-xxxxxxxxxx.xxxxxx [info]  [script] [#1/127.0.0.1:47757] connection established
-xxxxxxxxxx.xxxxxx [info]  [script] [#1/127.0.0.1:47757] requesting events matching /^?(.*)$?/
-xxxxxxxxxx.xxxxxx [info]  [script] [#1/127.0.0.1:47757] accepting state
-xxxxxxxxxx.xxxxxx [info]  [script] [#1/127.0.0.1:47757] requesting synchronized state
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] phase: handshake
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] peer_description is not set
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] peer supports keep-in-cache; using that
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] phase: sync (sender)
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] starting to send full state
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] done sending full state
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] phase: running
-xxxxxxxxxx.xxxxxx [info]  [script] [#1/127.0.0.1:47757] connection closed
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] peer disconnected
-xxxxxxxxxx.xxxxxx [info]  [child]  [#1/127.0.0.1:47757] connection closed
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] closing connection
--- a/testing/istate/base/sync-rcv/stderr.log
+++ b/testing/istate/base/sync-rcv/stderr.log
@ -1 +0,0 @@
-xxxxxxxxxx.xxxxxx received termination signal
--- a/testing/istate/base/sync-rcv/stdout.log
+++ b/testing/istate/base/sync-rcv/stdout.log
--- a/testing/istate/base/sync-rcv/vars.log
+++ b/testing/istate/base/sync-rcv/vars.log
@ -1,34 +0,0 @@
-421
-1234567
-Jodel
-4.3.2.1
-4.0.0.0/8
-21.0
-192.150.186
-42.0 secs
-{
-[3] = asdfg1,
-[1] = asdfg2
-}
-file "test2" of string
-/^?(abbcdefgh)$?/
-{
-3,
-5,
-6,
-4,
-2
-}
-{
-[4, JKL] = 104,
-[2, DEF] = 103,
-[3, GHI] = 103
-}
-{
-[12345] = /^?(12345)$?/,
-[6767] = /^?(QWERTZ)$?/,
-[12346] = /^?(12345)$?/
-}
-6667/tcp
-[2, 20, 3, 4]
-[a=zxzxzx, b=[a=pop, b=43, c=9.999], c=[a=IOIOI, b=201, c=612.2], d=6.6666]
--- a/testing/istate/base/sync-send/stderr.log
+++ b/testing/istate/base/sync-send/stderr.log
@ -1,2 +0,0 @@
-xxxxxxxxxx.xxxxxx processing suspended
-xxxxxxxxxx.xxxxxx processing continued
--- a/testing/istate/base/sync-send/stdout.log
+++ b/testing/istate/base/sync-send/stdout.log
--- a/testing/istate/base/sync-send/vars.log
+++ b/testing/istate/base/sync-send/vars.log
@ -1,34 +0,0 @@
-421
-1234567
-Jodel
-4.3.2.1
-4.0.0.0/8
-21.0
-192.150.186
-42.0 secs
-{
-[3] = asdfg1,
-[1] = asdfg2
-}
-file "test2" of string
-/^?(abbcdefgh)$?/
-{
-3,
-5,
-6,
-4,
-2
-}
-{
-[4, JKL] = 104,
-[2, DEF] = 103,
-[3, GHI] = 103
-}
-{
-[12345] = /^?(12345)$?/,
-[6767] = /^?(QWERTZ)$?/,
-[12346] = /^?(12345)$?/
-}
-6667/tcp
-[2, 20, 3, 4]
-[a=zxzxzx, b=[a=pop, b=43, c=9.999], c=[a=IOIOI, b=201, c=612.2], d=6.6666]
--- a/testing/istate/istate.py
+++ b/testing/istate/istate.py
@ -1,174 +0,0 @@
-#! /usr/bin/env python
-#
-# Tests persistence.
-#
-# $Id: istate.py,v 1.1.2.4 2005/10/11 22:31:42 sommer Exp $
-
-import time
-import os
-import os.path
-import optparse
-import sys
-import subprocess
-
-import tests
-
-optparser = optparse.OptionParser( usage = "%prog [options]", version = "0.1" )
-optparser.add_option( "-s", "--show-diff", action = "store_true", dest = "showdiff",
-                    default = False, help = "show diffs of mismatches" )
-optparser.add_option( "-b", "--new-base", action = "store_true", dest = "newbase",
-                    default = False, help = "create new baseline" )
-optparser.add_option( "-d", "--debug", action = "store_true", dest = "debug",
-                    default = False, help = "enable debug output" )
-optparser.add_option( "-t", "--set", action = "store", type = "string", dest = "set",
-                    default = None, help = "only do given test set" )
-
-
-( tests.Options, args ) = optparser.parse_args()
-
-if len(args) != 0:
-    optparser.error( "Wrong number of arguments" )
-
-##########################################
-# Write persistent data and read it back.
-##########################################
-
-if tests.testSet("persistence"):
-
-    tests.spawnBro("persistence-write",
-               ["-r", os.path.join(tests.Traces, "empty.trace"),
-                os.path.join(tests.Scripts, "vars-init.bro"),
-                os.path.join(tests.Scripts, "vars-print.bro")])
-    tests.waitProc("persistence-write")
-    tests.finishTest("persistence-write", ["stdout.log", "stderr.log", "vars.log"])
-
-    tests.spawnBro("persistence-read",
-               [os.path.join(tests.Scripts, "vars-declare.bro"),
-                os.path.join(tests.Scripts, "vars-print.bro")],
-                copy=[os.path.join(tests.workDir("persistence-write"), ".state")])
-    tests.waitProc("persistence-read")
-    tests.finishTest("persistence-read", ["stdout.log", "stderr.log", "vars.log"])
-
-    tests.compareFiles("persistence-write", "persistence-read", ["vars.log"])
-
-##########################################
-# Exchange events (clear-text).
-#
-# The used trace contains two connections separated by a silence of a
-# couple of seconds. We start the processes so that the events for the
-# *second* one (which is a full HTTP connection) are exchanged.
-##########################################
-
-if tests.testSet("events"):
-
-    tests.spawnBro("events-send",
-               ["-r", os.path.join(tests.Scripts, os.path.join(tests.Traces, "web.trace")),
-                "--pseudo-realtime",
-                "-C",
-               os.path.join(tests.Scripts, "events-send.bro")])
-    time.sleep(2)
-    tests.spawnBro("events-rcv",
-               [os.path.join(tests.Scripts, "events-rcv.bro")])
-    tests.waitProc("events-send")
-    tests.killProc("events-rcv")
-    tests.finishTest("events-send", ["stdout.log", "stderr.log", "http.log", "conn.log"], ignoreTime=True)
-    tests.finishTest("events-rcv", ["stdout.log", "stderr.log", "http.log", "conn.log"], ignoreTime=True)
-
-    tests.spawnBro("events-display",
-               ["-x", os.path.join(tests.workDir("events-rcv"), "events.bst")])
-    tests.waitProc("events-display")
-    tests.finishTest("events-display", ["stdout.log"], ignoreTime=True, sort=True, delete=['127.0.0.1:[0-9]*',"Event.*remote_.*"])
-
-    tests.compareFiles("events-send", "events-rcv", ["http.log"], ignoreTime=True, ignoreSessionID=True)
-
-##########################################
-# Exchange synchronized state
-##########################################
-
-if tests.testSet("sync"):
-
-    tests.spawnBro("sync-send",
-               [os.path.join(tests.Scripts, "vars-sync-send.bro")])
-    tests.spawnBro("sync-rcv",
-               [os.path.join(tests.Scripts, "vars-sync-rcv.bro")])
-    tests.waitProc("sync-send")
-    time.sleep(1)
-    tests.killProc("sync-rcv")
-    tests.finishTest("sync-send", ["stdout.log", "stderr.log", "vars.log"], ignoreTime=True)
-    tests.finishTest("sync-rcv", ["stdout.log", "stderr.log", "vars.log", "remote.log"], ignoreTime=True, delete=["pid.*pid.*", "temporarily unavailable \\[..\\]"])
-
-    tests.compareFiles("sync-send", "sync-rcv", ["vars.log"], ignoreTime=True)
-
-# Old version
-#    tests.spawnBro("sync-send",
-#               ["-r", os.path.join(tests.Scripts, os.path.join(tests.Traces, "web.trace")),
-#       	        "--pseudo-realtime",
-#                "-C",
-#               os.path.join(tests.Scripts, "vars-sync-send.bro")])
-
-##########################################
-# Test Broccoli with bro-ping
-##########################################
-
-
-if tests.testSet("broccoli"):
-
-    broctest = os.path.join(tests.BroBase, "aux/broccoli/test")
-    broclib = os.path.join(tests.BroBase, "build/aux/broccoli/src/")
-    broping = os.path.join(tests.BroBase, "build/aux/broccoli/test/broping")
-
-    brocpy = os.path.join(tests.BroBase, "build/aux/broccoli/bindings/broccoli-python")
-
-    broccoli = True
-
-    # Test if Broccoli was compiled.
-    if not os.path.exists(broping):
-        print "    Broccoli was not compiled, skipping tests."
-        broccoli = False
-
-    # Test if this is a IPv6 Bro.
-    if broccoli:
-        v6 = subprocess.call(["grep", "-q", "#define BROv6", os.path.join(tests.BroBase, "build/config.h")])
-        if v6 == 0:
-            print "    Bro built with IPv6 support not compatible with Broccoli, skipping tests."
-            broccoli = False
-
-    if broccoli:
-        tests.spawnBro("bro-ping", [os.path.join(broctest, "broping-record.bro")])
-        time.sleep(1)
-        tests.spawnProc("broccoli-ping",
-                        [broping,
-                        "-r",
-                        "-c", "5",
-                        "127.0.0.1"])
-        tests.waitProc("broccoli-ping")
-        tests.killProc("bro-ping")
-
-        tests.finishTest("bro-ping", ["stdout.log", "stderr.log", "remote.log"],
-                         ignoreTime=True, delete=["127.0.0.1:[0-9]*", "pid.*pid.*",
-                         ".*Resource temporarily unavailable.*", ".*connection closed.*",
-                         ".*peer disconnected.*"])
-        tests.finishTest("broccoli-ping", ["stdout.log", "stderr.log"],
-                         delete=["time=.* s$"])
-
-        # Test if Python binding are installed.
-        sopath = subprocess.Popen(["find", brocpy, "-name", "_broccoli_intern.so"], stdout=subprocess.PIPE).communicate()[0]
-        if sopath != "":
-
-            os.environ["LD_LIBRARY_PATH"] = broclib
-            os.environ["DYLD_LIBRARY_PATH"] = broclib
-            os.environ["PYTHONPATH"] = os.path.dirname(sopath)
-
-            tests.spawnBro("python-bro", [os.path.join(brocpy, "tests/test.bro")])
-            time.sleep(1)
-            tests.spawnProc("python-script", [os.path.join(brocpy, "tests/test.py")])
-            tests.waitProc("python-script")
-            tests.killProc("python-bro")
-            tests.finishTest("python-bro", ["stdout.log"], ignoreTime=True)
-            tests.finishTest("python-script", ["stdout.log"], ignoreTime=True, delete=["0x[^>]*", ".[0-9]{2}"])
-        else:
-            print "    Python bindings not built, skipping test."
-            print "       (To build: cd %s && python setup.py build)" % brocpy
-
-
-
--- a/testing/istate/rndseed.dat
+++ b/testing/istate/rndseed.dat
@ -1,17 +0,0 @@
-1971283154
-1128552575
-26676
-875311974
-790730425
-1553617948
-3593004090
-2070230499
-1420669195
-754343139
-2906181924
-542878596
-2459738795
-924396623
-743111462
-3363354015
-198575356
--- a/testing/istate/scripts/events-rcv.bro
+++ b/testing/istate/scripts/events-rcv.bro
@ -1,18 +0,0 @@
-# $Id: events-rcv.bro,v 1.1.2.1 2005/10/07 01:59:12 sommer Exp $
-
-@load tcp
-@load http-request
-@load http-reply
-@load http-header
-@load http-body
-@load http-abstract
-	
-@load capture-events	
-@load remote
-	
-redef peer_description = "events-rcv";
-	
-redef Remote::destinations += {
-    ["foo"] = [$host = 127.0.0.1, $events = /.*/, $connect=T]
-};
-
--- a/testing/istate/scripts/events-send.bro
+++ b/testing/istate/scripts/events-send.bro
@ -1,21 +0,0 @@
-# $Id: events-send.bro,v 1.1.2.1 2005/10/07 01:59:12 sommer Exp $
-
-@load tcp
-@load http-request
-@load http-reply
-@load http-header
-@load http-body
-@load http-abstract
-@load listen-clear
-	
-@load capture-events	
-	
-redef peer_description = "events-send";
-
-# Make sure the HTTP connection really gets out.
-# (We still miss one final connection event because we shutdown before
-# it gets propagated but that's ok.)
-redef tcp_close_delay = 0secs;
-
-	
-	
--- a/testing/istate/scripts/vars-declare.bro
+++ b/testing/istate/scripts/vars-declare.bro
@ -1,36 +0,0 @@
-# $Id: vars-declare.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
-#
-# Declares variables.
-
-global foo1: count &persistent &synchronized;
-global foo2: int &persistent &synchronized;
-global foo3: string &persistent &synchronized; 
-global foo4: addr &persistent &synchronized; 
-global foo5: subnet &persistent &synchronized; 
-global foo6: double &persistent &synchronized; 
-global foo7: net &persistent &synchronized; 
-global foo8: interval &persistent &synchronized; 
-global foo9: table[count] of string &persistent &synchronized;
-global foo10: file &persistent &synchronized; 
-global foo11: pattern &persistent &synchronized; 
-global foo12: set[count] &persistent &synchronized; 
-global foo13: table[count, string] of count &persistent &synchronized;
-global foo14: table[count] of pattern &persistent &synchronized;
-global foo15: port &persistent &synchronized;
-global foo16: vector of count &persistent &synchronized;
-
-type type1: record {
-    a: string;
-    b: count &default=42;
-    c: double &optional;
-    };
-
-type type2: record {
-    a: string;
-    b: type1;
-    c: type1;
-    d: double;
-    };
-
-global foo17: type2  &persistent &synchronized;
-
--- a/testing/istate/scripts/vars-init.bro
+++ b/testing/istate/scripts/vars-init.bro
@ -1,42 +0,0 @@
-# $Id: vars-init.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
-# 
-# Instantiates variables.
-
-global foo1 = 42 &persistent &synchronized;
-global foo2 = -42 &persistent &synchronized;
-global foo3 = "Hallihallo" &persistent &synchronized; 
-global foo4 = 1.2.3.4 &persistent &synchronized; 
-global foo5 = 1.2.0.0/16 &persistent &synchronized; 
-global foo6 = 3.14 &persistent &synchronized; 
-global foo7 = 131.159. &persistent &synchronized; 
-global foo8 = 42 secs &persistent &synchronized; 
-global foo9 = { [1] = "qwerty", [2] = "uiop" } &persistent &synchronized;
-global foo10 = open("test") &persistent &synchronized; 
-global foo11 = /12345/ &persistent &synchronized; 
-global foo12 = { 1,2,3,4,5 } &persistent &synchronized; 
-global foo13  =  { [1,"ABC"] = 101, [2,"DEF"] = 102, [3,"GHI"] = 103 } &persistent &synchronized;
-global foo14  =  { [12345] = foo11, [12346] = foo11 } &persistent &synchronized;
-global foo15 = 42/udp &persistent &synchronized;
-global foo16: vector of count = [1,2,3] &persistent &synchronized;
- 
-type type1: record {
-    a: string;
-    b: count &default=42;
-    c: double &optional;
-    };
-
-type type2: record {
-    a: string;
-    b: type1;
-    c: type1;
-    d: double;
-    };
-
-global foo17: type2 = [
-	$a = "yuyuyu",
-    $b = [$a="rec1", $b=100, $c=1.24],
-    $c = [$a="rec2", $b=200, $c=2.24],
-   	$d = 7.77				   
-	] &persistent &synchronized;
-
-
--- a/testing/istate/scripts/vars-modify.bro
+++ b/testing/istate/scripts/vars-modify.bro
@ -1,61 +0,0 @@
-# $Id: vars-modify.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
-#
-# Performs modifications on variables.
-
-function modify()
-	{
-	foo1 = 420;
-	++foo1;
-	
-	--foo2;
-	
-	foo3 = "Jodel";
-	
-	foo4 = 4.3.2.1; 
-	
-	foo5 = 4.0.0.0/8; 
-	
-	foo6 = 21;
-	
-	foo7 = 192.150.186; 
-	
-	foo9[3] = "asdfg1";
-	foo9[1] = "asdfg2";
-	delete foo9[2];
-	
-	foo10 = open("test2");
-	
-	foo11 = /abbcdefgh/;
-	
-	add foo12[6];
-	delete foo12[1];
-	
-	foo13[4,"JKL"] = 104;
-	delete foo13[1,"ABC"];
-	++foo13[2,"DEF"];
-	
-	foo14[6767] = /QWERTZ/;
-	
-	foo15 = 6667/tcp;
-	
-	foo16[4] = 4;
-	foo16[2] = 20;
-	++foo16[1];
-	
-	local x: type1;
-	x$a = "pop";
-	++x$b;
-	x$c = 9.999;
-	foo17$a = "zxzxzx";
-	foo17$b = x;
-	foo17$c$a = "IOIOI";
-	++foo17$c$b;
-	foo17$c$c = 612.2;
-	foo17$d = 6.6666;
-	
-	foo2 = 1234567;
-	}
-
-
-
-
--- a/testing/istate/scripts/vars-print.bro
+++ b/testing/istate/scripts/vars-print.bro
@ -1,29 +0,0 @@
-# $Id: vars-print.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
-#
-# Print variables.
-
-event bro_done()
-	{
-	local out = open("vars.log");
-	print out, foo1;
-	print out, foo2;
-	print out, foo3;
-	print out, foo4;
-	print out, foo5;
-	print out, foo6;
-	print out, foo7;
-	print out, foo8;
-	print out, foo9;
-	print out, foo10;
-	print out, foo11;
-	print out, foo12;
-	print out, foo13;
-	print out, foo14;
-	print out, foo15;
-	print out, foo16;
-	print out, foo17;
-	}
-
-	
-	
-	
--- a/testing/istate/scripts/vars-sync-rcv.bro
+++ b/testing/istate/scripts/vars-sync-rcv.bro
@ -1,13 +0,0 @@
-# $Id: vars-sync-rcv.bro,v 1.1.2.1 2005/10/11 21:15:05 sommer Exp $
-
-@load vars-init
-@load vars-print
-
-@load capture-events	
-@load remote
-
-	
-redef Remote::destinations += {
-    ["foo"] = [$host = 127.0.0.1, $events = /.*/, $connect=T, $sync=T]
-};
-
--- a/testing/istate/scripts/vars-sync-send.bro
+++ b/testing/istate/scripts/vars-sync-send.bro
@ -1,20 +0,0 @@
-# $Id: vars-sync-send.bro,v 1.1.2.1 2005/10/11 21:15:05 sommer Exp $
-#
-
-@load vars-init
-@load vars-print
-@load vars-modify
-
-@load listen-clear
-
-event remote_connection_handshake_done(p: event_peer)
-	{
-	modify();
-	terminate_communication();
-	}
-			 
-redef Remote::destinations += {
-    ["foo"] = [$host = 127.0.0.1, $sync=T]
-};
-
-	
--- a/testing/istate/tests.py
+++ b/testing/istate/tests.py
@ -1,300 +0,0 @@
-# $Id: tests.py,v 1.1.2.5 2005/10/11 22:31:42 sommer Exp $
-#
-# Various helper functions.
-
-import sys
-import os
-import copy
-import errno
-import signal
-import subprocess
-
-# Path to our files.
-Testing = os.path.abspath(".")
-
-# Path to top-level Bro directory.
-if os.path.exists("../../build/src/bro"):
-    BroBase = os.path.abspath("../..")
-else:
-    error("cannot find build directory")
-
-# Path where tmp files are created.
-Tmp = os.path.join(Testing, "tmp")
-
-# Path to seed file.
-BroSeed = os.path.join(Testing, "rndseed.dat")
-
-# Path to our test scripts.
-Scripts = os.path.join(Testing, "scripts")
-
-# Path to our test traces.
-Traces = os.path.join(Testing, "traces")
-
-# Where the base files to compare against are stored.
-Base = os.path.join(os.getcwd(), "./base")
-
-# Process ID of all processes we've spawned, indexed by textual tag *and* pid.
-Running = {}
-
-# Set to true when at least one check failed.
-Failed = False
-
-# getopt options
-Options = None
-
-def error(str):
-    print >>sys.stderr, "Error:", str
-    sys.exit(1)
-
-def debug(str):
-    if Options.debug:
-        print >>sys.stderr, "Debug:", str
-
-def log(str):
-    print >>sys.stderr, str
-
-# Returns full path of given process' working directory.
-def workDir(tag):
-    return os.path.join(Tmp, tag)
-
-# Intializes work dir for given process.
-def initWorkDir(tag):
-
-    try:
-        os.mkdir(Tmp)
-    except OSError, e:
-        if e.errno != errno.EEXIST:
-            raise
-
-    os.system("rm -rf " + workDir(tag))
-    os.mkdir(workDir(tag))
-
-# Spawns process identified by the given tag. Enters process into RunningBro.
-def spawnProc(tag, cmdline, copy=[]):
-    initWorkDir(tag)
-    os.chdir(workDir(tag))
-
-    for i in copy:
-        debug("Copying %s into workdir of %s" % (i, tag))
-        os.system("cp -r %s %s" % (i, workDir(tag)))
-
-    debug("Spawning '%s' as %s" % (" ".join(cmdline), tag))
-
-    saved_stdin = os.dup(0)
-    saved_stdout = os.dup(1)
-    saved_stderr = os.dup(2)
-    child_stdin = open("/dev/null", "r")
-    child_stdout = open("stdout.log", "w")
-    child_stderr = open("stderr.log", "w")
-    os.dup2(child_stdin.fileno(), 0)
-    os.dup2(child_stdout.fileno(), 1)
-    os.dup2(child_stderr.fileno(), 2)
-    pid = os.spawnvp(os.P_NOWAIT, cmdline[0], cmdline)
-    os.dup2(saved_stdin, 0)
-    os.dup2(saved_stdout, 1)
-    os.dup2(saved_stderr, 2)
-
-    Running[tag] = pid
-    Running[pid] = tag
-
-# Spaws a Bro process.
-def spawnBro(tag, args, copy=[]):
-    bropath =  os.path.join(BroBase, "policy")
-    bropath += ":" + os.path.join(BroBase, "build/src")
-
-    os.putenv("BROPATH", bropath + ":" + Scripts)
-    os.unsetenv("BRO_LOG_SUFFIX")
-    args += ["--load-seeds", BroSeed, "-B", "state,comm"]
-    spawnProc(tag, [os.path.join(BroBase, "build/src/bro")] + args, copy=copy)
-
-# Examines a process' exit code.
-def parseExitCode(tag, result):
-    if os.WCOREDUMP(result):
-        error("process %s core dumped." % tag)
-
-    if os.WIFSIGNALED(result):
-        error("process %s got signal %d." % (tag, os.WTERMSIG(result)))
-
-    if not os.WIFEXITED(result):
-        error("process %s exited abnormally (%d)." % (tag, result))
-
-    result = os.WEXITSTATUS(result)
-    debug("process %s exited with %d" % (tag, result))
-
-    return result
-
-# Waits for process to finish.
-def waitProc(tag):
-    (pid, result) = os.waitpid(Running[tag], 0)
-    result = parseExitCode(tag, result)
-    if result != 0:
-	error("Execution of %s failed." % tag)
-
-    del Running[pid]
-    del Running[tag]
-
-# Waits for all of our processes to terminte.
-def waitProcs():
-    while Running:
-        (pid, result) = os.waitpid(0, 0)
-        parseExitCode(Running[pid], result)
-        del Running[Running[pid]]
-        del Running[pid]
-
-# Kills the process and waits for its termination.
-def killProc(tag):
-    pid = Running[tag]
-    debug("Killing %s..." % tag)
-    os.kill(pid, signal.SIGTERM)
-    (pid, result) = os.waitpid(pid, 0)
-    parseExitCode(tag, result)
-    del Running[pid]
-    del Running[tag]
-
-# Cleans up temporary stuff
-def cleanup():
-    os.system("rm -rf " + Tmp)
-
-# Canonicalizes file content for diffing.
-def canonicalizeFile(file, ignoreTime, ignoreSessionID, sort, delete):
-
-    cmd = []
-
-    if delete:
-        for i in delete:
-            cmd += ["sed 's/%s//g' | grep -v '^$'" % i]
-
-    if ignoreTime:
-        cmd += ["sed 's/[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]\.[0-9][0-9]\{0,6\}/xxxxxxxxxx.xxxxxx/g'"]
-
-    if ignoreSessionID:
-        # A session is either "%1" or "%my-peer-description-1"
-        cmd += ["sed 's/%\([^ ]*-\)\{0,1\}[0-9][0-9]*/%XXX/g'"]
-
-    if sort:
-        cmd += ["LC_ALL=c sort"]
-
-    if not cmd:
-        return
-
-    tmp = file + ".tmp"
-    cmd = "cat %s | %s >%s" % (file, " | ".join(cmd), tmp)
-
-    debug("Canonicalizing '%s'" % cmd)
-    os.system(cmd)
-    os.system("mv %s %s" % (tmp, file))
-
-# Diffs the two files, If mismatch, prints "FAILED" and returns true.
-def diff(file1, file2):
-
-    quiet = ">/dev/null"
-    if Options.showdiff:
-        quiet = ""
-
-    for f in (file1, file2):
-        if not os.path.exists(f):
-            print "FAILED (%s does not exist)" % f
-            return False
-
-    diff = "diff -u %s %s %s" % (file1, file2, quiet)
-
-    debug("Executing '%s'" % diff)
-    result = os.system(diff)
-
-    if os.WEXITSTATUS(result) != 0:
-        print "FAILED"
-        return False
-
-    return True
-
-# Compares files of process against base version. Returns false if mismatch found.
-def checkFiles(tag, files, ignoreTime, sort, delete):
-    base = os.path.join(Base, tag)
-    work = workDir(tag)
-
-    print "    Checking %s..." % tag,
-
-    failed = False
-
-    for file in files:
-        oldfile = os.path.join(base, file)
-        newfile = os.path.join(work, file)
-
-        canonicalizeFile(newfile, ignoreTime, False, sort, delete)
-
-        if not diff(oldfile, newfile):
-            failed = True
-            break
-
-    if not failed:
-        print "ok"
-    else:
-        Failed = failed
-
-# Compares files of two processes. Return false if mismatch found.
-def compareFiles(tag1, tag2, files, ignoreTime=False, ignoreSessionID=False, sort=False, delete=None):
-    work1 = workDir(tag1)
-    work2 = workDir(tag2)
-
-    print "    Comparing %s with %s..." % (tag1, tag2),
-
-    failed = False
-
-    for file in files:
-        file1 = os.path.join(work1, file)
-        file2 = os.path.join(work2, file)
-
-        canonicalizeFile(file1, ignoreTime, ignoreSessionID, sort, delete)
-        canonicalizeFile(file2, ignoreTime, ignoreSessionID, sort, delete)
-
-        if not diff(file1, file2):
-            failed = True
-            break
-
-    if not failed:
-        print "ok"
-    else:
-        Failed = failed
-
-# Make the result of process new baseline.
-def makeNewBase(tag, files, ignoreTime, sort, delete):
-
-    try:
-        os.mkdir(Base)
-    except OSError, e:
-        if e.errno != errno.EEXIST:
-            raise
-
-    base = os.path.join(Base, tag)
-    work = workDir(tag)
-
-    print "    Copying files for %s..." % tag
-
-    try:
-        os.mkdir(base)
-    except OSError, e:
-        if e.errno != errno.EEXIST:
-            raise
-
-    # Delete all files but those belonging to CVS.
-    os.system("find %s -type f -not -path '*/CVS/*' -not -path '*/.svn/*' -exec rm '{}' ';'" % base)
-
-    for file in files:
-        oldfile = os.path.join(work, file)
-        newfile = os.path.join(base, file)
-	os.system("cp %s %s" % (oldfile, newfile))
-        canonicalizeFile(newfile, ignoreTime, False, sort, delete)
-
-def testSet(set):
-    if Options.set and set != Options.set:
-        return False
-
-    print "Running set '%s' ..." % set
-    return True
-
-# Either check given files or make it new baseline, depending on options.
-def finishTest(tag, files, ignoreTime=False, sort=False, delete=None):
-    if Options.newbase:
-	makeNewBase(tag, files, ignoreTime, sort, delete)
-    else:
-	checkFiles(tag, files, ignoreTime, sort, delete)
--- a/testing/istate/traces/empty.trace
+++ b/testing/istate/traces/empty.trace
--- a/testing/istate/traces/web.trace
+++ b/testing/istate/traces/web.trace
				`@ -0,0 +1 @@`
				`1128727435.450898 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X`
				`@ -0,0 +1 @@`
				`1106953531.452525 DroppedPackets 2 packets dropped after filtering, 1109 received, 10000 on link`
				`@ -1 +0,0 @@`
				`xxxxxxxxxx.xxxxxx received termination signal`