mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 14:08:20 +00:00
Merge remote-tracking branch 'origin/master' into topic/vladg/file-analysis-exe-analyzer
This commit is contained in:
Vlad Grigorescu
commit
da89837693
70 changed files with 1550 additions and 377 deletions
121
CHANGES
121
CHANGES
|
|
@ -1,4 +1,125 @@
|
||||||
|
|
||||||
|
2.3-720 | 2015-04-17 14:18:26 -0700
|
||||||
|
|
||||||
|
* Updating NEWS.
|
||||||
|
|
||||||
|
2.3-716 | 2015-04-17 13:06:37 -0700
|
||||||
|
|
||||||
|
* Add seeking functionality to raw reader. One can now add an option
|
||||||
|
"offset" to the config map. Positive offsets are interpreted to be
|
||||||
|
from the beginning of the file, negative from the end of the file
|
||||||
|
(-1 is end of file). Only works for raw reader in streaming or
|
||||||
|
manual mode. Does not work with executables. Addresses BIT-985.
|
||||||
|
(Johanna Amann)
|
||||||
|
|
||||||
|
* Allow setting packet and byte thresholds for connections. (Johanna Amann)
|
||||||
|
|
||||||
|
This extends the ConnSize analyzer to be able to raise events when
|
||||||
|
each direction of a connection crosses a certain amount of bytes
|
||||||
|
or packets.
|
||||||
|
|
||||||
|
Thresholds are set using:
|
||||||
|
- set_conn_bytes_threshold(c$id, [num-bytes], [direction]);
|
||||||
|
- set_conn_packets_threshold(c$id, [num-packets], [direction]);
|
||||||
|
|
||||||
|
They raise the events, respectively:
|
||||||
|
- event conn_bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
|
||||||
|
- event conn_packets_threshold_crossed(c: connection, threshold: count, is_orig: bool)
|
||||||
|
|
||||||
|
Current thresholds can be examined using get_conn_bytes_threshold()
|
||||||
|
and get_conn_packets_threshold().
|
||||||
|
|
||||||
|
Only one threshold can be set per connection.
|
||||||
|
|
||||||
|
* Add high-level API for packet/bytes thresholding in
|
||||||
|
base/protocols/conn/thresholds.bro that holds lists of thresholds
|
||||||
|
and raises an event for each threshold exactly once. (Johanna
|
||||||
|
Amann)
|
||||||
|
|
||||||
|
* Fix a bug where child packet analyzers of the TCP analyzer
|
||||||
|
where not found using FindChild.
|
||||||
|
|
||||||
|
* Update GridFTP analyzer to use connection thresholding instead of
|
||||||
|
polling. (Johanna Amann)
|
||||||
|
|
||||||
|
2.3-709 | 2015-04-17 12:37:32 -0700
|
||||||
|
|
||||||
|
* Fix addressing the dreaded "internal error: unknown msg type 115
|
||||||
|
in Poll()". (Jon Siwek)
|
||||||
|
|
||||||
|
This patch removes the error handling code for overload conditions
|
||||||
|
in the main process that could cause trouble down the road. The
|
||||||
|
"chunked_io_buffer_soft_cap" script variable can now tune when the
|
||||||
|
client process begins shutting down peer connections, and the
|
||||||
|
default setting is now double what it used to be. Addresses
|
||||||
|
BIT-1376.
|
||||||
|
|
||||||
|
2.3-707 | 2015-04-17 10:57:59 -0500
|
||||||
|
|
||||||
|
* Add more info about Broker to NEWS. (Jon Siwek)
|
||||||
|
|
||||||
|
2.3-705 | 2015-04-16 08:16:45 -0700
|
||||||
|
|
||||||
|
* Update Mozilla CA list. (Johanna Amann)
|
||||||
|
|
||||||
|
* Update tests to have them keep using older certificates where
|
||||||
|
appropiate. (Johanna Amann)
|
||||||
|
|
||||||
|
2.3-699 | 2015-04-16 09:51:58 -0500
|
||||||
|
|
||||||
|
* Fix the to_count function to use strtoull versus strtoll.
|
||||||
|
(Jon Siwek)
|
||||||
|
|
||||||
|
2.3-697 | 2015-04-15 09:51:15 -0700
|
||||||
|
|
||||||
|
* Removing error check verifying that an ASCII writer has been
|
||||||
|
properly finished. Instead of aborting, we now just clean up in
|
||||||
|
that case and proceed. Addresses BIT-1331. (Robin Sommer)
|
||||||
|
|
||||||
|
2.3-696 | 2015-04-14 15:56:36 -0700
|
||||||
|
|
||||||
|
* Update sqlite to 3.8.9
|
||||||
|
|
||||||
|
2.3-695 | 2015-04-13 10:34:42 -0500
|
||||||
|
|
||||||
|
* Fix iterator invalidation in broker::Manager dtor. (Jon Siwek)
|
||||||
|
|
||||||
|
* Add paragraph to plugin documentation. (Robin Sommer)
|
||||||
|
|
||||||
|
2.3-693 | 2015-04-11 10:56:31 -0700
|
||||||
|
|
||||||
|
* BIT-1367: improve coercion of anonymous records in set constructor.
|
||||||
|
(Jon Siwek)
|
||||||
|
|
||||||
|
* Allow to specify ports for sftp log rotator. (Johanna Amann)
|
||||||
|
|
||||||
|
2.3-690 | 2015-04-10 21:51:10 -0700
|
||||||
|
|
||||||
|
* Make sure to always delete the remote serializer. Addresses
|
||||||
|
BIT-1306 and probably also BIT-1356. (Robin Sommer)
|
||||||
|
|
||||||
|
* Cleaning up --help. -D and -Y/y were still listed, even though
|
||||||
|
they had no effect anymore. Removing some dead code along with -D.
|
||||||
|
Addresses BIT-1372. (Robin Sommer)
|
||||||
|
|
||||||
|
2.3-688 | 2015-04-10 08:10:44 -0700
|
||||||
|
|
||||||
|
* Update SQLite to 3.8.8.3.
|
||||||
|
|
||||||
|
2.3-687 | 2015-04-10 07:32:52 -0700
|
||||||
|
|
||||||
|
* Remove stale signature benchmarking code (-L command-line option).
|
||||||
|
(Jon Siwek)
|
||||||
|
|
||||||
|
* BIT-844: fix UDP payload signatures to match packet-wise. (Jon
|
||||||
|
Siwek)
|
||||||
|
|
||||||
|
2.3-682 | 2015-04-09 12:07:00 -0700
|
||||||
|
|
||||||
|
* Fixing input readers' component type. (Robin Sommer)
|
||||||
|
|
||||||
|
* Tiny spelling correction. (Seth Hall)
|
||||||
|
|
||||||
2.3-680 | 2015-04-06 16:02:43 -0500
|
2.3-680 | 2015-04-06 16:02:43 -0500
|
||||||
|
|
||||||
* BIT-1371: remove CMake version check from binary package scripts.
|
* BIT-1371: remove CMake version check from binary package scripts.
|
||||||
|
|
|
||||||
97
NEWS
97
NEWS
|
|
@ -7,9 +7,6 @@ their own ``CHANGES``.)
|
||||||
Bro 2.4 (in progress)
|
Bro 2.4 (in progress)
|
||||||
=====================
|
=====================
|
||||||
|
|
||||||
Dependencies
|
|
||||||
------------
|
|
||||||
|
|
||||||
New Functionality
|
New Functionality
|
||||||
-----------------
|
-----------------
|
||||||
|
|
||||||
|
|
@ -17,20 +14,25 @@ New Functionality
|
||||||
functionality, like protocol/file analysis, via shared libraries.
|
functionality, like protocol/file analysis, via shared libraries.
|
||||||
Plugins can be developed and distributed externally, and will be
|
Plugins can be developed and distributed externally, and will be
|
||||||
pulled in dynamically at startup. Currently, a plugin can provide
|
pulled in dynamically at startup. Currently, a plugin can provide
|
||||||
custom protocol analyzers, file analyzers, log writers[TODO], input
|
custom protocol analyzers, file analyzers, log writers, input
|
||||||
readers[TODO], packet sources[TODO], and new built-in functions. A
|
readers, packet sources and dumpers, and new built-in functions. A
|
||||||
plugin can furthermore hook into Bro's processing a number of places
|
plugin can furthermore hook into Bro's processing at a number of
|
||||||
to add custom logic.
|
places to add custom logic.
|
||||||
|
|
||||||
See https://www.bro.org/sphinx-git/devel/plugins.html for more
|
See https://www.bro.org/sphinx-git/devel/plugins.html for more
|
||||||
information on writing plugins.
|
information on writing plugins.
|
||||||
|
|
||||||
- Bro now has supoprt for the MySQL wire protocol. Activity gets
|
- Bro now has support for the MySQL wire protocol. Activity gets
|
||||||
logged into mysql.log.
|
logged into mysql.log.
|
||||||
|
|
||||||
- Bro now features a completely rewritten, enhanced SSH analyzer. A lot
|
- Bro now parses DTLS traffic.
|
||||||
more information about SSH sessions is logged. The analyzer is able to
|
|
||||||
determine if logins failed or succeeded in most circumstances.
|
- Bro now has an RDP analyzer.
|
||||||
|
|
||||||
|
- Bro now features a completely rewritten, enhanced SSH analyzer, with
|
||||||
|
a set of addedd events being generated. A lot more information about
|
||||||
|
SSH sessions is logged. The analyzer is able to determine if logins
|
||||||
|
failed or succeeded in most circumstances.
|
||||||
|
|
||||||
- Bro's file analysis now supports reassembly of files that are not
|
- Bro's file analysis now supports reassembly of files that are not
|
||||||
transferred/seen sequentially.
|
transferred/seen sequentially.
|
||||||
|
|
@ -43,33 +45,66 @@ New Functionality
|
||||||
``next`` and ``break`` can be used inside the loop's body just like
|
``next`` and ``break`` can be used inside the loop's body just like
|
||||||
with ``for`` loops.
|
with ``for`` loops.
|
||||||
|
|
||||||
- Bro now integrates Broker, it's new communication library. See
|
- Bro now integrates Broker, a new communication library. See
|
||||||
aux/broker/README for more information on Broker, and
|
aux/broker/README for more information on Broker, and
|
||||||
doc/frameworks/comm.rst for the corresponding Bro script API.
|
doc/frameworks/broker.rst for the corresponding Bro script API.
|
||||||
|
|
||||||
TODO: Extend with some more information on Broker.
|
With Broker, Bro has the similar capabilities of exchanging events and
|
||||||
|
logs with remote peers (either another Bro process or some other
|
||||||
|
application that uses Broker). It also includes a key-value store
|
||||||
|
API that can be used to share state between peers and optionally
|
||||||
|
allow data to persist on disk for longer-term storage.
|
||||||
|
|
||||||
Broker support is by default off for now; it can be enabled at
|
Broker support is by default off for now; it can be enabled at
|
||||||
configure time with --enable-broker. It requires CAF version 0.13+
|
configure time with --enable-broker. It requires CAF version 0.13+
|
||||||
(https://github.com/actor-framework/actor-framework) as well as a
|
(https://github.com/actor-framework/actor-framework) as well as a
|
||||||
C++11 compiler (e.g. GCC 4.8+ or Clang 3.3+).
|
C++11 compiler (e.g. GCC 4.8+ or Clang 3.3+).
|
||||||
|
|
||||||
Broker will become a mandatory dependency in future Bro versions.
|
Broker will become a mandatory dependency in future Bro versions and
|
||||||
|
replace the current communcation and serialization system.
|
||||||
|
|
||||||
- Add --enable-c++11 configure flag to compile Bro's source code in
|
- Add --enable-c++11 configure flag to compile Bro's source code in
|
||||||
C++11 mode with a corresponding compiler. Note that 2.4 will be the
|
C++11 mode with a corresponding compiler. Note that 2.4 will be the
|
||||||
last version of Bro that compiles without C++11 support.
|
last version of Bro that compiles without C++11 support.
|
||||||
|
|
||||||
- The SSL analysis now alert when encountering SSL connections with
|
- The SSL analysis now alerts when encountering SSL connections with
|
||||||
old protocol versions or unsafe cipher suites.
|
old protocol versions or unsafe cipher suites. It also gained
|
||||||
|
extended reporting of weak keys, caching of already valdidated
|
||||||
- [TODO] Add new BroControl features.
|
certificates, full support TLS record defragmentation. SSL generally
|
||||||
|
became much more robust and added several fields to ssl.log (while
|
||||||
|
removing some other).
|
||||||
|
|
||||||
- A new icmp_sent_payload event provides access to ICMP payload.
|
- A new icmp_sent_payload event provides access to ICMP payload.
|
||||||
|
|
||||||
- Bro now parses DTLS traffic.
|
- The input framework's raw reader now supports seeking by adding an
|
||||||
|
option "offset" to the config map. Positive offsets are interpreted
|
||||||
|
to be from the beginning of the file, negative from the end of the
|
||||||
|
file (-1 is end of file).
|
||||||
|
|
||||||
- Bro now has an RDP analyzer.
|
- One can now raise events when a connection crosses a given size
|
||||||
|
threshold in terms of packets or bytes. The primary API for that
|
||||||
|
functionality is in base/protocols/conn/thresholds.bro.
|
||||||
|
|
||||||
|
- BroControl now has a new command "deploy" which is equivalent to running
|
||||||
|
the "check", "install", "stop", and "start" commands (in that order).
|
||||||
|
|
||||||
|
- BroControl now has a new option "StatusCmdShowAll" that controls whether
|
||||||
|
or not the broctl "status" command gathers all of the status information.
|
||||||
|
This option can be used to make the "status" command run significantly
|
||||||
|
faster (in this case, the "Peers" column will not be shown in the output).
|
||||||
|
|
||||||
|
- BroControl now has a new option "StatsLogEnable" that controls whether
|
||||||
|
or not broctl will record information to the "stats.log" file. This option
|
||||||
|
can be used to make the "broctl cron" command run slightly faster (in this
|
||||||
|
case, "broctl cron" will also no longer send email about not seeing any
|
||||||
|
packets on the monitoring interfaces).
|
||||||
|
|
||||||
|
- BroControl now has a new option "MailHostUpDown" which controls whether or
|
||||||
|
not the "broctl cron" command will send email when it notices that a host
|
||||||
|
in the cluster is up or down.
|
||||||
|
|
||||||
|
- BroControl now has a new option "CommandTimeout" which specifies the number
|
||||||
|
of seconds to wait for a command that broctl ran to return results.
|
||||||
|
|
||||||
Changed Functionality
|
Changed Functionality
|
||||||
---------------------
|
---------------------
|
||||||
|
|
@ -110,8 +145,6 @@ Changed Functionality
|
||||||
- The default name for extracted files changed from extract-protocol-id
|
- The default name for extracted files changed from extract-protocol-id
|
||||||
to extract-timestamp-protocol-id.
|
to extract-timestamp-protocol-id.
|
||||||
|
|
||||||
- [TODO] Add changed BroControl features.
|
|
||||||
|
|
||||||
- The weird named "unmatched_HTTP_reply" has been removed since it can
|
- The weird named "unmatched_HTTP_reply" has been removed since it can
|
||||||
be detected at the script-layer and is handled correctly by the
|
be detected at the script-layer and is handled correctly by the
|
||||||
default HTTP scripts.
|
default HTTP scripts.
|
||||||
|
|
@ -125,7 +158,23 @@ Changed Functionality
|
||||||
explicitly set. Before, the default path function would always be set
|
explicitly set. Before, the default path function would always be set
|
||||||
for all filters which didn't specify their own ``path_func``.
|
for all filters which didn't specify their own ``path_func``.
|
||||||
|
|
||||||
- TODO: what SSH events got changed or removed?
|
- BroControl now establishes only one ssh connection from the manager to
|
||||||
|
each remote host in a cluster configuration (previously, there would be
|
||||||
|
one ssh connection per remote Bro process).
|
||||||
|
|
||||||
|
- BroControl now uses SQLite to record state information instead of a
|
||||||
|
plain text file (the file "spool/broctl.dat" is no longer used).
|
||||||
|
On FreeBSD, this means that there is a new dependency on the package
|
||||||
|
"py27-sqlite3".
|
||||||
|
|
||||||
|
- BroControl now records the expected running state of each Bro node right
|
||||||
|
before each start or stop. The "broctl cron" command uses this info to
|
||||||
|
either start or stop Bro nodes as needed so that the actual state matches
|
||||||
|
the expected state (previously, "broctl cron" could only start nodes in
|
||||||
|
the "crashed" state, and could never stop a node).
|
||||||
|
|
||||||
|
- BroControl now sends all normal command output (i.e., not error messages)
|
||||||
|
to stdout. Error messages are still sent to stderr, however.
|
||||||
|
|
||||||
Deprecated Functionality
|
Deprecated Functionality
|
||||||
------------------------
|
------------------------
|
||||||
|
|
|
||||||
2
VERSION
2
VERSION
|
|
@ -1 +1 @@
|
||||||
2.3-680
|
2.3-720
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
Subproject commit ab50e5115bc0d217552a63f15382e45ed608f5fc
|
Subproject commit 544330932e7cd4615d6d19f63907e8aa2acebb9e
|
||||||
|
|
@ -1 +1 @@
|
||||||
Subproject commit 1a2ab9ee7c80ca905e86a2a11283e7c0477341a9
|
Subproject commit 0c25c1daa7dcf885dd16cc1b725295dc36decafe
|
||||||
|
|
@ -245,13 +245,26 @@ VERSION). You can find a full list of files installed in
|
||||||
copies over the binary tarball in ``build/dist``.
|
copies over the binary tarball in ``build/dist``.
|
||||||
|
|
||||||
``init-plugin`` will never overwrite existing files. If its target
|
``init-plugin`` will never overwrite existing files. If its target
|
||||||
directory already exists, it will be default decline to do anything.
|
directory already exists, it will by default decline to do anything.
|
||||||
You can run it with ``-u`` instead to update an existing plugin,
|
You can run it with ``-u`` instead to update an existing plugin,
|
||||||
however it will never overwrite any existing files; it will only put
|
however it will never overwrite any existing files; it will only put
|
||||||
in place files it doesn't find yet. To revert a file back to what
|
in place files it doesn't find yet. To revert a file back to what
|
||||||
``init-plugin`` created originally, delete it first and then rerun
|
``init-plugin`` created originally, delete it first and then rerun
|
||||||
with ``-u``.
|
with ``-u``.
|
||||||
|
|
||||||
|
``init-plugin`` puts a ``configure`` script in place that wraps
|
||||||
|
``cmake`` with a more familiar configure-style configuration. By
|
||||||
|
default, the script provides two options for specifying paths to the
|
||||||
|
Bro source (``--bro-dist``) and to the plugin's installation directory
|
||||||
|
(``--install-root``). To extend ``configure`` with plugin-specific
|
||||||
|
options (such as search paths for its dependencies) don't edit the
|
||||||
|
script directly but instead extend ``configure.plugin``, which
|
||||||
|
``configure`` includes. That way you will be able to more easily
|
||||||
|
update ``configure`` in the future when the distribution version
|
||||||
|
changes. In ``configure.plugin`` you can use the predefined shell
|
||||||
|
function ``append_cache_entry`` to seed values into the CMake cache;
|
||||||
|
see the installed skeleton version and existing plugins for examples.
|
||||||
|
|
||||||
Activating a Plugin
|
Activating a Plugin
|
||||||
===================
|
===================
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -37,6 +37,8 @@ export {
|
||||||
user: string;
|
user: string;
|
||||||
## The remote host to which to transfer logs.
|
## The remote host to which to transfer logs.
|
||||||
host: string;
|
host: string;
|
||||||
|
## The port to connect to. Defaults to 22
|
||||||
|
host_port: count &default=22;
|
||||||
## The path/directory on the remote host to send logs.
|
## The path/directory on the remote host to send logs.
|
||||||
path: string;
|
path: string;
|
||||||
};
|
};
|
||||||
|
|
@ -63,8 +65,8 @@ function sftp_postprocessor(info: Log::RotationInfo): bool
|
||||||
{
|
{
|
||||||
local dst = fmt("%s/%s.%s.log", d$path, info$path,
|
local dst = fmt("%s/%s.%s.log", d$path, info$path,
|
||||||
strftime(Log::sftp_rotation_date_format, info$open));
|
strftime(Log::sftp_rotation_date_format, info$open));
|
||||||
command += fmt("echo put %s %s | sftp -b - %s@%s;", info$fname, dst,
|
command += fmt("echo put %s %s | sftp -P %d -b - %s@%s;", info$fname, dst,
|
||||||
d$user, d$host);
|
d$host_port, d$user, d$host);
|
||||||
}
|
}
|
||||||
|
|
||||||
command += fmt("/bin/rm %s", info$fname);
|
command += fmt("/bin/rm %s", info$fname);
|
||||||
|
|
|
||||||
|
|
@ -3282,6 +3282,11 @@ const forward_remote_events = F &redef;
|
||||||
## more sophisticated script-level communication framework.
|
## more sophisticated script-level communication framework.
|
||||||
const forward_remote_state_changes = F &redef;
|
const forward_remote_state_changes = F &redef;
|
||||||
|
|
||||||
|
## The number of IO chunks allowed to be buffered between the child
|
||||||
|
## and parent process of remote communication before Bro starts dropping
|
||||||
|
## connections to remote peers in an attempt to catch up.
|
||||||
|
const chunked_io_buffer_soft_cap = 800000 &redef;
|
||||||
|
|
||||||
## Place-holder constant indicating "no peer".
|
## Place-holder constant indicating "no peer".
|
||||||
const PEER_ID_NONE = 0;
|
const PEER_ID_NONE = 0;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -2,3 +2,4 @@
|
||||||
@load ./contents
|
@load ./contents
|
||||||
@load ./inactivity
|
@load ./inactivity
|
||||||
@load ./polling
|
@load ./polling
|
||||||
|
@load ./thresholds
|
||||||
|
|
|
||||||
274
scripts/base/protocols/conn/thresholds.bro
Normal file
274
scripts/base/protocols/conn/thresholds.bro
Normal file
|
|
@ -0,0 +1,274 @@
|
||||||
|
##! Implements a generic API to throw events when a connection crosses a
|
||||||
|
##! fixed threshold of bytes or packets.
|
||||||
|
|
||||||
|
module ConnThreshold;
|
||||||
|
|
||||||
|
export {
|
||||||
|
|
||||||
|
type Thresholds: record {
|
||||||
|
orig_byte: set[count] &default=count_set(); ##< current originator byte thresholds we watch for
|
||||||
|
resp_byte: set[count] &default=count_set(); ##< current responder byte thresholds we watch for
|
||||||
|
orig_packet: set[count] &default=count_set(); ##< corrent originator packet thresholds we watch for
|
||||||
|
resp_packet: set[count] &default=count_set(); ##< corrent responder packet thresholds we watch for
|
||||||
|
};
|
||||||
|
|
||||||
|
## Sets a byte threshold for connection sizes, adding it to potentially already existing thresholds.
|
||||||
|
## conn_bytes_threshold_crossed will be raised for each set threshold.
|
||||||
|
##
|
||||||
|
## cid: The connection id.
|
||||||
|
##
|
||||||
|
## threshold: Threshold in bytes.
|
||||||
|
##
|
||||||
|
## is_orig: If true, threshold is set for bytes from originator, otherwise for bytes from responder.
|
||||||
|
##
|
||||||
|
## Returns: T on success, F on failure.
|
||||||
|
##
|
||||||
|
## .. bro:see:: bytes_threshold_crossed packets_threshold_crossed set_packets_threshold
|
||||||
|
## delete_bytes_threshold delete_packets_threshold
|
||||||
|
global set_bytes_threshold: function(c: connection, threshold: count, is_orig: bool): bool;
|
||||||
|
|
||||||
|
## Sets a packet threshold for connection sizes, adding it to potentially already existing thresholds.
|
||||||
|
## conn_packets_threshold_crossed will be raised for each set threshold.
|
||||||
|
##
|
||||||
|
## cid: The connection id.
|
||||||
|
##
|
||||||
|
## threshold: Threshold in packets.
|
||||||
|
##
|
||||||
|
## is_orig: If true, threshold is set for packets from originator, otherwise for packets from responder.
|
||||||
|
##
|
||||||
|
## Returns: T on success, F on failure.
|
||||||
|
##
|
||||||
|
## .. bro:see:: bytes_threshold_crossed packets_threshold_crossed set_bytes_threshold
|
||||||
|
## delete_bytes_threshold delete_packets_threshold
|
||||||
|
global set_packets_threshold: function(c: connection, threshold: count, is_orig: bool): bool;
|
||||||
|
|
||||||
|
## Deletes a byte threshold for connection sizes.
|
||||||
|
##
|
||||||
|
## cid: The connection id.
|
||||||
|
##
|
||||||
|
## threshold: Threshold in bytes to remove.
|
||||||
|
##
|
||||||
|
## is_orig: If true, threshold is removed for packets from originator, otherwhise for packets from responder.
|
||||||
|
##
|
||||||
|
## Returns: T on success, F on failure.
|
||||||
|
##
|
||||||
|
## .. bro:see:: bytes_threshold_crossed packets_threshold_crossed set_bytes_threshold set_packets_threshold
|
||||||
|
## delete_packets_threshold
|
||||||
|
global delete_bytes_threshold: function(c: connection, threshold: count, is_orig: bool): bool;
|
||||||
|
|
||||||
|
## Deletes a packet threshold for connection sizes.
|
||||||
|
##
|
||||||
|
## cid: The connection id.
|
||||||
|
##
|
||||||
|
## threshold: Threshold in packets.
|
||||||
|
##
|
||||||
|
## is_orig: If true, threshold is removed for packets from originator, otherwise for packets from responder.
|
||||||
|
##
|
||||||
|
## Returns: T on success, F on failure.
|
||||||
|
##
|
||||||
|
## .. bro:see:: bytes_threshold_crossed packets_threshold_crossed set_bytes_threshold set_packets_threshold
|
||||||
|
## delete_bytes_threshold
|
||||||
|
global delete_packets_threshold: function(c: connection, threshold: count, is_orig: bool): bool;
|
||||||
|
|
||||||
|
## Generated for a connection that crossed a set byte threshold
|
||||||
|
##
|
||||||
|
## c: the connection
|
||||||
|
##
|
||||||
|
## threshold: the threshold that was set
|
||||||
|
##
|
||||||
|
## is_orig: True if the threshold was crossed by the originator of the connection
|
||||||
|
##
|
||||||
|
## .. bro:see:: packets_threshold_crossed set_bytes_threshold set_packets_threshold
|
||||||
|
## delete_bytes_threshold delete_packets_threshold
|
||||||
|
global bytes_threshold_crossed: event(c: connection, threshold: count, is_orig: bool);
|
||||||
|
|
||||||
|
## Generated for a connection that crossed a set byte threshold
|
||||||
|
##
|
||||||
|
## c: the connection
|
||||||
|
##
|
||||||
|
## threshold: the threshold that was set
|
||||||
|
##
|
||||||
|
## is_orig: True if the threshold was crossed by the originator of the connection
|
||||||
|
##
|
||||||
|
## .. bro:see:: bytes_threshold_crossed set_bytes_threshold set_packets_threshold
|
||||||
|
## delete_bytes_threshold delete_packets_threshold
|
||||||
|
global packets_threshold_crossed: event(c: connection, threshold: count, is_orig: bool);
|
||||||
|
}
|
||||||
|
|
||||||
|
redef record connection += {
|
||||||
|
thresholds: ConnThreshold::Thresholds &optional;
|
||||||
|
};
|
||||||
|
|
||||||
|
function set_conn(c: connection)
|
||||||
|
{
|
||||||
|
if ( c?$thresholds )
|
||||||
|
return;
|
||||||
|
|
||||||
|
c$thresholds = Thresholds();
|
||||||
|
}
|
||||||
|
|
||||||
|
function find_min_threshold(t: set[count]): count
|
||||||
|
{
|
||||||
|
if ( |t| == 0 )
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
local first = T;
|
||||||
|
local min: count = 0;
|
||||||
|
|
||||||
|
for ( i in t )
|
||||||
|
{
|
||||||
|
if ( first )
|
||||||
|
{
|
||||||
|
min = i;
|
||||||
|
first = F;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
if ( i < min )
|
||||||
|
min = i;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return min;
|
||||||
|
}
|
||||||
|
|
||||||
|
function set_current_threshold(c: connection, bytes: bool, is_orig: bool): bool
|
||||||
|
{
|
||||||
|
local t: count = 0;
|
||||||
|
local cur: count = 0;
|
||||||
|
|
||||||
|
if ( bytes && is_orig )
|
||||||
|
{
|
||||||
|
t = find_min_threshold(c$thresholds$orig_byte);
|
||||||
|
cur = get_current_conn_bytes_threshold(c$id, is_orig);
|
||||||
|
}
|
||||||
|
else if ( bytes && ! is_orig )
|
||||||
|
{
|
||||||
|
t = find_min_threshold(c$thresholds$resp_byte);
|
||||||
|
cur = get_current_conn_bytes_threshold(c$id, is_orig);
|
||||||
|
}
|
||||||
|
else if ( ! bytes && is_orig )
|
||||||
|
{
|
||||||
|
t = find_min_threshold(c$thresholds$orig_packet);
|
||||||
|
cur = get_current_conn_packets_threshold(c$id, is_orig);
|
||||||
|
}
|
||||||
|
else if ( ! bytes && ! is_orig )
|
||||||
|
{
|
||||||
|
t = find_min_threshold(c$thresholds$resp_packet);
|
||||||
|
cur = get_current_conn_packets_threshold(c$id, is_orig);
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( t == cur )
|
||||||
|
return T;
|
||||||
|
|
||||||
|
if ( bytes && is_orig )
|
||||||
|
return set_current_conn_bytes_threshold(c$id, t, T);
|
||||||
|
else if ( bytes && ! is_orig )
|
||||||
|
return set_current_conn_bytes_threshold(c$id, t, F);
|
||||||
|
else if ( ! bytes && is_orig )
|
||||||
|
return set_current_conn_packets_threshold(c$id, t, T);
|
||||||
|
else if ( ! bytes && ! is_orig )
|
||||||
|
return set_current_conn_packets_threshold(c$id, t, F);
|
||||||
|
}
|
||||||
|
|
||||||
|
function set_bytes_threshold(c: connection, threshold: count, is_orig: bool): bool
|
||||||
|
{
|
||||||
|
set_conn(c);
|
||||||
|
|
||||||
|
if ( threshold == 0 )
|
||||||
|
return F;
|
||||||
|
|
||||||
|
if ( is_orig )
|
||||||
|
add c$thresholds$orig_byte[threshold];
|
||||||
|
else
|
||||||
|
add c$thresholds$resp_byte[threshold];
|
||||||
|
|
||||||
|
return set_current_threshold(c, T, is_orig);
|
||||||
|
}
|
||||||
|
|
||||||
|
function set_packets_threshold(c: connection, threshold: count, is_orig: bool): bool
|
||||||
|
{
|
||||||
|
set_conn(c);
|
||||||
|
|
||||||
|
if ( threshold == 0 )
|
||||||
|
return F;
|
||||||
|
|
||||||
|
if ( is_orig )
|
||||||
|
add c$thresholds$orig_packet[threshold];
|
||||||
|
else
|
||||||
|
add c$thresholds$resp_packet[threshold];
|
||||||
|
|
||||||
|
return set_current_threshold(c, F, is_orig);
|
||||||
|
}
|
||||||
|
|
||||||
|
function delete_bytes_threshold(c: connection, threshold: count, is_orig: bool): bool
|
||||||
|
{
|
||||||
|
set_conn(c);
|
||||||
|
|
||||||
|
if ( is_orig && threshold in c$thresholds$orig_byte )
|
||||||
|
{
|
||||||
|
delete c$thresholds$orig_byte[threshold];
|
||||||
|
set_current_threshold(c, T, is_orig);
|
||||||
|
return T;
|
||||||
|
}
|
||||||
|
else if ( ! is_orig && threshold in c$thresholds$resp_byte )
|
||||||
|
{
|
||||||
|
delete c$thresholds$resp_byte[threshold];
|
||||||
|
set_current_threshold(c, T, is_orig);
|
||||||
|
return T;
|
||||||
|
}
|
||||||
|
|
||||||
|
return F;
|
||||||
|
}
|
||||||
|
|
||||||
|
function delete_packets_threshold(c: connection, threshold: count, is_orig: bool): bool
|
||||||
|
{
|
||||||
|
set_conn(c);
|
||||||
|
|
||||||
|
if ( is_orig && threshold in c$thresholds$orig_packet )
|
||||||
|
{
|
||||||
|
delete c$thresholds$orig_packet[threshold];
|
||||||
|
set_current_threshold(c, F, is_orig);
|
||||||
|
return T;
|
||||||
|
}
|
||||||
|
else if ( ! is_orig && threshold in c$thresholds$resp_packet )
|
||||||
|
{
|
||||||
|
delete c$thresholds$resp_packet[threshold];
|
||||||
|
set_current_threshold(c, F, is_orig);
|
||||||
|
return T;
|
||||||
|
}
|
||||||
|
|
||||||
|
return F;
|
||||||
|
}
|
||||||
|
|
||||||
|
event conn_bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool) &priority=5
|
||||||
|
{
|
||||||
|
if ( is_orig && threshold in c$thresholds$orig_byte )
|
||||||
|
{
|
||||||
|
delete c$thresholds$orig_byte[threshold];
|
||||||
|
event ConnThreshold::bytes_threshold_crossed(c, threshold, is_orig);
|
||||||
|
}
|
||||||
|
else if ( ! is_orig && threshold in c$thresholds$resp_byte )
|
||||||
|
{
|
||||||
|
delete c$thresholds$resp_byte[threshold];
|
||||||
|
event ConnThreshold::bytes_threshold_crossed(c, threshold, is_orig);
|
||||||
|
}
|
||||||
|
|
||||||
|
set_current_threshold(c, T, is_orig);
|
||||||
|
}
|
||||||
|
|
||||||
|
event conn_packets_threshold_crossed(c: connection, threshold: count, is_orig: bool) &priority=5
|
||||||
|
{
|
||||||
|
if ( is_orig && threshold in c$thresholds$orig_packet )
|
||||||
|
{
|
||||||
|
delete c$thresholds$orig_packet[threshold];
|
||||||
|
event ConnThreshold::packets_threshold_crossed(c, threshold, is_orig);
|
||||||
|
}
|
||||||
|
else if ( ! is_orig && threshold in c$thresholds$resp_packet )
|
||||||
|
{
|
||||||
|
delete c$thresholds$resp_packet[threshold];
|
||||||
|
event ConnThreshold::packets_threshold_crossed(c, threshold, is_orig);
|
||||||
|
}
|
||||||
|
|
||||||
|
set_current_threshold(c, F, is_orig);
|
||||||
|
}
|
||||||
|
|
@ -11,13 +11,13 @@
|
||||||
##! GridFTP data channels are identified by a heuristic that relies on
|
##! GridFTP data channels are identified by a heuristic that relies on
|
||||||
##! the fact that default settings for GridFTP clients typically
|
##! the fact that default settings for GridFTP clients typically
|
||||||
##! mutually authenticate the data channel with TLS/SSL and negotiate a
|
##! mutually authenticate the data channel with TLS/SSL and negotiate a
|
||||||
##! NULL bulk cipher (no encryption). Connections with those
|
##! NULL bulk cipher (no encryption). Connections with those attributes
|
||||||
##! attributes are then polled for two minutes with decreasing frequency
|
##! are marked as GridFTP if the data transfer within the first two minutes
|
||||||
##! to check if the transfer sizes are large enough to indicate a
|
##! is big enough to indicate a GripFTP data channel that would be
|
||||||
##! GridFTP data channel that would be undesirable to analyze further
|
##! undesirable to analyze further (e.g. stop TCP reassembly). A side
|
||||||
##! (e.g. stop TCP reassembly). A side effect is that true connection
|
##! effect is that true connection sizes are not logged, but at the benefit
|
||||||
##! sizes are not logged, but at the benefit of saving CPU cycles that
|
##! of saving CPU cycles that would otherwise go to analyzing the large
|
||||||
##! would otherwise go to analyzing the large (and likely benign) connections.
|
##! (and likely benign) connections.
|
||||||
|
|
||||||
@load ./info
|
@load ./info
|
||||||
@load ./main
|
@load ./main
|
||||||
|
|
@ -32,23 +32,14 @@ export {
|
||||||
## GridFTP data channel.
|
## GridFTP data channel.
|
||||||
const size_threshold = 1073741824 &redef;
|
const size_threshold = 1073741824 &redef;
|
||||||
|
|
||||||
## Max number of times to check whether a connection's size exceeds the
|
## Time during which we check whether a connection's size exceeds the
|
||||||
## :bro:see:`GridFTP::size_threshold`.
|
## :bro:see:`GridFTP::size_threshold`.
|
||||||
const max_poll_count = 15 &redef;
|
const max_time = 2 min &redef;
|
||||||
|
|
||||||
## Whether to skip further processing of the GridFTP data channel once
|
## Whether to skip further processing of the GridFTP data channel once
|
||||||
## detected, which may help performance.
|
## detected, which may help performance.
|
||||||
const skip_data = T &redef;
|
const skip_data = T &redef;
|
||||||
|
|
||||||
## Base amount of time between checking whether a GridFTP data connection
|
|
||||||
## has transferred more than :bro:see:`GridFTP::size_threshold` bytes.
|
|
||||||
const poll_interval = 1sec &redef;
|
|
||||||
|
|
||||||
## The amount of time the base :bro:see:`GridFTP::poll_interval` is
|
|
||||||
## increased by each poll interval. Can be used to make more frequent
|
|
||||||
## checks at the start of a connection and gradually slow down.
|
|
||||||
const poll_interval_increase = 1sec &redef;
|
|
||||||
|
|
||||||
## Raised when a GridFTP data channel is detected.
|
## Raised when a GridFTP data channel is detected.
|
||||||
##
|
##
|
||||||
## c: The connection pertaining to the GridFTP data channel.
|
## c: The connection pertaining to the GridFTP data channel.
|
||||||
|
|
@ -79,23 +70,27 @@ event ftp_request(c: connection, command: string, arg: string) &priority=4
|
||||||
c$ftp$last_auth_requested = arg;
|
c$ftp$last_auth_requested = arg;
|
||||||
}
|
}
|
||||||
|
|
||||||
function size_callback(c: connection, cnt: count): interval
|
event ConnThreshold::bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
|
||||||
{
|
{
|
||||||
if ( c$orig$size > size_threshold || c$resp$size > size_threshold )
|
if ( threshold < size_threshold || "gridftp-data" in c$service || c$duration > max_time )
|
||||||
|
return;
|
||||||
|
|
||||||
|
add c$service["gridftp-data"];
|
||||||
|
event GridFTP::data_channel_detected(c);
|
||||||
|
|
||||||
|
if ( skip_data )
|
||||||
|
skip_further_processing(c$id);
|
||||||
|
}
|
||||||
|
|
||||||
|
event gridftp_possibility_timeout(c: connection)
|
||||||
|
{
|
||||||
|
# only remove if we did not already detect it and the connection
|
||||||
|
# is not yet at its end.
|
||||||
|
if ( "gridftp-data" !in c$service && ! c$conn?$service )
|
||||||
{
|
{
|
||||||
add c$service["gridftp-data"];
|
ConnThreshold::delete_bytes_threshold(c, size_threshold, T);
|
||||||
event GridFTP::data_channel_detected(c);
|
ConnThreshold::delete_bytes_threshold(c, size_threshold, F);
|
||||||
|
|
||||||
if ( skip_data )
|
|
||||||
skip_further_processing(c$id);
|
|
||||||
|
|
||||||
return -1sec;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( cnt >= max_poll_count )
|
|
||||||
return -1sec;
|
|
||||||
|
|
||||||
return poll_interval + poll_interval_increase * cnt;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
event ssl_established(c: connection) &priority=5
|
event ssl_established(c: connection) &priority=5
|
||||||
|
|
@ -118,5 +113,9 @@ event ssl_established(c: connection) &priority=-3
|
||||||
# By default GridFTP data channels do mutual authentication and
|
# By default GridFTP data channels do mutual authentication and
|
||||||
# negotiate a cipher suite with a NULL bulk cipher.
|
# negotiate a cipher suite with a NULL bulk cipher.
|
||||||
if ( data_channel_initial_criteria(c) )
|
if ( data_channel_initial_criteria(c) )
|
||||||
ConnPolling::watch(c, size_callback, 0, 0secs);
|
{
|
||||||
|
ConnThreshold::set_bytes_threshold(c, size_threshold, T);
|
||||||
|
ConnThreshold::set_bytes_threshold(c, size_threshold, F);
|
||||||
|
schedule max_time { gridftp_possibility_timeout(c) };
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
|
||||||
File diff suppressed because one or more lines are too long
|
|
@ -1 +1 @@
|
||||||
Subproject commit f2e34d731ed29bb993fbb065846faa342a8c824f
|
Subproject commit 6a429e79bbaf0fcc11eff5f639bfb9d1f62be6f2
|
||||||
|
|
@ -137,20 +137,6 @@ bool ChunkedIOFd::Write(Chunk* chunk)
|
||||||
chunk->len, fmt_bytes(chunk->data, min((uint32)20, chunk->len)));
|
chunk->len, fmt_bytes(chunk->data, min((uint32)20, chunk->len)));
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
// Reject if our queue of pending chunks is way too large. Otherwise,
|
|
||||||
// memory could fill up if the other side doesn't read.
|
|
||||||
if ( stats.pending > MAX_BUFFERED_CHUNKS )
|
|
||||||
{
|
|
||||||
DBG_LOG(DBG_CHUNKEDIO, "write queue full");
|
|
||||||
|
|
||||||
#ifdef DEBUG_COMMUNICATION
|
|
||||||
AddToBuffer("<false:write-queue-full>", false);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
errno = ENOSPC;
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef DEBUG_COMMUNICATION
|
#ifdef DEBUG_COMMUNICATION
|
||||||
AddToBuffer(chunk, false);
|
AddToBuffer(chunk, false);
|
||||||
#endif
|
#endif
|
||||||
|
|
@ -627,7 +613,7 @@ bool ChunkedIOFd::IsIdle()
|
||||||
|
|
||||||
bool ChunkedIOFd::IsFillingUp()
|
bool ChunkedIOFd::IsFillingUp()
|
||||||
{
|
{
|
||||||
return stats.pending > MAX_BUFFERED_CHUNKS_SOFT;
|
return stats.pending > chunked_io_buffer_soft_cap;
|
||||||
}
|
}
|
||||||
|
|
||||||
iosource::FD_Set ChunkedIOFd::ExtraReadFDs() const
|
iosource::FD_Set ChunkedIOFd::ExtraReadFDs() const
|
||||||
|
|
@ -838,15 +824,6 @@ bool ChunkedIOSSL::Write(Chunk* chunk)
|
||||||
chunk->len, fmt_bytes(chunk->data, 20));
|
chunk->len, fmt_bytes(chunk->data, 20));
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
// Reject if our queue of pending chunks is way too large. Otherwise,
|
|
||||||
// memory could fill up if the other side doesn't read.
|
|
||||||
if ( stats.pending > MAX_BUFFERED_CHUNKS )
|
|
||||||
{
|
|
||||||
DBG_LOG(DBG_CHUNKEDIO, "write queue full");
|
|
||||||
errno = ENOSPC;
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Queue it.
|
// Queue it.
|
||||||
++stats.pending;
|
++stats.pending;
|
||||||
Queue* q = new Queue;
|
Queue* q = new Queue;
|
||||||
|
|
|
||||||
|
|
@ -221,13 +221,6 @@ private:
|
||||||
// than BUFFER_SIZE.
|
// than BUFFER_SIZE.
|
||||||
static const uint32 FLAG_PARTIAL = 0x80000000;
|
static const uint32 FLAG_PARTIAL = 0x80000000;
|
||||||
|
|
||||||
// We report that we're filling up when there are more than this number
|
|
||||||
// of pending chunks.
|
|
||||||
static const uint32 MAX_BUFFERED_CHUNKS_SOFT = 400000;
|
|
||||||
|
|
||||||
// Maximum number of chunks we store in memory before rejecting writes.
|
|
||||||
static const uint32 MAX_BUFFERED_CHUNKS = 500000;
|
|
||||||
|
|
||||||
char* read_buffer;
|
char* read_buffer;
|
||||||
uint32 read_len;
|
uint32 read_len;
|
||||||
uint32 read_pos;
|
uint32 read_pos;
|
||||||
|
|
@ -275,8 +268,6 @@ public:
|
||||||
virtual void Stats(char* buffer, int length);
|
virtual void Stats(char* buffer, int length);
|
||||||
|
|
||||||
private:
|
private:
|
||||||
// Maximum number of chunks we store in memory before rejecting writes.
|
|
||||||
static const uint32 MAX_BUFFERED_CHUNKS = 500000;
|
|
||||||
|
|
||||||
// Only returns true if all data has been read. If not, call
|
// Only returns true if all data has been read. If not, call
|
||||||
// it again with the same parameters as long as error is not
|
// it again with the same parameters as long as error is not
|
||||||
|
|
|
||||||
|
|
@ -7,8 +7,6 @@
|
||||||
#include "EquivClass.h"
|
#include "EquivClass.h"
|
||||||
#include "DFA.h"
|
#include "DFA.h"
|
||||||
|
|
||||||
int dfa_state_cache_size = 10000;
|
|
||||||
|
|
||||||
unsigned int DFA_State::transition_counter = 0;
|
unsigned int DFA_State::transition_counter = 0;
|
||||||
|
|
||||||
DFA_State::DFA_State(int arg_state_num, const EquivClass* ec,
|
DFA_State::DFA_State(int arg_state_num, const EquivClass* ec,
|
||||||
|
|
@ -292,9 +290,8 @@ unsigned int DFA_State::Size()
|
||||||
+ (centry ? padded_sizeof(CacheEntry) : 0);
|
+ (centry ? padded_sizeof(CacheEntry) : 0);
|
||||||
}
|
}
|
||||||
|
|
||||||
DFA_State_Cache::DFA_State_Cache(int arg_maxsize)
|
DFA_State_Cache::DFA_State_Cache()
|
||||||
{
|
{
|
||||||
maxsize = arg_maxsize;
|
|
||||||
hits = misses = 0;
|
hits = misses = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -402,7 +399,7 @@ DFA_Machine::DFA_Machine(NFA_Machine* n, EquivClass* arg_ec)
|
||||||
|
|
||||||
ec = arg_ec;
|
ec = arg_ec;
|
||||||
|
|
||||||
dfa_state_cache = new DFA_State_Cache(dfa_state_cache_size);
|
dfa_state_cache = new DFA_State_Cache();
|
||||||
|
|
||||||
NFA_state_list* ns = new NFA_state_list;
|
NFA_state_list* ns = new NFA_state_list;
|
||||||
ns->append(n->FirstState());
|
ns->append(n->FirstState());
|
||||||
|
|
|
||||||
|
|
@ -15,8 +15,6 @@ class DFA_State;
|
||||||
|
|
||||||
#include "NFA.h"
|
#include "NFA.h"
|
||||||
|
|
||||||
extern int dfa_state_cache_size;
|
|
||||||
|
|
||||||
class DFA_Machine;
|
class DFA_Machine;
|
||||||
class DFA_State;
|
class DFA_State;
|
||||||
struct CacheEntry;
|
struct CacheEntry;
|
||||||
|
|
@ -78,7 +76,7 @@ struct CacheEntry {
|
||||||
|
|
||||||
class DFA_State_Cache {
|
class DFA_State_Cache {
|
||||||
public:
|
public:
|
||||||
DFA_State_Cache(int maxsize);
|
DFA_State_Cache();
|
||||||
~DFA_State_Cache();
|
~DFA_State_Cache();
|
||||||
|
|
||||||
// If the caller stores the handle, it has to call Ref() on it.
|
// If the caller stores the handle, it has to call Ref() on it.
|
||||||
|
|
@ -105,8 +103,6 @@ public:
|
||||||
void GetStats(Stats* s);
|
void GetStats(Stats* s);
|
||||||
|
|
||||||
private:
|
private:
|
||||||
int maxsize;
|
|
||||||
|
|
||||||
int hits; // Statistics
|
int hits; // Statistics
|
||||||
int misses;
|
int misses;
|
||||||
|
|
||||||
|
|
|
||||||
33
src/Expr.cc
33
src/Expr.cc
|
|
@ -2599,6 +2599,39 @@ bool AssignExpr::TypeCheck(attr_list* attrs)
|
||||||
|
|
||||||
if ( ! same_type(op1->Type(), op2->Type()) )
|
if ( ! same_type(op1->Type(), op2->Type()) )
|
||||||
{
|
{
|
||||||
|
if ( bt1 == TYPE_TABLE && bt2 == TYPE_TABLE )
|
||||||
|
{
|
||||||
|
if ( op2->Tag() == EXPR_SET_CONSTRUCTOR )
|
||||||
|
{
|
||||||
|
// Some elements in constructor list must not match, see if
|
||||||
|
// we can create a new constructor now that the expected type
|
||||||
|
// of LHS is known and let it do coercions where possible.
|
||||||
|
SetConstructorExpr* sce = dynamic_cast<SetConstructorExpr*>(op2);
|
||||||
|
ListExpr* ctor_list = dynamic_cast<ListExpr*>(sce->Op());
|
||||||
|
attr_list* attr_copy = 0;
|
||||||
|
|
||||||
|
if ( sce->Attrs() )
|
||||||
|
{
|
||||||
|
attr_list* a = sce->Attrs()->Attrs();
|
||||||
|
attrs = new attr_list;
|
||||||
|
loop_over_list(*a, i)
|
||||||
|
attrs->append((*a)[i]);
|
||||||
|
}
|
||||||
|
|
||||||
|
int errors_before = reporter->Errors();
|
||||||
|
op2 = new SetConstructorExpr(ctor_list, attr_copy, op1->Type());
|
||||||
|
int errors_after = reporter->Errors();
|
||||||
|
|
||||||
|
if ( errors_after > errors_before )
|
||||||
|
{
|
||||||
|
ExprError("type clash in assignment");
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
ExprError("type clash in assignment");
|
ExprError("type clash in assignment");
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -178,6 +178,7 @@ RecordType* peer;
|
||||||
int forward_remote_state_changes;
|
int forward_remote_state_changes;
|
||||||
int forward_remote_events;
|
int forward_remote_events;
|
||||||
int remote_check_sync_consistency;
|
int remote_check_sync_consistency;
|
||||||
|
bro_uint_t chunked_io_buffer_soft_cap;
|
||||||
|
|
||||||
StringVal* ssl_ca_certificate;
|
StringVal* ssl_ca_certificate;
|
||||||
StringVal* ssl_private_key;
|
StringVal* ssl_private_key;
|
||||||
|
|
@ -276,6 +277,7 @@ void init_general_global_var()
|
||||||
forward_remote_events = opt_internal_int("forward_remote_events");
|
forward_remote_events = opt_internal_int("forward_remote_events");
|
||||||
remote_check_sync_consistency =
|
remote_check_sync_consistency =
|
||||||
opt_internal_int("remote_check_sync_consistency");
|
opt_internal_int("remote_check_sync_consistency");
|
||||||
|
chunked_io_buffer_soft_cap = opt_internal_unsigned("chunked_io_buffer_soft_cap");
|
||||||
|
|
||||||
ssl_ca_certificate = internal_val("ssl_ca_certificate")->AsStringVal();
|
ssl_ca_certificate = internal_val("ssl_ca_certificate")->AsStringVal();
|
||||||
ssl_private_key = internal_val("ssl_private_key")->AsStringVal();
|
ssl_private_key = internal_val("ssl_private_key")->AsStringVal();
|
||||||
|
|
|
||||||
|
|
@ -181,6 +181,7 @@ extern RecordType* peer;
|
||||||
extern int forward_remote_state_changes;
|
extern int forward_remote_state_changes;
|
||||||
extern int forward_remote_events;
|
extern int forward_remote_events;
|
||||||
extern int remote_check_sync_consistency;
|
extern int remote_check_sync_consistency;
|
||||||
|
extern bro_uint_t chunked_io_buffer_soft_cap;
|
||||||
|
|
||||||
extern StringVal* ssl_ca_certificate;
|
extern StringVal* ssl_ca_certificate;
|
||||||
extern StringVal* ssl_private_key;
|
extern StringVal* ssl_private_key;
|
||||||
|
|
|
||||||
|
|
@ -20,9 +20,6 @@ int case_insensitive = 0;
|
||||||
extern int RE_parse(void);
|
extern int RE_parse(void);
|
||||||
extern void RE_set_input(const char* str);
|
extern void RE_set_input(const char* str);
|
||||||
|
|
||||||
// If true, the set-wise matching always returns false - for benchmarking.
|
|
||||||
extern int rule_bench;
|
|
||||||
|
|
||||||
Specific_RE_Matcher::Specific_RE_Matcher(match_type arg_mt, int arg_multiline)
|
Specific_RE_Matcher::Specific_RE_Matcher(match_type arg_mt, int arg_multiline)
|
||||||
: equiv_class(NUM_SYM)
|
: equiv_class(NUM_SYM)
|
||||||
{
|
{
|
||||||
|
|
@ -279,9 +276,6 @@ inline void RE_Match_State::AddMatches(const AcceptingSet& as,
|
||||||
bool RE_Match_State::Match(const u_char* bv, int n,
|
bool RE_Match_State::Match(const u_char* bv, int n,
|
||||||
bool bol, bool eol, bool clear)
|
bool bol, bool eol, bool clear)
|
||||||
{
|
{
|
||||||
if ( rule_bench > 0 )
|
|
||||||
return false;
|
|
||||||
|
|
||||||
if ( current_pos == -1 )
|
if ( current_pos == -1 )
|
||||||
{
|
{
|
||||||
// First call to Match().
|
// First call to Match().
|
||||||
|
|
|
||||||
|
|
@ -542,6 +542,9 @@ RemoteSerializer::RemoteSerializer()
|
||||||
current_msgtype = 0;
|
current_msgtype = 0;
|
||||||
current_args = 0;
|
current_args = 0;
|
||||||
source_peer = 0;
|
source_peer = 0;
|
||||||
|
|
||||||
|
// Register as a "dont-count" source first, we may change that later.
|
||||||
|
iosource_mgr->Register(this, true);
|
||||||
}
|
}
|
||||||
|
|
||||||
RemoteSerializer::~RemoteSerializer()
|
RemoteSerializer::~RemoteSerializer()
|
||||||
|
|
@ -571,8 +574,6 @@ void RemoteSerializer::Enable()
|
||||||
|
|
||||||
Fork();
|
Fork();
|
||||||
|
|
||||||
iosource_mgr->Register(this);
|
|
||||||
|
|
||||||
Log(LogInfo, fmt("communication started, parent pid is %d, child pid is %d", getpid(), child_pid));
|
Log(LogInfo, fmt("communication started, parent pid is %d, child pid is %d", getpid(), child_pid));
|
||||||
initialized = 1;
|
initialized = 1;
|
||||||
}
|
}
|
||||||
|
|
@ -612,6 +613,9 @@ void RemoteSerializer::Fork()
|
||||||
if ( child_pid )
|
if ( child_pid )
|
||||||
return;
|
return;
|
||||||
|
|
||||||
|
// Register as a "does-count" source now.
|
||||||
|
iosource_mgr->Register(this, false);
|
||||||
|
|
||||||
// If we are re-forking, remove old entries
|
// If we are re-forking, remove old entries
|
||||||
loop_over_list(peers, i)
|
loop_over_list(peers, i)
|
||||||
RemovePeer(peers[i]);
|
RemovePeer(peers[i]);
|
||||||
|
|
@ -3460,7 +3464,8 @@ void SocketComm::Run()
|
||||||
int a = select(max_fd + 1, &fd_read, &fd_write, &fd_except, 0);
|
int a = select(max_fd + 1, &fd_read, &fd_write, &fd_except, 0);
|
||||||
|
|
||||||
if ( selects % 100000 == 0 )
|
if ( selects % 100000 == 0 )
|
||||||
Log(fmt("selects=%ld canwrites=%ld", selects, canwrites));
|
Log(fmt("selects=%ld canwrites=%ld pending=%lu",
|
||||||
|
selects, canwrites, io->Stats()->pending));
|
||||||
|
|
||||||
if ( a < 0 )
|
if ( a < 0 )
|
||||||
// Ignore errors for now.
|
// Ignore errors for now.
|
||||||
|
|
|
||||||
|
|
@ -577,9 +577,6 @@ RuleFileMagicState* RuleMatcher::InitFileMagic() const
|
||||||
{
|
{
|
||||||
RuleFileMagicState* state = new RuleFileMagicState();
|
RuleFileMagicState* state = new RuleFileMagicState();
|
||||||
|
|
||||||
if ( rule_bench == 3 )
|
|
||||||
return state;
|
|
||||||
|
|
||||||
loop_over_list(root->psets[Rule::FILE_MAGIC], i)
|
loop_over_list(root->psets[Rule::FILE_MAGIC], i)
|
||||||
{
|
{
|
||||||
RuleHdrTest::PatternSet* set = root->psets[Rule::FILE_MAGIC][i];
|
RuleHdrTest::PatternSet* set = root->psets[Rule::FILE_MAGIC][i];
|
||||||
|
|
@ -630,9 +627,6 @@ RuleMatcher::MIME_Matches* RuleMatcher::Match(RuleFileMagicState* state,
|
||||||
return rval;
|
return rval;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( rule_bench >= 2 )
|
|
||||||
return rval;
|
|
||||||
|
|
||||||
#ifdef DEBUG
|
#ifdef DEBUG
|
||||||
if ( debug_logger.IsEnabled(DBG_RULES) )
|
if ( debug_logger.IsEnabled(DBG_RULES) )
|
||||||
{
|
{
|
||||||
|
|
@ -712,9 +706,6 @@ RuleEndpointState* RuleMatcher::InitEndpoint(analyzer::Analyzer* analyzer,
|
||||||
RuleEndpointState* state =
|
RuleEndpointState* state =
|
||||||
new RuleEndpointState(analyzer, from_orig, opposite, pia);
|
new RuleEndpointState(analyzer, from_orig, opposite, pia);
|
||||||
|
|
||||||
if ( rule_bench == 3 )
|
|
||||||
return state;
|
|
||||||
|
|
||||||
rule_hdr_test_list tests;
|
rule_hdr_test_list tests;
|
||||||
tests.append(root);
|
tests.append(root);
|
||||||
|
|
||||||
|
|
@ -837,9 +828,6 @@ void RuleMatcher::Match(RuleEndpointState* state, Rule::PatternType type,
|
||||||
// for 'accepted' (that depends on the average number of matching
|
// for 'accepted' (that depends on the average number of matching
|
||||||
// patterns).
|
// patterns).
|
||||||
|
|
||||||
if ( rule_bench >= 2 )
|
|
||||||
return;
|
|
||||||
|
|
||||||
bool newmatch = false;
|
bool newmatch = false;
|
||||||
|
|
||||||
#ifdef DEBUG
|
#ifdef DEBUG
|
||||||
|
|
@ -956,9 +944,6 @@ void RuleMatcher::Match(RuleEndpointState* state, Rule::PatternType type,
|
||||||
|
|
||||||
void RuleMatcher::FinishEndpoint(RuleEndpointState* state)
|
void RuleMatcher::FinishEndpoint(RuleEndpointState* state)
|
||||||
{
|
{
|
||||||
if ( rule_bench == 3 )
|
|
||||||
return;
|
|
||||||
|
|
||||||
// Send EOL to payload matchers.
|
// Send EOL to payload matchers.
|
||||||
Match(state, Rule::PAYLOAD, (const u_char *) "", 0, false, true, false);
|
Match(state, Rule::PAYLOAD, (const u_char *) "", 0, false, true, false);
|
||||||
|
|
||||||
|
|
@ -1110,15 +1095,9 @@ void RuleMatcher::ExecRule(Rule* rule, RuleEndpointState* state, bool eos)
|
||||||
|
|
||||||
void RuleMatcher::ClearEndpointState(RuleEndpointState* state)
|
void RuleMatcher::ClearEndpointState(RuleEndpointState* state)
|
||||||
{
|
{
|
||||||
if ( rule_bench == 3 )
|
state->payload_size = -1;
|
||||||
return;
|
|
||||||
|
|
||||||
ExecPureRules(state, 1);
|
ExecPureRules(state, 1);
|
||||||
state->payload_size = -1;
|
|
||||||
state->matched_by_patterns.clear();
|
|
||||||
loop_over_list(state->matched_text, i)
|
|
||||||
delete state->matched_text[i];
|
|
||||||
state->matched_text.clear();
|
|
||||||
|
|
||||||
loop_over_list(state->matchers, j)
|
loop_over_list(state->matchers, j)
|
||||||
state->matchers[j]->state->Clear();
|
state->matchers[j]->state->Clear();
|
||||||
|
|
@ -1126,9 +1105,6 @@ void RuleMatcher::ClearEndpointState(RuleEndpointState* state)
|
||||||
|
|
||||||
void RuleMatcher::ClearFileMagicState(RuleFileMagicState* state) const
|
void RuleMatcher::ClearFileMagicState(RuleFileMagicState* state) const
|
||||||
{
|
{
|
||||||
if ( rule_bench == 3 )
|
|
||||||
return;
|
|
||||||
|
|
||||||
loop_over_list(state->matchers, j)
|
loop_over_list(state->matchers, j)
|
||||||
state->matchers[j]->state->Clear();
|
state->matchers[j]->state->Clear();
|
||||||
}
|
}
|
||||||
|
|
@ -1496,8 +1472,12 @@ void RuleMatcherState::ClearMatchState(bool orig)
|
||||||
if ( ! rule_matcher )
|
if ( ! rule_matcher )
|
||||||
return;
|
return;
|
||||||
|
|
||||||
if ( orig_match_state )
|
if ( orig )
|
||||||
rule_matcher->ClearEndpointState(orig_match_state);
|
{
|
||||||
if ( resp_match_state )
|
if ( orig_match_state )
|
||||||
|
rule_matcher->ClearEndpointState(orig_match_state);
|
||||||
|
}
|
||||||
|
|
||||||
|
else if ( resp_match_state )
|
||||||
rule_matcher->ClearEndpointState(resp_match_state);
|
rule_matcher->ClearEndpointState(resp_match_state);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -22,8 +22,6 @@
|
||||||
|
|
||||||
//#define MATCHER_PRINT_STATS
|
//#define MATCHER_PRINT_STATS
|
||||||
|
|
||||||
extern int rule_bench;
|
|
||||||
|
|
||||||
// Parser interface:
|
// Parser interface:
|
||||||
|
|
||||||
extern void rules_error(const char* msg);
|
extern void rules_error(const char* msg);
|
||||||
|
|
|
||||||
|
|
@ -400,7 +400,7 @@ public:
|
||||||
*
|
*
|
||||||
* @return The analyzer, or null if not found.
|
* @return The analyzer, or null if not found.
|
||||||
*/
|
*/
|
||||||
Analyzer* FindChild(ID id);
|
virtual Analyzer* FindChild(ID id);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Recursively searches all (direct or indirect) childs of the
|
* Recursively searches all (direct or indirect) childs of the
|
||||||
|
|
@ -411,7 +411,7 @@ public:
|
||||||
* @return The first analyzer of the given type found, or null if
|
* @return The first analyzer of the given type found, or null if
|
||||||
* none.
|
* none.
|
||||||
*/
|
*/
|
||||||
Analyzer* FindChild(Tag tag);
|
virtual Analyzer* FindChild(Tag tag);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Recursively searches all (direct or indirect) childs of the
|
* Recursively searches all (direct or indirect) childs of the
|
||||||
|
|
|
||||||
|
|
@ -6,4 +6,5 @@ include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DI
|
||||||
bro_plugin_begin(Bro ConnSize)
|
bro_plugin_begin(Bro ConnSize)
|
||||||
bro_plugin_cc(ConnSize.cc Plugin.cc)
|
bro_plugin_cc(ConnSize.cc Plugin.cc)
|
||||||
bro_plugin_bif(events.bif)
|
bro_plugin_bif(events.bif)
|
||||||
|
bro_plugin_bif(functions.bif)
|
||||||
bro_plugin_end()
|
bro_plugin_end()
|
||||||
|
|
|
||||||
|
|
@ -29,6 +29,11 @@ void ConnSize_Analyzer::Init()
|
||||||
orig_pkts = 0;
|
orig_pkts = 0;
|
||||||
resp_bytes = 0;
|
resp_bytes = 0;
|
||||||
resp_pkts = 0;
|
resp_pkts = 0;
|
||||||
|
|
||||||
|
orig_bytes_thresh = 0;
|
||||||
|
orig_pkts_thresh = 0;
|
||||||
|
resp_bytes_thresh = 0;
|
||||||
|
resp_pkts_thresh = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
void ConnSize_Analyzer::Done()
|
void ConnSize_Analyzer::Done()
|
||||||
|
|
@ -36,6 +41,50 @@ void ConnSize_Analyzer::Done()
|
||||||
Analyzer::Done();
|
Analyzer::Done();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
void ConnSize_Analyzer::ThresholdEvent(EventHandlerPtr f, uint64 threshold, bool is_orig)
|
||||||
|
{
|
||||||
|
if ( ! f )
|
||||||
|
return;
|
||||||
|
|
||||||
|
val_list* vl = new val_list;
|
||||||
|
vl->append(BuildConnVal());
|
||||||
|
vl->append(new Val(threshold, TYPE_COUNT));
|
||||||
|
vl->append(new Val(is_orig, TYPE_BOOL));
|
||||||
|
ConnectionEvent(f, vl);
|
||||||
|
}
|
||||||
|
|
||||||
|
void ConnSize_Analyzer::CheckSizes(bool is_orig)
|
||||||
|
{
|
||||||
|
if ( is_orig )
|
||||||
|
{
|
||||||
|
if ( orig_bytes_thresh && orig_bytes >= orig_bytes_thresh )
|
||||||
|
{
|
||||||
|
ThresholdEvent(conn_bytes_threshold_crossed, orig_bytes_thresh, is_orig);
|
||||||
|
orig_bytes_thresh = 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( orig_pkts_thresh && orig_pkts >= orig_pkts_thresh )
|
||||||
|
{
|
||||||
|
ThresholdEvent(conn_packets_threshold_crossed, orig_pkts_thresh, is_orig);
|
||||||
|
orig_pkts_thresh = 0;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
if ( resp_bytes_thresh && resp_bytes >= resp_bytes_thresh )
|
||||||
|
{
|
||||||
|
ThresholdEvent(conn_bytes_threshold_crossed, resp_bytes_thresh, is_orig);
|
||||||
|
resp_bytes_thresh = 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( resp_pkts_thresh && resp_pkts >= resp_pkts_thresh )
|
||||||
|
{
|
||||||
|
ThresholdEvent(conn_packets_threshold_crossed, resp_pkts_thresh, is_orig);
|
||||||
|
resp_pkts_thresh = 0;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
void ConnSize_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, uint64 seq, const IP_Hdr* ip, int caplen)
|
void ConnSize_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, uint64 seq, const IP_Hdr* ip, int caplen)
|
||||||
{
|
{
|
||||||
Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen);
|
Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen);
|
||||||
|
|
@ -50,6 +99,47 @@ void ConnSize_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
|
||||||
resp_bytes += ip->TotalLen();
|
resp_bytes += ip->TotalLen();
|
||||||
resp_pkts ++;
|
resp_pkts ++;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
CheckSizes(is_orig);
|
||||||
|
}
|
||||||
|
|
||||||
|
void ConnSize_Analyzer::SetThreshold(uint64 threshold, bool bytes, bool orig)
|
||||||
|
{
|
||||||
|
if ( bytes )
|
||||||
|
{
|
||||||
|
if ( orig )
|
||||||
|
orig_bytes_thresh = threshold;
|
||||||
|
else
|
||||||
|
resp_bytes_thresh = threshold;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
if ( orig )
|
||||||
|
orig_pkts_thresh = threshold;
|
||||||
|
else
|
||||||
|
resp_pkts_thresh = threshold;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check if threshold is already crossed.
|
||||||
|
CheckSizes(orig);
|
||||||
|
}
|
||||||
|
|
||||||
|
uint64_t ConnSize_Analyzer::GetThreshold(bool bytes, bool orig)
|
||||||
|
{
|
||||||
|
if ( bytes )
|
||||||
|
{
|
||||||
|
if ( orig )
|
||||||
|
return orig_bytes_thresh;
|
||||||
|
else
|
||||||
|
return resp_bytes_thresh;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
if ( orig )
|
||||||
|
return orig_pkts_thresh;
|
||||||
|
else
|
||||||
|
return resp_pkts_thresh;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void ConnSize_Analyzer::UpdateConnVal(RecordVal *conn_val)
|
void ConnSize_Analyzer::UpdateConnVal(RecordVal *conn_val)
|
||||||
|
|
|
||||||
|
|
@ -21,18 +21,28 @@ public:
|
||||||
virtual void UpdateConnVal(RecordVal *conn_val);
|
virtual void UpdateConnVal(RecordVal *conn_val);
|
||||||
virtual void FlipRoles();
|
virtual void FlipRoles();
|
||||||
|
|
||||||
|
void SetThreshold(uint64_t threshold, bool bytes, bool orig);
|
||||||
|
uint64 GetThreshold(bool bytes, bool orig);
|
||||||
|
|
||||||
static analyzer::Analyzer* Instantiate(Connection* conn)
|
static analyzer::Analyzer* Instantiate(Connection* conn)
|
||||||
{ return new ConnSize_Analyzer(conn); }
|
{ return new ConnSize_Analyzer(conn); }
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
virtual void DeliverPacket(int len, const u_char* data, bool is_orig,
|
virtual void DeliverPacket(int len, const u_char* data, bool is_orig,
|
||||||
uint64 seq, const IP_Hdr* ip, int caplen);
|
uint64 seq, const IP_Hdr* ip, int caplen);
|
||||||
|
void CheckSizes(bool is_orig);
|
||||||
|
|
||||||
|
void ThresholdEvent(EventHandlerPtr f, uint64 threshold, bool is_orig);
|
||||||
|
|
||||||
uint64_t orig_bytes;
|
uint64_t orig_bytes;
|
||||||
uint64_t resp_bytes;
|
uint64_t resp_bytes;
|
||||||
uint64_t orig_pkts;
|
uint64_t orig_pkts;
|
||||||
uint64_t resp_pkts;
|
uint64_t resp_pkts;
|
||||||
|
|
||||||
|
uint64_t orig_bytes_thresh;
|
||||||
|
uint64_t resp_bytes_thresh;
|
||||||
|
uint64_t orig_pkts_thresh;
|
||||||
|
uint64_t resp_pkts_thresh;
|
||||||
};
|
};
|
||||||
|
|
||||||
} } // namespace analyzer::*
|
} } // namespace analyzer::*
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,27 @@
|
||||||
|
## Generated for a connection that crossed a set byte threshold. Note that this
|
||||||
|
## is a low level event that should usually be avoided for user code. Use
|
||||||
|
## ConnThreshold::bytes_threshold_crossed instead.
|
||||||
|
##
|
||||||
|
## c: the connection
|
||||||
|
##
|
||||||
|
## threshold: the threshold that was set
|
||||||
|
##
|
||||||
|
## is_orig: true if the threshold was crossed by the originator of the connection
|
||||||
|
##
|
||||||
|
## .. bro:see:: set_current_conn_packets_threshold set_current_conn_bytes_threshold conn_packets_threshold_crossed
|
||||||
|
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
|
||||||
|
event conn_bytes_threshold_crossed%(c: connection, threshold: count, is_orig: bool%);
|
||||||
|
|
||||||
|
## Generated for a connection that crossed a set packet threshold. Note that this
|
||||||
|
## is a low level event that should usually be avoided for user code. Use
|
||||||
|
## ConnThreshold::bytes_threshold_crossed instead.
|
||||||
|
##
|
||||||
|
## c: the connection
|
||||||
|
##
|
||||||
|
## threshold: the threshold that was set
|
||||||
|
##
|
||||||
|
## is_orig: true if the threshold was crossed by the originator of the connection
|
||||||
|
##
|
||||||
|
## .. bro:see:: set_current_conn_packets_threshold set_current_conn_bytes_threshold conn_bytes_threshold_crossed
|
||||||
|
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
|
||||||
|
event conn_packets_threshold_crossed%(c: connection, threshold: count, is_orig: bool%);
|
||||||
109
src/analyzer/protocol/conn-size/functions.bif
Normal file
109
src/analyzer/protocol/conn-size/functions.bif
Normal file
|
|
@ -0,0 +1,109 @@
|
||||||
|
%%{
|
||||||
|
#include "analyzer/protocol/conn-size/ConnSize.h"
|
||||||
|
|
||||||
|
static analyzer::Analyzer* GetConnsizeAnalyzer(Val* cid)
|
||||||
|
{
|
||||||
|
Connection* c = sessions->FindConnection(cid);
|
||||||
|
if ( ! c )
|
||||||
|
{
|
||||||
|
reporter->Error("cannot find connection");
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
analyzer::Analyzer* a = c->FindAnalyzer("CONNSIZE");
|
||||||
|
if ( ! a )
|
||||||
|
reporter->Error("connection does not have ConnSize analyzer");
|
||||||
|
|
||||||
|
return a;
|
||||||
|
}
|
||||||
|
|
||||||
|
%%}
|
||||||
|
|
||||||
|
## Sets the current byte threshold for connection sizes, overwriting any potential old
|
||||||
|
## threshold. Be aware that in nearly any case you will want to use the high level API
|
||||||
|
## instead (ConnThreshold::set_bytes_threshold).
|
||||||
|
##
|
||||||
|
## cid: The connection id.
|
||||||
|
##
|
||||||
|
## threshold: Threshold in bytes.
|
||||||
|
##
|
||||||
|
## is_orig: If true, threshold is set for bytes from originator, otherwhise for bytes from responder.
|
||||||
|
##
|
||||||
|
## .. bro:see:: set_current_conn_packets_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
|
||||||
|
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
|
||||||
|
function set_current_conn_bytes_threshold%(cid: conn_id, threshold: count, is_orig: bool%): bool
|
||||||
|
%{
|
||||||
|
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
|
||||||
|
if ( ! a )
|
||||||
|
return new Val(0, TYPE_BOOL);
|
||||||
|
|
||||||
|
static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->SetThreshold(threshold, 1, is_orig);
|
||||||
|
|
||||||
|
return new Val(1, TYPE_BOOL);
|
||||||
|
%}
|
||||||
|
|
||||||
|
## Sets a threshold for connection packets, overwtiting any potential old thresholds.
|
||||||
|
## Be aware that in nearly any case you will want to use the high level API
|
||||||
|
## instead (ConnThreshold::set_packets_threshold).
|
||||||
|
##
|
||||||
|
## cid: The connection id.
|
||||||
|
##
|
||||||
|
## threshold: Threshold in packets.
|
||||||
|
##
|
||||||
|
## is_orig: If true, threshold is set for packets from originator, otherwhise for packets from responder.
|
||||||
|
##
|
||||||
|
## .. bro:see:: set_current_conn_bytes_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
|
||||||
|
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
|
||||||
|
function set_current_conn_packets_threshold%(cid: conn_id, threshold: count, is_orig: bool%): bool
|
||||||
|
%{
|
||||||
|
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
|
||||||
|
if ( ! a )
|
||||||
|
return new Val(0, TYPE_BOOL);
|
||||||
|
|
||||||
|
static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->SetThreshold(threshold, 0, is_orig);
|
||||||
|
|
||||||
|
return new Val(1, TYPE_BOOL);
|
||||||
|
%}
|
||||||
|
|
||||||
|
## Gets the current byte threshold size for a connection.
|
||||||
|
##
|
||||||
|
## cid: The connection id.
|
||||||
|
##
|
||||||
|
## is_orig: If true, threshold of originator, otherwhise threshold of responder.
|
||||||
|
##
|
||||||
|
## Returns: 0 if no threshold is set or the threshold in bytes
|
||||||
|
##
|
||||||
|
## .. bro:see:: set_current_conn_packets_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
|
||||||
|
## get_current_conn_packets_threshold
|
||||||
|
function get_current_conn_bytes_threshold%(cid: conn_id, is_orig: bool%): count
|
||||||
|
%{
|
||||||
|
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
|
||||||
|
if ( ! a )
|
||||||
|
return new Val(0, TYPE_COUNT);
|
||||||
|
|
||||||
|
return new Val(
|
||||||
|
static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetThreshold(1, is_orig),
|
||||||
|
TYPE_COUNT);
|
||||||
|
%}
|
||||||
|
|
||||||
|
## Gets the current packet threshold size for a connection.
|
||||||
|
##
|
||||||
|
## cid: The connection id.
|
||||||
|
##
|
||||||
|
## is_orig: If true, threshold of originator, otherwhise threshold of responder.
|
||||||
|
##
|
||||||
|
## Returns: 0 if no threshold is set or the threshold in packets
|
||||||
|
##
|
||||||
|
## .. bro:see:: set_current_conn_packets_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
|
||||||
|
## get_current_conn_bytes_threshold
|
||||||
|
function get_current_conn_packets_threshold%(cid: conn_id, is_orig: bool%): count
|
||||||
|
%{
|
||||||
|
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
|
||||||
|
if ( ! a )
|
||||||
|
return new Val(0, TYPE_COUNT);
|
||||||
|
|
||||||
|
return new Val(
|
||||||
|
static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetThreshold(0, is_orig),
|
||||||
|
TYPE_COUNT);
|
||||||
|
%}
|
||||||
|
|
||||||
|
|
@ -81,7 +81,7 @@ void PIA::PIA_Done()
|
||||||
}
|
}
|
||||||
|
|
||||||
void PIA::PIA_DeliverPacket(int len, const u_char* data, bool is_orig, uint64 seq,
|
void PIA::PIA_DeliverPacket(int len, const u_char* data, bool is_orig, uint64 seq,
|
||||||
const IP_Hdr* ip, int caplen)
|
const IP_Hdr* ip, int caplen, bool clear_state)
|
||||||
{
|
{
|
||||||
if ( pkt_buffer.state == SKIPPING )
|
if ( pkt_buffer.state == SKIPPING )
|
||||||
return;
|
return;
|
||||||
|
|
@ -108,6 +108,9 @@ void PIA::PIA_DeliverPacket(int len, const u_char* data, bool is_orig, uint64 se
|
||||||
// FIXME: I'm not sure why it does not work with eol=true...
|
// FIXME: I'm not sure why it does not work with eol=true...
|
||||||
DoMatch(data, len, is_orig, true, false, false, ip);
|
DoMatch(data, len, is_orig, true, false, false, ip);
|
||||||
|
|
||||||
|
if ( clear_state )
|
||||||
|
RuleMatcherState::ClearMatchState(is_orig);
|
||||||
|
|
||||||
pkt_buffer.state = new_state;
|
pkt_buffer.state = new_state;
|
||||||
|
|
||||||
current_packet.data = 0;
|
current_packet.data = 0;
|
||||||
|
|
|
||||||
|
|
@ -42,7 +42,7 @@ public:
|
||||||
protected:
|
protected:
|
||||||
void PIA_Done();
|
void PIA_Done();
|
||||||
void PIA_DeliverPacket(int len, const u_char* data, bool is_orig,
|
void PIA_DeliverPacket(int len, const u_char* data, bool is_orig,
|
||||||
uint64 seq, const IP_Hdr* ip, int caplen);
|
uint64 seq, const IP_Hdr* ip, int caplen, bool clear_state);
|
||||||
|
|
||||||
enum State { INIT, BUFFERING, MATCHING_ONLY, SKIPPING } state;
|
enum State { INIT, BUFFERING, MATCHING_ONLY, SKIPPING } state;
|
||||||
|
|
||||||
|
|
@ -109,7 +109,7 @@ protected:
|
||||||
uint64 seq, const IP_Hdr* ip, int caplen)
|
uint64 seq, const IP_Hdr* ip, int caplen)
|
||||||
{
|
{
|
||||||
Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen);
|
Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen);
|
||||||
PIA_DeliverPacket(len, data, is_orig, seq, ip, caplen);
|
PIA_DeliverPacket(len, data, is_orig, seq, ip, caplen, true);
|
||||||
}
|
}
|
||||||
|
|
||||||
virtual void ActivateAnalyzer(analyzer::Tag tag, const Rule* rule);
|
virtual void ActivateAnalyzer(analyzer::Tag tag, const Rule* rule);
|
||||||
|
|
@ -154,7 +154,7 @@ protected:
|
||||||
uint64 seq, const IP_Hdr* ip, int caplen)
|
uint64 seq, const IP_Hdr* ip, int caplen)
|
||||||
{
|
{
|
||||||
Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen);
|
Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen);
|
||||||
PIA_DeliverPacket(len, data, is_orig, seq, ip, caplen);
|
PIA_DeliverPacket(len, data, is_orig, seq, ip, caplen, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
virtual void DeliverStream(int len, const u_char* data, bool is_orig);
|
virtual void DeliverStream(int len, const u_char* data, bool is_orig);
|
||||||
|
|
|
||||||
|
|
@ -62,7 +62,7 @@ void RDP_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
|
||||||
{
|
{
|
||||||
reporter->AnalyzerError(this,
|
reporter->AnalyzerError(this,
|
||||||
"failed to add TCP child analyzer "
|
"failed to add TCP child analyzer "
|
||||||
"to RPD analyzer: already exists");
|
"to RDP analyzer: already exists");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -367,6 +367,41 @@ void TCP_Analyzer::Done()
|
||||||
finished = 1;
|
finished = 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
analyzer::Analyzer* TCP_Analyzer::FindChild(ID arg_id)
|
||||||
|
{
|
||||||
|
analyzer::Analyzer* child = analyzer::TransportLayerAnalyzer::FindChild(arg_id);
|
||||||
|
|
||||||
|
if ( child )
|
||||||
|
return child;
|
||||||
|
|
||||||
|
LOOP_OVER_GIVEN_CHILDREN(i, packet_children)
|
||||||
|
{
|
||||||
|
analyzer::Analyzer* child = (*i)->FindChild(arg_id);
|
||||||
|
if ( child )
|
||||||
|
return child;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
analyzer::Analyzer* TCP_Analyzer::FindChild(Tag arg_tag)
|
||||||
|
{
|
||||||
|
analyzer::Analyzer* child = analyzer::TransportLayerAnalyzer::FindChild(arg_tag);
|
||||||
|
|
||||||
|
if ( child )
|
||||||
|
return child;
|
||||||
|
|
||||||
|
LOOP_OVER_GIVEN_CHILDREN(i, packet_children)
|
||||||
|
{
|
||||||
|
analyzer::Analyzer* child = (*i)->FindChild(arg_tag);
|
||||||
|
if ( child )
|
||||||
|
return child;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
void TCP_Analyzer::EnableReassembly()
|
void TCP_Analyzer::EnableReassembly()
|
||||||
{
|
{
|
||||||
SetReassembler(new TCP_Reassembler(this, this,
|
SetReassembler(new TCP_Reassembler(this, this,
|
||||||
|
|
@ -1764,6 +1799,15 @@ bool TCP_Analyzer::HadGap(bool is_orig) const
|
||||||
return endp && endp->HadGap();
|
return endp && endp->HadGap();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
void TCP_Analyzer::AddChildPacketAnalyzer(analyzer::Analyzer* a)
|
||||||
|
{
|
||||||
|
DBG_LOG(DBG_ANALYZER, "%s added packet child %s",
|
||||||
|
this->GetAnalyzerName(), a->GetAnalyzerName());
|
||||||
|
|
||||||
|
packet_children.push_back(a);
|
||||||
|
a->SetParent(this);
|
||||||
|
}
|
||||||
|
|
||||||
int TCP_Analyzer::DataPending(TCP_Endpoint* closing_endp)
|
int TCP_Analyzer::DataPending(TCP_Endpoint* closing_endp)
|
||||||
{
|
{
|
||||||
if ( Skipping() )
|
if ( Skipping() )
|
||||||
|
|
|
||||||
|
|
@ -47,8 +47,10 @@ public:
|
||||||
|
|
||||||
// Add a child analyzer that will always get the packets,
|
// Add a child analyzer that will always get the packets,
|
||||||
// independently of whether we do any reassembly.
|
// independently of whether we do any reassembly.
|
||||||
void AddChildPacketAnalyzer(analyzer::Analyzer* a)
|
void AddChildPacketAnalyzer(analyzer::Analyzer* a);
|
||||||
{ packet_children.push_back(a); a->SetParent(this); }
|
|
||||||
|
virtual Analyzer* FindChild(ID id);
|
||||||
|
virtual Analyzer* FindChild(Tag tag);
|
||||||
|
|
||||||
// True if the connection has closed in some sense, false otherwise.
|
// True if the connection has closed in some sense, false otherwise.
|
||||||
int IsClosed() const { return orig->did_close || resp->did_close; }
|
int IsClosed() const { return orig->did_close || resp->did_close; }
|
||||||
|
|
|
||||||
|
|
@ -2247,7 +2247,7 @@ function to_count%(str: string%): count
|
||||||
const char* s = str->CheckString();
|
const char* s = str->CheckString();
|
||||||
char* end_s;
|
char* end_s;
|
||||||
|
|
||||||
uint64 u = (uint64) strtoll(s, &end_s, 10);
|
uint64 u = (uint64) strtoull(s, &end_s, 10);
|
||||||
|
|
||||||
if ( s[0] == '\0' || end_s[0] != '\0' )
|
if ( s[0] == '\0' || end_s[0] != '\0' )
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -26,8 +26,15 @@ int bro_broker::Manager::send_flags_unsolicited_idx;
|
||||||
|
|
||||||
bro_broker::Manager::~Manager()
|
bro_broker::Manager::~Manager()
|
||||||
{
|
{
|
||||||
|
vector<decltype(data_stores)::key_type> stores_to_close;
|
||||||
|
|
||||||
for ( auto& s : data_stores )
|
for ( auto& s : data_stores )
|
||||||
CloseStore(s.first.first, s.first.second);
|
stores_to_close.emplace_back(s.first);
|
||||||
|
|
||||||
|
for ( auto& s : stores_to_close )
|
||||||
|
// This doesn't loop directly over data_stores, because CloseStore
|
||||||
|
// modifies the map and invalidates iterators.
|
||||||
|
CloseStore(s.first, s.second);
|
||||||
}
|
}
|
||||||
|
|
||||||
static int require_field(RecordType* rt, const char* name)
|
static int require_field(RecordType* rt, const char* name)
|
||||||
|
|
|
||||||
|
|
@ -9,7 +9,7 @@
|
||||||
using namespace input;
|
using namespace input;
|
||||||
|
|
||||||
Component::Component(const std::string& name, factory_callback arg_factory)
|
Component::Component(const std::string& name, factory_callback arg_factory)
|
||||||
: plugin::Component(plugin::component::WRITER, name)
|
: plugin::Component(plugin::component::READER, name)
|
||||||
{
|
{
|
||||||
factory = arg_factory;
|
factory = arg_factory;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -8,6 +8,7 @@
|
||||||
#include <fcntl.h>
|
#include <fcntl.h>
|
||||||
#include <errno.h>
|
#include <errno.h>
|
||||||
#include <signal.h>
|
#include <signal.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
|
||||||
#include "Raw.h"
|
#include "Raw.h"
|
||||||
#include "Plugin.h"
|
#include "Plugin.h"
|
||||||
|
|
@ -298,6 +299,17 @@ bool Raw::OpenInput()
|
||||||
Warning(Fmt("Init: cannot set close-on-exec for %s", fname.c_str()));
|
Warning(Fmt("Init: cannot set close-on-exec for %s", fname.c_str()));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if ( offset )
|
||||||
|
{
|
||||||
|
int whence = (offset > 0) ? SEEK_SET : SEEK_END;
|
||||||
|
if ( fseek(file, offset, whence) < 0 )
|
||||||
|
{
|
||||||
|
char buf[256];
|
||||||
|
strerror_r(errno, buf, sizeof(buf));
|
||||||
|
Error(Fmt("Seek failed in init: %s", buf));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -377,6 +389,20 @@ bool Raw::DoInit(const ReaderInfo& info, int num_fields, const Field* const* fie
|
||||||
forcekill = true;
|
forcekill = true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
it = info.config.find("offset"); // we want to seek to a given offset inside the file
|
||||||
|
if ( it != info.config.end() && ! execute && (Info().mode == MODE_STREAM || Info().mode == MODE_MANUAL) )
|
||||||
|
{
|
||||||
|
string offset_s = it->second;
|
||||||
|
offset = strtoll(offset_s.c_str(), 0, 10);
|
||||||
|
if ( offset < 0 )
|
||||||
|
offset++; // we want -1 to be the end of the file
|
||||||
|
}
|
||||||
|
else if ( it != info.config.end() )
|
||||||
|
{
|
||||||
|
Error("Offset only is supported for MODE_STREAM and MODE_MANUAL; it is also not supported when executing a command");
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
if ( num_fields != want_fields )
|
if ( num_fields != want_fields )
|
||||||
{
|
{
|
||||||
Error(Fmt("Filter for raw reader contains wrong number of fields -- got %d, expected %d. "
|
Error(Fmt("Filter for raw reader contains wrong number of fields -- got %d, expected %d. "
|
||||||
|
|
|
||||||
|
|
@ -65,6 +65,8 @@ private:
|
||||||
|
|
||||||
bool forcekill;
|
bool forcekill;
|
||||||
|
|
||||||
|
int64_t offset;
|
||||||
|
|
||||||
int pipes[6];
|
int pipes[6];
|
||||||
pid_t childpid;
|
pid_t childpid;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -24,6 +24,7 @@ Manager::~Manager()
|
||||||
for ( SourceList::iterator i = sources.begin(); i != sources.end(); ++i )
|
for ( SourceList::iterator i = sources.begin(); i != sources.end(); ++i )
|
||||||
{
|
{
|
||||||
(*i)->src->Done();
|
(*i)->src->Done();
|
||||||
|
delete (*i)->src;
|
||||||
delete *i;
|
delete *i;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -183,9 +184,24 @@ finished:
|
||||||
|
|
||||||
void Manager::Register(IOSource* src, bool dont_count)
|
void Manager::Register(IOSource* src, bool dont_count)
|
||||||
{
|
{
|
||||||
|
// First see if we already have registered that source. If so, just
|
||||||
|
// adjust dont_count.
|
||||||
|
for ( SourceList::iterator i = sources.begin(); i != sources.end(); ++i )
|
||||||
|
{
|
||||||
|
if ( (*i)->src == src )
|
||||||
|
{
|
||||||
|
if ( (*i)->dont_count != dont_count )
|
||||||
|
// Adjust the global counter.
|
||||||
|
dont_counts += (dont_count ? 1 : -1);
|
||||||
|
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
src->Init();
|
src->Init();
|
||||||
Source* s = new Source;
|
Source* s = new Source;
|
||||||
s->src = src;
|
s->src = src;
|
||||||
|
s->dont_count = dont_count;
|
||||||
if ( dont_count )
|
if ( dont_count )
|
||||||
++dont_counts;
|
++dont_counts;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -29,7 +29,9 @@ public:
|
||||||
~Manager();
|
~Manager();
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Registers an IOSource with the manager.
|
* Registers an IOSource with the manager. If the source is already
|
||||||
|
* registered, the method will update its *dont_count* value but not
|
||||||
|
* do anything else.
|
||||||
*
|
*
|
||||||
* @param src The source. The manager takes ownership.
|
* @param src The source. The manager takes ownership.
|
||||||
*
|
*
|
||||||
|
|
@ -117,6 +119,7 @@ private:
|
||||||
FD_Set fd_read;
|
FD_Set fd_read;
|
||||||
FD_Set fd_write;
|
FD_Set fd_write;
|
||||||
FD_Set fd_except;
|
FD_Set fd_except;
|
||||||
|
bool dont_count;
|
||||||
|
|
||||||
bool Ready(fd_set* read, fd_set* write, fd_set* except) const
|
bool Ready(fd_set* read, fd_set* write, fd_set* except) const
|
||||||
{ return fd_read.Ready(read) || fd_write.Ready(write) ||
|
{ return fd_read.Ready(read) || fd_write.Ready(write) ||
|
||||||
|
|
|
||||||
|
|
@ -181,10 +181,9 @@ bool Ascii::InitFormatter()
|
||||||
Ascii::~Ascii()
|
Ascii::~Ascii()
|
||||||
{
|
{
|
||||||
if ( ! ascii_done )
|
if ( ! ascii_done )
|
||||||
{
|
// In case of errors aborting the logging altogether,
|
||||||
fprintf(stderr, "internal error: finish missing\n");
|
// DoFinish() may not have been called.
|
||||||
abort();
|
CloseFile(network_time);
|
||||||
}
|
|
||||||
|
|
||||||
delete formatter;
|
delete formatter;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
19
src/main.cc
19
src/main.cc
|
|
@ -117,7 +117,6 @@ SampleLogger* sample_logger = 0;
|
||||||
int signal_val = 0;
|
int signal_val = 0;
|
||||||
int optimize = 0;
|
int optimize = 0;
|
||||||
int do_notice_analysis = 0;
|
int do_notice_analysis = 0;
|
||||||
int rule_bench = 0;
|
|
||||||
extern char version[];
|
extern char version[];
|
||||||
char* command_line_policy = 0;
|
char* command_line_policy = 0;
|
||||||
vector<string> params;
|
vector<string> params;
|
||||||
|
|
@ -179,8 +178,6 @@ void usage()
|
||||||
fprintf(stderr, " -i|--iface <interface> | read from given interface\n");
|
fprintf(stderr, " -i|--iface <interface> | read from given interface\n");
|
||||||
fprintf(stderr, " -p|--prefix <prefix> | add given prefix to policy file resolution\n");
|
fprintf(stderr, " -p|--prefix <prefix> | add given prefix to policy file resolution\n");
|
||||||
fprintf(stderr, " -r|--readfile <readfile> | read from given tcpdump file\n");
|
fprintf(stderr, " -r|--readfile <readfile> | read from given tcpdump file\n");
|
||||||
fprintf(stderr, " -y|--flowfile <file>[=<ident>] | read from given flow file\n");
|
|
||||||
fprintf(stderr, " -Y|--netflow <ip>:<prt>[=<id>] | read flow from socket\n");
|
|
||||||
fprintf(stderr, " -s|--rulefile <rulefile> | read rules from given file\n");
|
fprintf(stderr, " -s|--rulefile <rulefile> | read rules from given file\n");
|
||||||
fprintf(stderr, " -t|--tracefile <tracefile> | activate execution tracing\n");
|
fprintf(stderr, " -t|--tracefile <tracefile> | activate execution tracing\n");
|
||||||
fprintf(stderr, " -w|--writefile <writefile> | write to given tcpdump file\n");
|
fprintf(stderr, " -w|--writefile <writefile> | write to given tcpdump file\n");
|
||||||
|
|
@ -191,11 +188,9 @@ void usage()
|
||||||
fprintf(stderr, " -B|--debug <dbgstreams> | Enable debugging output for selected streams ('-B help' for help)\n");
|
fprintf(stderr, " -B|--debug <dbgstreams> | Enable debugging output for selected streams ('-B help' for help)\n");
|
||||||
#endif
|
#endif
|
||||||
fprintf(stderr, " -C|--no-checksums | ignore checksums\n");
|
fprintf(stderr, " -C|--no-checksums | ignore checksums\n");
|
||||||
fprintf(stderr, " -D|--dfa-size <size> | DFA state cache size\n");
|
|
||||||
fprintf(stderr, " -F|--force-dns | force DNS\n");
|
fprintf(stderr, " -F|--force-dns | force DNS\n");
|
||||||
fprintf(stderr, " -I|--print-id <ID name> | print out given ID\n");
|
fprintf(stderr, " -I|--print-id <ID name> | print out given ID\n");
|
||||||
fprintf(stderr, " -K|--md5-hashkey <hashkey> | set key for MD5-keyed hashing\n");
|
fprintf(stderr, " -K|--md5-hashkey <hashkey> | set key for MD5-keyed hashing\n");
|
||||||
fprintf(stderr, " -L|--rule-benchmark | benchmark for rules\n");
|
|
||||||
fprintf(stderr, " -N|--print-plugins | print available plugins and exit (-NN for verbose)\n");
|
fprintf(stderr, " -N|--print-plugins | print available plugins and exit (-NN for verbose)\n");
|
||||||
fprintf(stderr, " -O|--optimize | optimize policy script\n");
|
fprintf(stderr, " -O|--optimize | optimize policy script\n");
|
||||||
fprintf(stderr, " -P|--prime-dns | prime DNS\n");
|
fprintf(stderr, " -P|--prime-dns | prime DNS\n");
|
||||||
|
|
@ -488,8 +483,6 @@ int main(int argc, char** argv)
|
||||||
{"broxygen", required_argument, 0, 'X'},
|
{"broxygen", required_argument, 0, 'X'},
|
||||||
{"prefix", required_argument, 0, 'p'},
|
{"prefix", required_argument, 0, 'p'},
|
||||||
{"readfile", required_argument, 0, 'r'},
|
{"readfile", required_argument, 0, 'r'},
|
||||||
{"flowfile", required_argument, 0, 'y'},
|
|
||||||
{"netflow", required_argument, 0, 'Y'},
|
|
||||||
{"rulefile", required_argument, 0, 's'},
|
{"rulefile", required_argument, 0, 's'},
|
||||||
{"tracefile", required_argument, 0, 't'},
|
{"tracefile", required_argument, 0, 't'},
|
||||||
{"writefile", required_argument, 0, 'w'},
|
{"writefile", required_argument, 0, 'w'},
|
||||||
|
|
@ -497,13 +490,11 @@ int main(int argc, char** argv)
|
||||||
{"print-state", required_argument, 0, 'x'},
|
{"print-state", required_argument, 0, 'x'},
|
||||||
{"analyze", required_argument, 0, 'z'},
|
{"analyze", required_argument, 0, 'z'},
|
||||||
{"no-checksums", no_argument, 0, 'C'},
|
{"no-checksums", no_argument, 0, 'C'},
|
||||||
{"dfa-cache", required_argument, 0, 'D'},
|
|
||||||
{"force-dns", no_argument, 0, 'F'},
|
{"force-dns", no_argument, 0, 'F'},
|
||||||
{"load-seeds", required_argument, 0, 'G'},
|
{"load-seeds", required_argument, 0, 'G'},
|
||||||
{"save-seeds", required_argument, 0, 'H'},
|
{"save-seeds", required_argument, 0, 'H'},
|
||||||
{"set-seed", required_argument, 0, 'J'},
|
{"set-seed", required_argument, 0, 'J'},
|
||||||
{"md5-hashkey", required_argument, 0, 'K'},
|
{"md5-hashkey", required_argument, 0, 'K'},
|
||||||
{"rule-benchmark", no_argument, 0, 'L'},
|
|
||||||
{"print-plugins", no_argument, 0, 'N'},
|
{"print-plugins", no_argument, 0, 'N'},
|
||||||
{"optimize", no_argument, 0, 'O'},
|
{"optimize", no_argument, 0, 'O'},
|
||||||
{"prime-dns", no_argument, 0, 'P'},
|
{"prime-dns", no_argument, 0, 'P'},
|
||||||
|
|
@ -557,7 +548,7 @@ int main(int argc, char** argv)
|
||||||
opterr = 0;
|
opterr = 0;
|
||||||
|
|
||||||
char opts[256];
|
char opts[256];
|
||||||
safe_strncpy(opts, "B:D:e:f:I:i:K:l:n:p:R:r:s:T:t:U:w:x:X:z:CFGLNOPSWabdghvZQ",
|
safe_strncpy(opts, "B:e:f:I:i:K:l:n:p:R:r:s:T:t:U:w:x:X:z:CFGLNOPSWabdghvZQ",
|
||||||
sizeof(opts));
|
sizeof(opts));
|
||||||
|
|
||||||
#ifdef USE_PERFTOOLS_DEBUG
|
#ifdef USE_PERFTOOLS_DEBUG
|
||||||
|
|
@ -631,10 +622,6 @@ int main(int argc, char** argv)
|
||||||
override_ignore_checksums = 1;
|
override_ignore_checksums = 1;
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case 'D':
|
|
||||||
dfa_state_cache_size = atoi(optarg);
|
|
||||||
break;
|
|
||||||
|
|
||||||
case 'E':
|
case 'E':
|
||||||
pseudo_realtime = 1.0;
|
pseudo_realtime = 1.0;
|
||||||
if ( optarg )
|
if ( optarg )
|
||||||
|
|
@ -668,10 +655,6 @@ int main(int argc, char** argv)
|
||||||
hmac_key_set = 1;
|
hmac_key_set = 1;
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case 'L':
|
|
||||||
++rule_bench;
|
|
||||||
break;
|
|
||||||
|
|
||||||
case 'N':
|
case 'N':
|
||||||
++print_plugins;
|
++print_plugins;
|
||||||
break;
|
break;
|
||||||
|
|
|
||||||
|
|
@ -7,3 +7,4 @@
|
||||||
18446744073709551611
|
18446744073709551611
|
||||||
0
|
0
|
||||||
123
|
123
|
||||||
|
9223372036854775808 and 9223372036854775808 are the same
|
||||||
|
|
|
||||||
23
testing/btest/Baseline/core.conn-size-threshold/.stdout
Normal file
23
testing/btest/Baseline/core.conn-size-threshold/.stdout
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
0
|
||||||
|
0
|
||||||
|
0
|
||||||
|
0
|
||||||
|
Threshold set for [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp]
|
||||||
|
3000
|
||||||
|
2000
|
||||||
|
63
|
||||||
|
50
|
||||||
|
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2000, F
|
||||||
|
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 3000, T
|
||||||
|
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 50, F
|
||||||
|
0
|
||||||
|
0
|
||||||
|
0
|
||||||
|
0
|
||||||
|
Threshold set for [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp]
|
||||||
|
3000
|
||||||
|
2000
|
||||||
|
63
|
||||||
|
50
|
||||||
|
triggered bytes, [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp], 2000, F
|
||||||
|
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 63, T
|
||||||
|
|
@ -3,7 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path loaded_scripts
|
#path loaded_scripts
|
||||||
#open 2015-03-05-20-42-42
|
#open 2015-04-17-16-40-15
|
||||||
#fields name
|
#fields name
|
||||||
#types string
|
#types string
|
||||||
scripts/base/init-bare.bro
|
scripts/base/init-bare.bro
|
||||||
|
|
@ -59,6 +59,7 @@ scripts/base/init-bare.bro
|
||||||
build/scripts/base/bif/plugins/Bro_BackDoor.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_BackDoor.events.bif.bro
|
||||||
build/scripts/base/bif/plugins/Bro_BitTorrent.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_BitTorrent.events.bif.bro
|
||||||
build/scripts/base/bif/plugins/Bro_ConnSize.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_ConnSize.events.bif.bro
|
||||||
|
build/scripts/base/bif/plugins/Bro_ConnSize.functions.bif.bro
|
||||||
build/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro
|
||||||
build/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro
|
||||||
build/scripts/base/bif/plugins/Bro_DNP3.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_DNP3.events.bif.bro
|
||||||
|
|
@ -124,4 +125,4 @@ scripts/base/init-bare.bro
|
||||||
build/scripts/base/bif/plugins/Bro_SQLiteWriter.sqlite.bif.bro
|
build/scripts/base/bif/plugins/Bro_SQLiteWriter.sqlite.bif.bro
|
||||||
scripts/policy/misc/loaded-scripts.bro
|
scripts/policy/misc/loaded-scripts.bro
|
||||||
scripts/base/utils/paths.bro
|
scripts/base/utils/paths.bro
|
||||||
#close 2015-03-05-20-42-42
|
#close 2015-04-17-16-40-15
|
||||||
|
|
|
||||||
|
|
@ -3,7 +3,7 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path loaded_scripts
|
#path loaded_scripts
|
||||||
#open 2015-03-05-20-59-07
|
#open 2015-04-17-16-46-56
|
||||||
#fields name
|
#fields name
|
||||||
#types string
|
#types string
|
||||||
scripts/base/init-bare.bro
|
scripts/base/init-bare.bro
|
||||||
|
|
@ -59,6 +59,7 @@ scripts/base/init-bare.bro
|
||||||
build/scripts/base/bif/plugins/Bro_BackDoor.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_BackDoor.events.bif.bro
|
||||||
build/scripts/base/bif/plugins/Bro_BitTorrent.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_BitTorrent.events.bif.bro
|
||||||
build/scripts/base/bif/plugins/Bro_ConnSize.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_ConnSize.events.bif.bro
|
||||||
|
build/scripts/base/bif/plugins/Bro_ConnSize.functions.bif.bro
|
||||||
build/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro
|
||||||
build/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro
|
||||||
build/scripts/base/bif/plugins/Bro_DNP3.events.bif.bro
|
build/scripts/base/bif/plugins/Bro_DNP3.events.bif.bro
|
||||||
|
|
@ -189,6 +190,7 @@ scripts/base/init-default.bro
|
||||||
scripts/base/protocols/conn/contents.bro
|
scripts/base/protocols/conn/contents.bro
|
||||||
scripts/base/protocols/conn/inactivity.bro
|
scripts/base/protocols/conn/inactivity.bro
|
||||||
scripts/base/protocols/conn/polling.bro
|
scripts/base/protocols/conn/polling.bro
|
||||||
|
scripts/base/protocols/conn/thresholds.bro
|
||||||
scripts/base/protocols/dhcp/__load__.bro
|
scripts/base/protocols/dhcp/__load__.bro
|
||||||
scripts/base/protocols/dhcp/consts.bro
|
scripts/base/protocols/dhcp/consts.bro
|
||||||
scripts/base/protocols/dhcp/main.bro
|
scripts/base/protocols/dhcp/main.bro
|
||||||
|
|
@ -259,4 +261,4 @@ scripts/base/init-default.bro
|
||||||
scripts/base/misc/find-checksum-offloading.bro
|
scripts/base/misc/find-checksum-offloading.bro
|
||||||
scripts/base/misc/find-filtered-trace.bro
|
scripts/base/misc/find-filtered-trace.bro
|
||||||
scripts/policy/misc/loaded-scripts.bro
|
scripts/policy/misc/loaded-scripts.bro
|
||||||
#close 2015-03-05-20-59-07
|
#close 2015-04-17-16-46-56
|
||||||
|
|
|
||||||
|
|
@ -9,5 +9,5 @@
|
||||||
|
|
||||||
}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, conn=[ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=<uninitialized>, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=<uninitialized>, local_resp=<uninitialized>, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={
|
}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, conn=[ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=<uninitialized>, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=<uninitialized>, local_resp=<uninitialized>, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={
|
||||||
|
|
||||||
}], extract_orig=F, extract_resp=F]
|
}], extract_orig=F, extract_resp=F, thresholds=<uninitialized>]
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -9,7 +9,7 @@
|
||||||
|
|
||||||
}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, conn=[ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=<uninitialized>, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=<uninitialized>, local_resp=<uninitialized>, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={
|
}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, conn=[ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=<uninitialized>, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=<uninitialized>, local_resp=<uninitialized>, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={
|
||||||
|
|
||||||
}], extract_orig=F, extract_resp=F, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={
|
}], extract_orig=F, extract_resp=F, thresholds=<uninitialized>, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={
|
||||||
|
|
||||||
}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={
|
}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -18,4 +18,7 @@ error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-che
|
||||||
error in port and /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-checking/set-type-checking.bro, line 38: arithmetic mixed with non-arithmetic (port and 1002)
|
error in port and /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-checking/set-type-checking.bro, line 38: arithmetic mixed with non-arithmetic (port and 1002)
|
||||||
error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-checking/set-type-checking.bro, line 38 and port: type mismatch (1002 and port)
|
error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-checking/set-type-checking.bro, line 38 and port: type mismatch (1002 and port)
|
||||||
error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-checking/set-type-checking.bro, line 38: inconsistent type in set constructor (set(1002))
|
error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-checking/set-type-checking.bro, line 38: inconsistent type in set constructor (set(1002))
|
||||||
|
error in port and /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-checking/set-type-checking.bro, line 44: arithmetic mixed with non-arithmetic (port and 1003)
|
||||||
|
error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-checking/set-type-checking.bro, line 44 and port: type mismatch (1003 and port)
|
||||||
|
error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-checking/set-type-checking.bro, line 44: inconsistent type in set constructor (set(1003))
|
||||||
error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-checking/set-type-checking.bro, line 44: type clash in assignment (lea = set(1003))
|
error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/language.set-type-checking/set-type-checking.bro, line 44: type clash in assignment (lea = set(1003))
|
||||||
|
|
|
||||||
|
|
@ -201,7 +201,7 @@
|
||||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
|
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
|
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1427751587.816777, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1429289002.204837, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result>
|
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Communication::LOG)) -> <no result>
|
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Communication::LOG)) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Conn::LOG)) -> <no result>
|
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Conn::LOG)) -> <no result>
|
||||||
|
|
@ -298,7 +298,7 @@
|
||||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
|
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
|
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1427751587.816777, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1429289002.204837, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(Notice::want_pp, <frame>, ()) -> <no result>
|
0.000000 MetaHookPost CallFunction(Notice::want_pp, <frame>, ()) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(PacketFilter::build, <frame>, ()) -> <no result>
|
0.000000 MetaHookPost CallFunction(PacketFilter::build, <frame>, ()) -> <no result>
|
||||||
0.000000 MetaHookPost CallFunction(PacketFilter::combine_filters, <frame>, (ip or not ip, and, )) -> <no result>
|
0.000000 MetaHookPost CallFunction(PacketFilter::combine_filters, <frame>, (ip or not ip, and, )) -> <no result>
|
||||||
|
|
@ -342,6 +342,7 @@
|
||||||
0.000000 MetaHookPost LoadFile(./Bro_BinaryReader.binary.bif.bro) -> -1
|
0.000000 MetaHookPost LoadFile(./Bro_BinaryReader.binary.bif.bro) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(./Bro_BitTorrent.events.bif.bro) -> -1
|
0.000000 MetaHookPost LoadFile(./Bro_BitTorrent.events.bif.bro) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(./Bro_ConnSize.events.bif.bro) -> -1
|
0.000000 MetaHookPost LoadFile(./Bro_ConnSize.events.bif.bro) -> -1
|
||||||
|
0.000000 MetaHookPost LoadFile(./Bro_ConnSize.functions.bif.bro) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(./Bro_DCE_RPC.events.bif.bro) -> -1
|
0.000000 MetaHookPost LoadFile(./Bro_DCE_RPC.events.bif.bro) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(./Bro_DHCP.events.bif.bro) -> -1
|
0.000000 MetaHookPost LoadFile(./Bro_DHCP.events.bif.bro) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(./Bro_DNP3.events.bif.bro) -> -1
|
0.000000 MetaHookPost LoadFile(./Bro_DNP3.events.bif.bro) -> -1
|
||||||
|
|
@ -454,6 +455,7 @@
|
||||||
0.000000 MetaHookPost LoadFile(./store.bif.bro) -> -1
|
0.000000 MetaHookPost LoadFile(./store.bif.bro) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(./strings.bif.bro) -> -1
|
0.000000 MetaHookPost LoadFile(./strings.bif.bro) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(./sum) -> -1
|
0.000000 MetaHookPost LoadFile(./sum) -> -1
|
||||||
|
0.000000 MetaHookPost LoadFile(./thresholds) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(./top-k.bif.bro) -> -1
|
0.000000 MetaHookPost LoadFile(./top-k.bif.bro) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(./topk) -> -1
|
0.000000 MetaHookPost LoadFile(./topk) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(./types.bif.bro) -> -1
|
0.000000 MetaHookPost LoadFile(./types.bif.bro) -> -1
|
||||||
|
|
@ -754,7 +756,7 @@
|
||||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
|
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
|
||||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
|
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
|
||||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
|
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
|
||||||
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1427751587.816777, node=bro, filter=ip or not ip, init=T, success=T]))
|
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1429289002.204837, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG))
|
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG))
|
||||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Communication::LOG))
|
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Communication::LOG))
|
||||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Conn::LOG))
|
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Conn::LOG))
|
||||||
|
|
@ -851,7 +853,7 @@
|
||||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
|
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
|
||||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
|
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
|
||||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
|
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
|
||||||
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1427751587.816777, node=bro, filter=ip or not ip, init=T, success=T]))
|
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1429289002.204837, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||||
0.000000 MetaHookPre CallFunction(Notice::want_pp, <frame>, ())
|
0.000000 MetaHookPre CallFunction(Notice::want_pp, <frame>, ())
|
||||||
0.000000 MetaHookPre CallFunction(PacketFilter::build, <frame>, ())
|
0.000000 MetaHookPre CallFunction(PacketFilter::build, <frame>, ())
|
||||||
0.000000 MetaHookPre CallFunction(PacketFilter::combine_filters, <frame>, (ip or not ip, and, ))
|
0.000000 MetaHookPre CallFunction(PacketFilter::combine_filters, <frame>, (ip or not ip, and, ))
|
||||||
|
|
@ -895,6 +897,7 @@
|
||||||
0.000000 MetaHookPre LoadFile(./Bro_BinaryReader.binary.bif.bro)
|
0.000000 MetaHookPre LoadFile(./Bro_BinaryReader.binary.bif.bro)
|
||||||
0.000000 MetaHookPre LoadFile(./Bro_BitTorrent.events.bif.bro)
|
0.000000 MetaHookPre LoadFile(./Bro_BitTorrent.events.bif.bro)
|
||||||
0.000000 MetaHookPre LoadFile(./Bro_ConnSize.events.bif.bro)
|
0.000000 MetaHookPre LoadFile(./Bro_ConnSize.events.bif.bro)
|
||||||
|
0.000000 MetaHookPre LoadFile(./Bro_ConnSize.functions.bif.bro)
|
||||||
0.000000 MetaHookPre LoadFile(./Bro_DCE_RPC.events.bif.bro)
|
0.000000 MetaHookPre LoadFile(./Bro_DCE_RPC.events.bif.bro)
|
||||||
0.000000 MetaHookPre LoadFile(./Bro_DHCP.events.bif.bro)
|
0.000000 MetaHookPre LoadFile(./Bro_DHCP.events.bif.bro)
|
||||||
0.000000 MetaHookPre LoadFile(./Bro_DNP3.events.bif.bro)
|
0.000000 MetaHookPre LoadFile(./Bro_DNP3.events.bif.bro)
|
||||||
|
|
@ -1007,6 +1010,7 @@
|
||||||
0.000000 MetaHookPre LoadFile(./store.bif.bro)
|
0.000000 MetaHookPre LoadFile(./store.bif.bro)
|
||||||
0.000000 MetaHookPre LoadFile(./strings.bif.bro)
|
0.000000 MetaHookPre LoadFile(./strings.bif.bro)
|
||||||
0.000000 MetaHookPre LoadFile(./sum)
|
0.000000 MetaHookPre LoadFile(./sum)
|
||||||
|
0.000000 MetaHookPre LoadFile(./thresholds)
|
||||||
0.000000 MetaHookPre LoadFile(./top-k.bif.bro)
|
0.000000 MetaHookPre LoadFile(./top-k.bif.bro)
|
||||||
0.000000 MetaHookPre LoadFile(./topk)
|
0.000000 MetaHookPre LoadFile(./topk)
|
||||||
0.000000 MetaHookPre LoadFile(./types.bif.bro)
|
0.000000 MetaHookPre LoadFile(./types.bif.bro)
|
||||||
|
|
@ -1306,7 +1310,7 @@
|
||||||
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
|
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
|
||||||
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
|
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
|
||||||
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
|
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
|
||||||
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1427751587.816777, node=bro, filter=ip or not ip, init=T, success=T])
|
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1429289002.204837, node=bro, filter=ip or not ip, init=T, success=T])
|
||||||
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
|
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
|
||||||
0.000000 | HookCallFunction Log::add_default_filter(Communication::LOG)
|
0.000000 | HookCallFunction Log::add_default_filter(Communication::LOG)
|
||||||
0.000000 | HookCallFunction Log::add_default_filter(Conn::LOG)
|
0.000000 | HookCallFunction Log::add_default_filter(Conn::LOG)
|
||||||
|
|
@ -1403,7 +1407,7 @@
|
||||||
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
|
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
|
||||||
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
|
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
|
||||||
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
|
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
|
||||||
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1427751587.816777, node=bro, filter=ip or not ip, init=T, success=T])
|
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1429289002.204837, node=bro, filter=ip or not ip, init=T, success=T])
|
||||||
0.000000 | HookCallFunction Notice::want_pp()
|
0.000000 | HookCallFunction Notice::want_pp()
|
||||||
0.000000 | HookCallFunction PacketFilter::build()
|
0.000000 | HookCallFunction PacketFilter::build()
|
||||||
0.000000 | HookCallFunction PacketFilter::combine_filters(ip or not ip, and, )
|
0.000000 | HookCallFunction PacketFilter::combine_filters(ip or not ip, and, )
|
||||||
|
|
@ -1448,45 +1452,45 @@
|
||||||
1362692526.869344 MetaHookPost CallFunction(ChecksumOffloading::check, <null>, ()) -> <no result>
|
1362692526.869344 MetaHookPost CallFunction(ChecksumOffloading::check, <null>, ()) -> <no result>
|
||||||
1362692526.869344 MetaHookPost CallFunction(filter_change_tracking, <null>, ()) -> <no result>
|
1362692526.869344 MetaHookPost CallFunction(filter_change_tracking, <null>, ()) -> <no result>
|
||||||
1362692526.869344 MetaHookPost CallFunction(net_stats, <frame>, ()) -> <no result>
|
1362692526.869344 MetaHookPost CallFunction(net_stats, <frame>, ()) -> <no result>
|
||||||
1362692526.869344 MetaHookPost CallFunction(new_connection, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> <no result>
|
1362692526.869344 MetaHookPost CallFunction(new_connection, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> <no result>
|
||||||
1362692526.869344 MetaHookPost DrainEvents() -> <void>
|
1362692526.869344 MetaHookPost DrainEvents() -> <void>
|
||||||
1362692526.869344 MetaHookPost QueueEvent(ChecksumOffloading::check()) -> false
|
1362692526.869344 MetaHookPost QueueEvent(ChecksumOffloading::check()) -> false
|
||||||
1362692526.869344 MetaHookPost QueueEvent(filter_change_tracking()) -> false
|
1362692526.869344 MetaHookPost QueueEvent(filter_change_tracking()) -> false
|
||||||
1362692526.869344 MetaHookPost QueueEvent(new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> false
|
1362692526.869344 MetaHookPost QueueEvent(new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> false
|
||||||
1362692526.869344 MetaHookPost UpdateNetworkTime(1362692526.869344) -> <void>
|
1362692526.869344 MetaHookPost UpdateNetworkTime(1362692526.869344) -> <void>
|
||||||
1362692526.869344 MetaHookPre BroObjDtor(<void ptr>)
|
1362692526.869344 MetaHookPre BroObjDtor(<void ptr>)
|
||||||
1362692526.869344 MetaHookPre CallFunction(ChecksumOffloading::check, <null>, ())
|
1362692526.869344 MetaHookPre CallFunction(ChecksumOffloading::check, <null>, ())
|
||||||
1362692526.869344 MetaHookPre CallFunction(filter_change_tracking, <null>, ())
|
1362692526.869344 MetaHookPre CallFunction(filter_change_tracking, <null>, ())
|
||||||
1362692526.869344 MetaHookPre CallFunction(net_stats, <frame>, ())
|
1362692526.869344 MetaHookPre CallFunction(net_stats, <frame>, ())
|
||||||
1362692526.869344 MetaHookPre CallFunction(new_connection, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
1362692526.869344 MetaHookPre CallFunction(new_connection, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
||||||
1362692526.869344 MetaHookPre DrainEvents()
|
1362692526.869344 MetaHookPre DrainEvents()
|
||||||
1362692526.869344 MetaHookPre QueueEvent(ChecksumOffloading::check())
|
1362692526.869344 MetaHookPre QueueEvent(ChecksumOffloading::check())
|
||||||
1362692526.869344 MetaHookPre QueueEvent(filter_change_tracking())
|
1362692526.869344 MetaHookPre QueueEvent(filter_change_tracking())
|
||||||
1362692526.869344 MetaHookPre QueueEvent(new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
1362692526.869344 MetaHookPre QueueEvent(new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
||||||
1362692526.869344 MetaHookPre UpdateNetworkTime(1362692526.869344)
|
1362692526.869344 MetaHookPre UpdateNetworkTime(1362692526.869344)
|
||||||
1362692526.869344 | HookBroObjDtor
|
1362692526.869344 | HookBroObjDtor
|
||||||
1362692526.869344 | HookUpdateNetworkTime 1362692526.869344
|
1362692526.869344 | HookUpdateNetworkTime 1362692526.869344
|
||||||
1362692526.869344 | HookCallFunction ChecksumOffloading::check()
|
1362692526.869344 | HookCallFunction ChecksumOffloading::check()
|
||||||
1362692526.869344 | HookCallFunction filter_change_tracking()
|
1362692526.869344 | HookCallFunction filter_change_tracking()
|
||||||
1362692526.869344 | HookCallFunction net_stats()
|
1362692526.869344 | HookCallFunction net_stats()
|
||||||
1362692526.869344 | HookCallFunction new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
1362692526.869344 | HookCallFunction new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
||||||
1362692526.869344 | HookDrainEvents
|
1362692526.869344 | HookDrainEvents
|
||||||
1362692526.869344 | HookQueueEvent ChecksumOffloading::check()
|
1362692526.869344 | HookQueueEvent ChecksumOffloading::check()
|
||||||
1362692526.869344 | HookQueueEvent filter_change_tracking()
|
1362692526.869344 | HookQueueEvent filter_change_tracking()
|
||||||
1362692526.869344 | HookQueueEvent new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
1362692526.869344 | HookQueueEvent new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.0, service={}, addl=, hot=0, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
||||||
1362692526.869344 | RequestObjDtor ChecksumOffloading::check()
|
1362692526.869344 | RequestObjDtor ChecksumOffloading::check()
|
||||||
1362692526.939084 MetaHookPost CallFunction(connection_established, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> <no result>
|
1362692526.939084 MetaHookPost CallFunction(connection_established, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> <no result>
|
||||||
1362692526.939084 MetaHookPost DrainEvents() -> <void>
|
1362692526.939084 MetaHookPost DrainEvents() -> <void>
|
||||||
1362692526.939084 MetaHookPost QueueEvent(connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> false
|
1362692526.939084 MetaHookPost QueueEvent(connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> false
|
||||||
1362692526.939084 MetaHookPost UpdateNetworkTime(1362692526.939084) -> <void>
|
1362692526.939084 MetaHookPost UpdateNetworkTime(1362692526.939084) -> <void>
|
||||||
1362692526.939084 MetaHookPre CallFunction(connection_established, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
1362692526.939084 MetaHookPre CallFunction(connection_established, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
||||||
1362692526.939084 MetaHookPre DrainEvents()
|
1362692526.939084 MetaHookPre DrainEvents()
|
||||||
1362692526.939084 MetaHookPre QueueEvent(connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
1362692526.939084 MetaHookPre QueueEvent(connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
||||||
1362692526.939084 MetaHookPre UpdateNetworkTime(1362692526.939084)
|
1362692526.939084 MetaHookPre UpdateNetworkTime(1362692526.939084)
|
||||||
1362692526.939084 | HookUpdateNetworkTime 1362692526.939084
|
1362692526.939084 | HookUpdateNetworkTime 1362692526.939084
|
||||||
1362692526.939084 | HookCallFunction connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
1362692526.939084 | HookCallFunction connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
||||||
1362692526.939084 | HookDrainEvents
|
1362692526.939084 | HookDrainEvents
|
||||||
1362692526.939084 | HookQueueEvent connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
1362692526.939084 | HookQueueEvent connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0], start_time=1362692526.869344, duration=0.06974, service={}, addl=, hot=0, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
||||||
1362692526.939378 MetaHookPost DrainEvents() -> <void>
|
1362692526.939378 MetaHookPost DrainEvents() -> <void>
|
||||||
1362692526.939378 MetaHookPost UpdateNetworkTime(1362692526.939378) -> <void>
|
1362692526.939378 MetaHookPost UpdateNetworkTime(1362692526.939378) -> <void>
|
||||||
1362692526.939378 MetaHookPre DrainEvents()
|
1362692526.939378 MetaHookPre DrainEvents()
|
||||||
|
|
@ -1496,12 +1500,12 @@
|
||||||
1362692526.939527 MetaHookPost CallFunction(Analyzer::__name, <frame>, (Analyzer::ANALYZER_HTTP)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(Analyzer::__name, <frame>, (Analyzer::ANALYZER_HTTP)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(Analyzer::name, <frame>, (Analyzer::ANALYZER_HTTP)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(Analyzer::name, <frame>, (Analyzer::ANALYZER_HTTP)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(HTTP::get_file_handle, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(HTTP::get_file_handle, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(HTTP::new_http_session, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(HTTP::new_http_session, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, T)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, T)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(cat, <frame>, (Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(cat, <frame>, (Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(fmt, <frame>, (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(fmt, <frame>, (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(fmt, <frame>, (-%s, HTTP)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(fmt, <frame>, (-%s, HTTP)) -> <no result>
|
||||||
|
|
@ -1516,29 +1520,29 @@
|
||||||
1362692526.939527 MetaHookPost CallFunction(http_request, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(http_request, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(id_string, <frame>, ([orig_h=141.142.228.5, orig_p=59856<...>/tcp])) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(id_string, <frame>, ([orig_h=141.142.228.5, orig_p=59856<...>/tcp])) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(network_time, <frame>, ()) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(network_time, <frame>, ()) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(protocol_confirmation, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], Analyzer::ANALYZER_HTTP, 3)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(protocol_confirmation, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], Analyzer::ANALYZER_HTTP, 3)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(set_file_handle, <frame>, (Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(set_file_handle, <frame>, (Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost CallFunction(split_string1, <frame>, (bro.org, <...>/)) -> <no result>
|
1362692526.939527 MetaHookPost CallFunction(split_string1, <frame>, (bro.org, <...>/)) -> <no result>
|
||||||
1362692526.939527 MetaHookPost DrainEvents() -> <void>
|
1362692526.939527 MetaHookPost DrainEvents() -> <void>
|
||||||
1362692526.939527 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)) -> false
|
1362692526.939527 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)) -> false
|
||||||
1362692526.939527 MetaHookPost QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)) -> false
|
1362692526.939527 MetaHookPost QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)) -> false
|
||||||
1362692526.939527 MetaHookPost QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)) -> false
|
1362692526.939527 MetaHookPost QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)) -> false
|
||||||
1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/*)) -> false
|
1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/*)) -> false
|
||||||
1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0))) -> false
|
1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0))) -> false
|
||||||
1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, CONNECTION, Keep-Alive)) -> false
|
1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, CONNECTION, Keep-Alive)) -> false
|
||||||
1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, HOST, bro.org)) -> false
|
1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, HOST, bro.org)) -> false
|
||||||
1362692526.939527 MetaHookPost QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) -> false
|
1362692526.939527 MetaHookPost QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) -> false
|
||||||
1362692526.939527 MetaHookPost QueueEvent(http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)) -> false
|
1362692526.939527 MetaHookPost QueueEvent(http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)) -> false
|
||||||
1362692526.939527 MetaHookPost UpdateNetworkTime(1362692526.939527) -> <void>
|
1362692526.939527 MetaHookPost UpdateNetworkTime(1362692526.939527) -> <void>
|
||||||
1362692526.939527 MetaHookPre CallFunction(Analyzer::__name, <frame>, (Analyzer::ANALYZER_HTTP))
|
1362692526.939527 MetaHookPre CallFunction(Analyzer::__name, <frame>, (Analyzer::ANALYZER_HTTP))
|
||||||
1362692526.939527 MetaHookPre CallFunction(Analyzer::name, <frame>, (Analyzer::ANALYZER_HTTP))
|
1362692526.939527 MetaHookPre CallFunction(Analyzer::name, <frame>, (Analyzer::ANALYZER_HTTP))
|
||||||
1362692526.939527 MetaHookPre CallFunction(HTTP::get_file_handle, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T))
|
1362692526.939527 MetaHookPre CallFunction(HTTP::get_file_handle, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T))
|
||||||
1362692526.939527 MetaHookPre CallFunction(HTTP::new_http_session, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
1362692526.939527 MetaHookPre CallFunction(HTTP::new_http_session, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
||||||
1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T))
|
1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T))
|
||||||
1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T))
|
1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T))
|
||||||
1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T))
|
1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T))
|
||||||
1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T))
|
1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T))
|
||||||
1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, T))
|
1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, <frame>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, T))
|
||||||
1362692526.939527 MetaHookPre CallFunction(cat, <frame>, (Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80))
|
1362692526.939527 MetaHookPre CallFunction(cat, <frame>, (Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80))
|
||||||
1362692526.939527 MetaHookPre CallFunction(fmt, <frame>, (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp))
|
1362692526.939527 MetaHookPre CallFunction(fmt, <frame>, (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp))
|
||||||
1362692526.939527 MetaHookPre CallFunction(fmt, <frame>, (-%s, HTTP))
|
1362692526.939527 MetaHookPre CallFunction(fmt, <frame>, (-%s, HTTP))
|
||||||
|
|
@ -1553,17 +1557,17 @@
|
||||||
1362692526.939527 MetaHookPre CallFunction(http_request, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1))
|
1362692526.939527 MetaHookPre CallFunction(http_request, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1))
|
||||||
1362692526.939527 MetaHookPre CallFunction(id_string, <frame>, ([orig_h=141.142.228.5, orig_p=59856<...>/tcp]))
|
1362692526.939527 MetaHookPre CallFunction(id_string, <frame>, ([orig_h=141.142.228.5, orig_p=59856<...>/tcp]))
|
||||||
1362692526.939527 MetaHookPre CallFunction(network_time, <frame>, ())
|
1362692526.939527 MetaHookPre CallFunction(network_time, <frame>, ())
|
||||||
1362692526.939527 MetaHookPre CallFunction(protocol_confirmation, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], Analyzer::ANALYZER_HTTP, 3))
|
1362692526.939527 MetaHookPre CallFunction(protocol_confirmation, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], Analyzer::ANALYZER_HTTP, 3))
|
||||||
1362692526.939527 MetaHookPre CallFunction(set_file_handle, <frame>, (Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80))
|
1362692526.939527 MetaHookPre CallFunction(set_file_handle, <frame>, (Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80))
|
||||||
1362692526.939527 MetaHookPre CallFunction(split_string1, <frame>, (bro.org, <...>/))
|
1362692526.939527 MetaHookPre CallFunction(split_string1, <frame>, (bro.org, <...>/))
|
||||||
1362692526.939527 MetaHookPre DrainEvents()
|
1362692526.939527 MetaHookPre DrainEvents()
|
||||||
1362692526.939527 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T))
|
1362692526.939527 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T))
|
||||||
1362692526.939527 MetaHookPre QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T))
|
1362692526.939527 MetaHookPre QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T))
|
||||||
1362692526.939527 MetaHookPre QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T))
|
1362692526.939527 MetaHookPre QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T))
|
||||||
1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/*))
|
1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/*))
|
||||||
1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0)))
|
1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0)))
|
||||||
1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, CONNECTION, Keep-Alive))
|
1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, CONNECTION, Keep-Alive))
|
||||||
1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, HOST, bro.org))
|
1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, HOST, bro.org))
|
||||||
1362692526.939527 MetaHookPre QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124]))
|
1362692526.939527 MetaHookPre QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124]))
|
||||||
1362692526.939527 MetaHookPre QueueEvent(http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1))
|
1362692526.939527 MetaHookPre QueueEvent(http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1))
|
||||||
1362692526.939527 MetaHookPre UpdateNetworkTime(1362692526.939527)
|
1362692526.939527 MetaHookPre UpdateNetworkTime(1362692526.939527)
|
||||||
|
|
@ -1571,12 +1575,12 @@
|
||||||
1362692526.939527 | HookCallFunction Analyzer::__name(Analyzer::ANALYZER_HTTP)
|
1362692526.939527 | HookCallFunction Analyzer::__name(Analyzer::ANALYZER_HTTP)
|
||||||
1362692526.939527 | HookCallFunction Analyzer::name(Analyzer::ANALYZER_HTTP)
|
1362692526.939527 | HookCallFunction Analyzer::name(Analyzer::ANALYZER_HTTP)
|
||||||
1362692526.939527 | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)
|
1362692526.939527 | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)
|
||||||
1362692526.939527 | HookCallFunction HTTP::new_http_session([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
1362692526.939527 | HookCallFunction HTTP::new_http_session([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
||||||
1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)
|
1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)
|
||||||
1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)
|
1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)
|
||||||
1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)
|
1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)
|
||||||
1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)
|
1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=<uninitialized>, user_agent=<uninitialized>, request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=[filename=<uninitialized>], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], F, T)
|
||||||
1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, T)
|
1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=[pending={}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, T)
|
||||||
1362692526.939527 | HookCallFunction cat(Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)
|
1362692526.939527 | HookCallFunction cat(Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)
|
||||||
1362692526.939527 | HookCallFunction fmt(%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)
|
1362692526.939527 | HookCallFunction fmt(%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)
|
||||||
1362692526.939527 | HookCallFunction fmt(-%s, HTTP)
|
1362692526.939527 | HookCallFunction fmt(-%s, HTTP)
|
||||||
|
|
@ -1591,17 +1595,17 @@
|
||||||
1362692526.939527 | HookCallFunction http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)
|
1362692526.939527 | HookCallFunction http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)
|
||||||
1362692526.939527 | HookCallFunction id_string([orig_h=141.142.228.5, orig_p=59856<...>/tcp])
|
1362692526.939527 | HookCallFunction id_string([orig_h=141.142.228.5, orig_p=59856<...>/tcp])
|
||||||
1362692526.939527 | HookCallFunction network_time()
|
1362692526.939527 | HookCallFunction network_time()
|
||||||
1362692526.939527 | HookCallFunction protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], Analyzer::ANALYZER_HTTP, 3)
|
1362692526.939527 | HookCallFunction protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], Analyzer::ANALYZER_HTTP, 3)
|
||||||
1362692526.939527 | HookCallFunction set_file_handle(Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80)
|
1362692526.939527 | HookCallFunction set_file_handle(Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80)
|
||||||
1362692526.939527 | HookCallFunction split_string1(bro.org, <...>/)
|
1362692526.939527 | HookCallFunction split_string1(bro.org, <...>/)
|
||||||
1362692526.939527 | HookDrainEvents
|
1362692526.939527 | HookDrainEvents
|
||||||
1362692526.939527 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)
|
1362692526.939527 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)
|
||||||
1362692526.939527 | HookQueueEvent http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)
|
1362692526.939527 | HookQueueEvent http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)
|
||||||
1362692526.939527 | HookQueueEvent http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)
|
1362692526.939527 | HookQueueEvent http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T)
|
||||||
1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/*)
|
1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/*)
|
||||||
1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0))
|
1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0))
|
||||||
1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, CONNECTION, Keep-Alive)
|
1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, CONNECTION, Keep-Alive)
|
||||||
1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, HOST, bro.org)
|
1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, addl=, hot=0, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, HOST, bro.org)
|
||||||
1362692526.939527 | HookQueueEvent http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])
|
1362692526.939527 | HookQueueEvent http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), request_body_len=0, response_body_len=0, status_code=<uninitialized>, status_msg=<uninitialized>, info_code=<uninitialized>, info_msg=<uninitialized>, filename=<uninitialized>, tags={}, username=<uninitialized>, password=<uninitialized>, capture_password=F, proxied=<uninitialized>, range_request=F, orig_fuids=<uninitialized>, orig_mime_types=<uninitialized>, resp_fuids=<uninitialized>, resp_mime_types=<uninitialized>, current_entity=<uninitialized>, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0], irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])
|
||||||
1362692526.939527 | HookQueueEvent http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)
|
1362692526.939527 | HookQueueEvent http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)
|
||||||
1362692527.008509 MetaHookPost DrainEvents() -> <void>
|
1362692527.008509 MetaHookPost DrainEvents() -> <void>
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
Demo::Foo - A Foo test input reader (dynamic, version 1.0)
|
Demo::Foo - A Foo test input reader (dynamic, version 1.0)
|
||||||
[Writer] Foo (Input::READER_FOO)
|
[Reader] Foo (Input::READER_FOO)
|
||||||
|
|
||||||
===
|
===
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
fkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
|
||||||
|
F
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
Threshold set for [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp]
|
||||||
|
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 1, T
|
||||||
|
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2000, F
|
||||||
|
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2500, T
|
||||||
|
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2700, T
|
||||||
|
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 50, F
|
||||||
|
Threshold set for [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp]
|
||||||
|
triggered bytes, [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp], 1, T
|
||||||
|
triggered bytes, [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp], 2000, F
|
||||||
|
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 52, F
|
||||||
|
|
@ -3,9 +3,9 @@
|
||||||
#empty_field (empty)
|
#empty_field (empty)
|
||||||
#unset_field -
|
#unset_field -
|
||||||
#path conn
|
#path conn
|
||||||
#open 2015-02-23-21-43-47
|
#open 2015-04-17-16-45-58
|
||||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||||
1348168976.274919 CXWv6p3arKYeMETxOg 192.168.57.103 60108 192.168.57.101 2811 tcp ssl,ftp,gridftp 0.294743 4491 6659 SF - - 0 ShAdDaFf 22 5643 21 7759 (empty)
|
1348168976.274919 CXWv6p3arKYeMETxOg 192.168.57.103 60108 192.168.57.101 2811 tcp ssl,ftp,gridftp 0.294743 4491 6659 SF - - 0 ShAdDaFf 22 5643 21 7759 (empty)
|
||||||
1348168976.546371 CjhGID4nQcgTWjvg4c 192.168.57.103 35391 192.168.57.101 55968 tcp ssl,gridftp-data 0.011938 2135 3196 S1 - - 0 ShADad 8 2559 6 3516 (empty)
|
1348168976.546371 CjhGID4nQcgTWjvg4c 192.168.57.103 35391 192.168.57.101 55968 tcp ssl,gridftp-data 0.010760 2109 3196 S1 - - 0 ShADad 7 2481 6 3516 (empty)
|
||||||
#close 2015-02-23-21-43-47
|
#close 2015-04-17-16-45-58
|
||||||
|
|
|
||||||
File diff suppressed because one or more lines are too long
|
|
@ -1,5 +1,5 @@
|
||||||
1254722768.219663 smtp_reply
|
1254722768.219663 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0], start_time=1254722767.529046, duration=0.690617, service={^J^J}, addl=, hot=0, history=ShAd, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0], start_time=1254722767.529046, duration=0.690617, service={^J^J}, addl=, hot=0, history=ShAd, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 220
|
[2] code: count = 220
|
||||||
[3] cmd: string = >
|
[3] cmd: string = >
|
||||||
|
|
@ -7,7 +7,7 @@
|
||||||
[5] cont_resp: bool = T
|
[5] cont_resp: bool = T
|
||||||
|
|
||||||
1254722768.219663 smtp_reply
|
1254722768.219663 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0], start_time=1254722767.529046, duration=0.690617, service={^J^J}, addl=, hot=0, history=ShAd, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=<uninitialized>, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=220 xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 , path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=<uninitialized>, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0], start_time=1254722767.529046, duration=0.690617, service={^J^J}, addl=, hot=0, history=ShAd, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=<uninitialized>, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=220 xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 , path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=<uninitialized>, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 220
|
[2] code: count = 220
|
||||||
[3] cmd: string = >
|
[3] cmd: string = >
|
||||||
|
|
@ -15,7 +15,7 @@
|
||||||
[5] cont_resp: bool = T
|
[5] cont_resp: bool = T
|
||||||
|
|
||||||
1254722768.219663 smtp_reply
|
1254722768.219663 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0], start_time=1254722767.529046, duration=0.690617, service={^J^J}, addl=, hot=0, history=ShAd, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=<uninitialized>, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=220 We do not authorize the use of this system to transport unsolicited, , path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=<uninitialized>, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0], start_time=1254722767.529046, duration=0.690617, service={^J^J}, addl=, hot=0, history=ShAd, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=<uninitialized>, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=220 We do not authorize the use of this system to transport unsolicited, , path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=<uninitialized>, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 220
|
[2] code: count = 220
|
||||||
[3] cmd: string = >
|
[3] cmd: string = >
|
||||||
|
|
@ -23,13 +23,13 @@
|
||||||
[5] cont_resp: bool = F
|
[5] cont_resp: bool = F
|
||||||
|
|
||||||
1254722768.224809 smtp_request
|
1254722768.224809 smtp_request
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0], start_time=1254722767.529046, duration=0.695763, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdD, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=<uninitialized>, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=<uninitialized>, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0], start_time=1254722767.529046, duration=0.695763, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdD, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=<uninitialized>, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=<uninitialized>, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = T
|
[1] is_orig: bool = T
|
||||||
[2] command: string = EHLO
|
[2] command: string = EHLO
|
||||||
[3] arg: string = GP
|
[3] arg: string = GP
|
||||||
|
|
||||||
1254722768.566183 smtp_reply
|
1254722768.566183 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 250
|
[2] code: count = 250
|
||||||
[3] cmd: string = EHLO
|
[3] cmd: string = EHLO
|
||||||
|
|
@ -37,7 +37,7 @@
|
||||||
[5] cont_resp: bool = T
|
[5] cont_resp: bool = T
|
||||||
|
|
||||||
1254722768.566183 smtp_reply
|
1254722768.566183 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 xc90.websitewelcome.com Hello GP [122.162.143.157], path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 xc90.websitewelcome.com Hello GP [122.162.143.157], path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 250
|
[2] code: count = 250
|
||||||
[3] cmd: string = EHLO
|
[3] cmd: string = EHLO
|
||||||
|
|
@ -45,7 +45,7 @@
|
||||||
[5] cont_resp: bool = T
|
[5] cont_resp: bool = T
|
||||||
|
|
||||||
1254722768.566183 smtp_reply
|
1254722768.566183 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 SIZE 52428800, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 SIZE 52428800, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 250
|
[2] code: count = 250
|
||||||
[3] cmd: string = EHLO
|
[3] cmd: string = EHLO
|
||||||
|
|
@ -53,7 +53,7 @@
|
||||||
[5] cont_resp: bool = T
|
[5] cont_resp: bool = T
|
||||||
|
|
||||||
1254722768.566183 smtp_reply
|
1254722768.566183 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 PIPELINING, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 PIPELINING, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 250
|
[2] code: count = 250
|
||||||
[3] cmd: string = EHLO
|
[3] cmd: string = EHLO
|
||||||
|
|
@ -61,7 +61,7 @@
|
||||||
[5] cont_resp: bool = T
|
[5] cont_resp: bool = T
|
||||||
|
|
||||||
1254722768.566183 smtp_reply
|
1254722768.566183 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 AUTH PLAIN LOGIN, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 AUTH PLAIN LOGIN, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 250
|
[2] code: count = 250
|
||||||
[3] cmd: string = EHLO
|
[3] cmd: string = EHLO
|
||||||
|
|
@ -69,7 +69,7 @@
|
||||||
[5] cont_resp: bool = T
|
[5] cont_resp: bool = T
|
||||||
|
|
||||||
1254722768.566183 smtp_reply
|
1254722768.566183 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 STARTTLS, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0], start_time=1254722767.529046, duration=1.037137, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 STARTTLS, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 250
|
[2] code: count = 250
|
||||||
[3] cmd: string = EHLO
|
[3] cmd: string = EHLO
|
||||||
|
|
@ -77,13 +77,13 @@
|
||||||
[5] cont_resp: bool = F
|
[5] cont_resp: bool = F
|
||||||
|
|
||||||
1254722768.568729 smtp_request
|
1254722768.568729 smtp_request
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0], start_time=1254722767.529046, duration=1.039683, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0], start_time=1254722767.529046, duration=1.039683, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = T
|
[1] is_orig: bool = T
|
||||||
[2] command: string = AUTH
|
[2] command: string = AUTH
|
||||||
[3] arg: string = LOGIN
|
[3] arg: string = LOGIN
|
||||||
|
|
||||||
1254722768.911081 smtp_reply
|
1254722768.911081 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0], start_time=1254722767.529046, duration=1.382035, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0], start_time=1254722767.529046, duration=1.382035, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 334
|
[2] code: count = 334
|
||||||
[3] cmd: string = AUTH
|
[3] cmd: string = AUTH
|
||||||
|
|
@ -91,13 +91,13 @@
|
||||||
[5] cont_resp: bool = F
|
[5] cont_resp: bool = F
|
||||||
|
|
||||||
1254722768.911655 smtp_request
|
1254722768.911655 smtp_request
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0], start_time=1254722767.529046, duration=1.382609, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0], start_time=1254722767.529046, duration=1.382609, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = T
|
[1] is_orig: bool = T
|
||||||
[2] command: string = **
|
[2] command: string = **
|
||||||
[3] arg: string = Z3VycGFydGFwQHBhdHJpb3RzLmlu
|
[3] arg: string = Z3VycGFydGFwQHBhdHJpb3RzLmlu
|
||||||
|
|
||||||
1254722769.253544 smtp_reply
|
1254722769.253544 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0], start_time=1254722767.529046, duration=1.724498, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0], start_time=1254722767.529046, duration=1.724498, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 334
|
[2] code: count = 334
|
||||||
[3] cmd: string = AUTH_ANSWER
|
[3] cmd: string = AUTH_ANSWER
|
||||||
|
|
@ -105,13 +105,13 @@
|
||||||
[5] cont_resp: bool = F
|
[5] cont_resp: bool = F
|
||||||
|
|
||||||
1254722769.254118 smtp_request
|
1254722769.254118 smtp_request
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0], start_time=1254722767.529046, duration=1.725072, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0], start_time=1254722767.529046, duration=1.725072, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = T
|
[1] is_orig: bool = T
|
||||||
[2] command: string = **
|
[2] command: string = **
|
||||||
[3] arg: string = cHVuamFiQDEyMw==
|
[3] arg: string = cHVuamFiQDEyMw==
|
||||||
|
|
||||||
1254722769.613798 smtp_reply
|
1254722769.613798 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0], start_time=1254722767.529046, duration=2.084752, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0], start_time=1254722767.529046, duration=2.084752, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 235
|
[2] code: count = 235
|
||||||
[3] cmd: string = AUTH_ANSWER
|
[3] cmd: string = AUTH_ANSWER
|
||||||
|
|
@ -119,13 +119,13 @@
|
||||||
[5] cont_resp: bool = F
|
[5] cont_resp: bool = F
|
||||||
|
|
||||||
1254722769.614414 smtp_request
|
1254722769.614414 smtp_request
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0], start_time=1254722767.529046, duration=2.085368, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0], start_time=1254722767.529046, duration=2.085368, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = T
|
[1] is_orig: bool = T
|
||||||
[2] command: string = MAIL
|
[2] command: string = MAIL
|
||||||
[3] arg: string = FROM: <gurpartap@patriots.in>
|
[3] arg: string = FROM: <gurpartap@patriots.in>
|
||||||
|
|
||||||
1254722769.956765 smtp_reply
|
1254722769.956765 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0], start_time=1254722767.529046, duration=2.427719, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0], start_time=1254722767.529046, duration=2.427719, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 250
|
[2] code: count = 250
|
||||||
[3] cmd: string = MAIL
|
[3] cmd: string = MAIL
|
||||||
|
|
@ -133,13 +133,13 @@
|
||||||
[5] cont_resp: bool = F
|
[5] cont_resp: bool = F
|
||||||
|
|
||||||
1254722769.957250 smtp_request
|
1254722769.957250 smtp_request
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0], start_time=1254722767.529046, duration=2.428204, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0], start_time=1254722767.529046, duration=2.428204, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = T
|
[1] is_orig: bool = T
|
||||||
[2] command: string = RCPT
|
[2] command: string = RCPT
|
||||||
[3] arg: string = TO: <raj_deol2002in@yahoo.co.in>
|
[3] arg: string = TO: <raj_deol2002in@yahoo.co.in>
|
||||||
|
|
||||||
1254722770.319708 smtp_reply
|
1254722770.319708 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0], start_time=1254722767.529046, duration=2.790662, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto={^J^I<raj_deol2002in@yahoo.co.in>^J}, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0], start_time=1254722767.529046, duration=2.790662, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto={^J^I<raj_deol2002in@yahoo.co.in>^J}, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 250
|
[2] code: count = 250
|
||||||
[3] cmd: string = RCPT
|
[3] cmd: string = RCPT
|
||||||
|
|
@ -147,13 +147,13 @@
|
||||||
[5] cont_resp: bool = F
|
[5] cont_resp: bool = F
|
||||||
|
|
||||||
1254722770.320203 smtp_request
|
1254722770.320203 smtp_request
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0], start_time=1254722767.529046, duration=2.791157, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto={^J^I<raj_deol2002in@yahoo.co.in>^J}, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0], start_time=1254722767.529046, duration=2.791157, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto={^J^I<raj_deol2002in@yahoo.co.in>^J}, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=0], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = T
|
[1] is_orig: bool = T
|
||||||
[2] command: string = DATA
|
[2] command: string = DATA
|
||||||
[3] arg: string =
|
[3] arg: string =
|
||||||
|
|
||||||
1254722770.661679 smtp_reply
|
1254722770.661679 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0], start_time=1254722767.529046, duration=3.132633, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto={^J^I<raj_deol2002in@yahoo.co.in>^J}, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=<uninitialized>], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=1], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0], start_time=1254722767.529046, duration=3.132633, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto={^J^I<raj_deol2002in@yahoo.co.in>^J}, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=<uninitialized>], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=1], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 354
|
[2] code: count = 354
|
||||||
[3] cmd: string = DATA
|
[3] cmd: string = DATA
|
||||||
|
|
@ -161,13 +161,13 @@
|
||||||
[5] cont_resp: bool = F
|
[5] cont_resp: bool = F
|
||||||
|
|
||||||
1254722771.858334 smtp_request
|
1254722771.858334 smtp_request
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0], start_time=1254722767.529046, duration=4.329288, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto={^J^I<raj_deol2002in@yahoo.co.in>^J}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" <gurpartap@patriots.in>, to={^J^I<raj_deol2002in@yahoo.co.in>^J}, reply_to=<uninitialized>, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=<uninitialized>, subject=SMTP, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[Fel9gs4OtNEV6gUJZ5, Ft4M3f2yMvLlmwtbq9, FL9Y0d45OI4LpS6fmh]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=5], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0], start_time=1254722767.529046, duration=4.329288, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto={^J^I<raj_deol2002in@yahoo.co.in>^J}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" <gurpartap@patriots.in>, to={^J^I<raj_deol2002in@yahoo.co.in>^J}, reply_to=<uninitialized>, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=<uninitialized>, subject=SMTP, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[Fel9gs4OtNEV6gUJZ5, Ft4M3f2yMvLlmwtbq9, FL9Y0d45OI4LpS6fmh]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=5], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = T
|
[1] is_orig: bool = T
|
||||||
[2] command: string = .
|
[2] command: string = .
|
||||||
[3] arg: string = .
|
[3] arg: string = .
|
||||||
|
|
||||||
1254722772.248789 smtp_reply
|
1254722772.248789 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0], start_time=1254722767.529046, duration=4.719743, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto={^J^I<raj_deol2002in@yahoo.co.in>^J}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" <gurpartap@patriots.in>, to={^J^I<raj_deol2002in@yahoo.co.in>^J}, reply_to=<uninitialized>, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=<uninitialized>, subject=SMTP, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[Fel9gs4OtNEV6gUJZ5, Ft4M3f2yMvLlmwtbq9, FL9Y0d45OI4LpS6fmh]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=5], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0], start_time=1254722767.529046, duration=4.719743, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=<gurpartap@patriots.in>, rcptto={^J^I<raj_deol2002in@yahoo.co.in>^J}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" <gurpartap@patriots.in>, to={^J^I<raj_deol2002in@yahoo.co.in>^J}, reply_to=<uninitialized>, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=<uninitialized>, subject=SMTP, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=<uninitialized>, fuids=[Fel9gs4OtNEV6gUJZ5, Ft4M3f2yMvLlmwtbq9, FL9Y0d45OI4LpS6fmh]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=<uninitialized>, mime_depth=5], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 250
|
[2] code: count = 250
|
||||||
[3] cmd: string = .
|
[3] cmd: string = .
|
||||||
|
|
@ -175,13 +175,13 @@
|
||||||
[5] cont_resp: bool = F
|
[5] cont_resp: bool = F
|
||||||
|
|
||||||
1254722774.763825 smtp_request
|
1254722774.763825 smtp_request
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0], start_time=1254722767.529046, duration=7.234779, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722772.248789, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=<uninitialized>, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=<uninitialized>, mime_depth=5], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0], start_time=1254722767.529046, duration=7.234779, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722772.248789, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=<uninitialized>, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=<uninitialized>, mime_depth=5], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = T
|
[1] is_orig: bool = T
|
||||||
[2] command: string = QUIT
|
[2] command: string = QUIT
|
||||||
[3] arg: string =
|
[3] arg: string =
|
||||||
|
|
||||||
1254722775.105467 smtp_reply
|
1254722775.105467 smtp_reply
|
||||||
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0], start_time=1254722767.529046, duration=7.576421, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDaF, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722772.248789, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=<uninitialized>, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=<uninitialized>, mime_depth=5], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
[0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0], start_time=1254722767.529046, duration=7.576421, service={^J^ISMTP^J}, addl=, hot=0, history=ShAdDaF, uid=CjhGID4nQcgTWjvg4c, tunnel=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, snmp=<uninitialized>, smtp=[ts=1254722772.248789, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=<uninitialized>, rcptto=<uninitialized>, date=<uninitialized>, from=<uninitialized>, to=<uninitialized>, reply_to=<uninitialized>, msg_id=<uninitialized>, in_reply_to=<uninitialized>, subject=<uninitialized>, x_originating_ip=<uninitialized>, first_received=<uninitialized>, second_received=<uninitialized>, last_reply=<uninitialized>, path=[74.53.140.153, 10.10.1.4], user_agent=<uninitialized>, tls=F, process_received_from=T, has_client_activity=F, entity=<uninitialized>, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=<uninitialized>, mime_depth=5], socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]
|
||||||
[1] is_orig: bool = F
|
[1] is_orig: bool = F
|
||||||
[2] code: count = 221
|
[2] code: count = 221
|
||||||
[3] cmd: string = QUIT
|
[3] cmd: string = QUIT
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
signature match, Found .*XXXX, XXXX
|
||||||
|
signature match, Found .*YYYY, YYYY
|
||||||
|
signature match, Found XXXX, XXXX
|
||||||
|
signature match, Found YYYY, YYYY
|
||||||
|
signature match, Found ^XXXX, XXXX
|
||||||
|
signature match, Found ^YYYY, YYYY
|
||||||
BIN
testing/btest/Traces/udp-signature-test.pcap
Normal file
BIN
testing/btest/Traces/udp-signature-test.pcap
Normal file
Binary file not shown.
|
|
@ -24,4 +24,12 @@ event bro_init()
|
||||||
local e: port = 123/tcp;
|
local e: port = 123/tcp;
|
||||||
print port_to_count(e);
|
print port_to_count(e);
|
||||||
|
|
||||||
|
local origString = "9223372036854775808";
|
||||||
|
local directCount: count = 9223372036854775808;
|
||||||
|
local fromStringCount: count = to_count(origString);
|
||||||
|
|
||||||
|
if ( directCount == fromStringCount )
|
||||||
|
print fmt("%s and %s are the same", directCount, fromStringCount);
|
||||||
|
else
|
||||||
|
print fmt("%s and %s are not the same", directCount, fromStringCount);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,10 @@
|
||||||
# @TEST-EXEC: bro -r $TRACES/tls/tls-expired-cert.trace %INPUT
|
# @TEST-EXEC: bro -r $TRACES/tls/tls-expired-cert.trace %INPUT
|
||||||
# @TEST-EXEC: btest-diff .stdout
|
# @TEST-EXEC: btest-diff .stdout
|
||||||
|
|
||||||
|
redef SSL::root_certs += {
|
||||||
|
["OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US"] = "\x30\x82\x02\x3C\x30\x82\x01\xA5\x02\x10\x70\xBA\xE4\x1D\x10\xD9\x29\x34\xB6\x38\xCA\x7B\x03\xCC\xBA\xBF\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x02\x05\x00\x30\x5F\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x55\x53\x31\x17\x30\x15\x06\x03\x55\x04\x0A\x13\x0E\x56\x65\x72\x69\x53\x69\x67\x6E\x2C\x20\x49\x6E\x63\x2E\x31\x37\x30\x35\x06\x03\x55\x04\x0B\x13\x2E\x43\x6C\x61\x73\x73\x20\x33\x20\x50\x75\x62\x6C\x69\x63\x20\x50\x72\x69\x6D\x61\x72\x79\x20\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x20\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x30\x1E\x17\x0D\x39\x36\x30\x31\x32\x39\x30\x30\x30\x30\x30\x30\x5A\x17\x0D\x32\x38\x30\x38\x30\x31\x32\x33\x35\x39\x35\x39\x5A\x30\x5F\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x55\x53\x31\x17\x30\x15\x06\x03\x55\x04\x0A\x13\x0E\x56\x65\x72\x69\x53\x69\x67\x6E\x2C\x20\x49\x6E\x63\x2E\x31\x37\x30\x35\x06\x03\x55\x04\x0B\x13\x2E\x43\x6C\x61\x73\x73\x20\x33\x20\x50\x75\x62\x6C\x69\x63\x20\x50\x72\x69\x6D\x61\x72\x79\x20\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x20\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x30\x81\x9F\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x01\x05\x00\x03\x81\x8D\x00\x30\x81\x89\x02\x81\x81\x00\xC9\x5C\x59\x9E\xF2\x1B\x8A\x01\x14\xB4\x10\xDF\x04\x40\xDB\xE3\x57\xAF\x6A\x45\x40\x8F\x84\x0C\x0B\xD1\x33\xD9\xD9\x11\xCF\xEE\x02\x58\x1F\x25\xF7\x2A\xA8\x44\x05\xAA\xEC\x03\x1F\x78\x7F\x9E\x93\xB9\x9A\x00\xAA\x23\x7D\xD6\xAC\x85\xA2\x63\x45\xC7\x72\x27\xCC\xF4\x4C\xC6\x75\x71\xD2\x39\xEF\x4F\x42\xF0\x75\xDF\x0A\x90\xC6\x8E\x20\x6F\x98\x0F\xF8\xAC\x23\x5F\x70\x29\x36\xA4\xC9\x86\xE7\xB1\x9A\x20\xCB\x53\xA5\x85\xE7\x3D\xBE\x7D\x9A\xFE\x24\x45\x33\xDC\x76\x15\xED\x0F\xA2\x71\x64\x4C\x65\x2E\x81\x68\x45\xA7\x02\x03\x01\x00\x01\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x02\x05\x00\x03\x81\x81\x00\xBB\x4C\x12\x2B\xCF\x2C\x26\x00\x4F\x14\x13\xDD\xA6\xFB\xFC\x0A\x11\x84\x8C\xF3\x28\x1C\x67\x92\x2F\x7C\xB6\xC5\xFA\xDF\xF0\xE8\x95\xBC\x1D\x8F\x6C\x2C\xA8\x51\xCC\x73\xD8\xA4\xC0\x53\xF0\x4E\xD6\x26\xC0\x76\x01\x57\x81\x92\x5E\x21\xF1\xD1\xB1\xFF\xE7\xD0\x21\x58\xCD\x69\x17\xE3\x44\x1C\x9C\x19\x44\x39\x89\x5C\xDC\x9C\x00\x0F\x56\x8D\x02\x99\xED\xA2\x90\x45\x4C\xE4\xBB\x10\xA4\x3D\xF0\x32\x03\x0E\xF1\xCE\xF8\xE8\xC9\x51\x8C\xE6\x62\x9F\xE6\x9F\xC0\x7D\xB7\x72\x9C\xC9\x36\x3A\x6B\x9F\x4E\xA8\xFF\x64\x0D\x64"
|
||||||
|
};
|
||||||
|
|
||||||
event ssl_established(c: connection) &priority=3
|
event ssl_established(c: connection) &priority=3
|
||||||
{
|
{
|
||||||
local chain: vector of opaque of x509 = vector();
|
local chain: vector of opaque of x509 = vector();
|
||||||
|
|
|
||||||
32
testing/btest/core/conn-size-threshold.bro
Normal file
32
testing/btest/core/conn-size-threshold.bro
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
# @TEST-EXEC: bro -r $TRACES/irc-dcc-send.trace %INPUT
|
||||||
|
# @TEST-EXEC: btest-diff .stdout
|
||||||
|
|
||||||
|
event connection_established(c: connection)
|
||||||
|
{
|
||||||
|
print get_current_conn_bytes_threshold(c$id, T);
|
||||||
|
print get_current_conn_bytes_threshold(c$id, F);
|
||||||
|
print get_current_conn_packets_threshold(c$id, T);
|
||||||
|
print get_current_conn_packets_threshold(c$id, F);
|
||||||
|
|
||||||
|
print fmt("Threshold set for %s", cat(c$id));
|
||||||
|
set_current_conn_bytes_threshold(c$id, 3000, T);
|
||||||
|
set_current_conn_bytes_threshold(c$id, 2000, F);
|
||||||
|
|
||||||
|
set_current_conn_packets_threshold(c$id, 50, F);
|
||||||
|
set_current_conn_packets_threshold(c$id, 63, T);
|
||||||
|
|
||||||
|
print get_current_conn_bytes_threshold(c$id, T);
|
||||||
|
print get_current_conn_bytes_threshold(c$id, F);
|
||||||
|
print get_current_conn_packets_threshold(c$id, T);
|
||||||
|
print get_current_conn_packets_threshold(c$id, F);
|
||||||
|
}
|
||||||
|
|
||||||
|
event conn_bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
|
||||||
|
{
|
||||||
|
print "triggered bytes", c$id, threshold, is_orig;
|
||||||
|
}
|
||||||
|
|
||||||
|
event conn_packets_threshold_crossed(c: connection, threshold: count, is_orig: bool)
|
||||||
|
{
|
||||||
|
print "triggered packets", c$id, threshold, is_orig;
|
||||||
|
}
|
||||||
|
|
@ -43,3 +43,18 @@ event bro_init()
|
||||||
{
|
{
|
||||||
local lea: MySet = set(1003); # type clash
|
local lea: MySet = set(1003); # type clash
|
||||||
}
|
}
|
||||||
|
|
||||||
|
type MyRecord: record {
|
||||||
|
user: string;
|
||||||
|
host: string;
|
||||||
|
host_port: count &default=22;
|
||||||
|
path: string;
|
||||||
|
};
|
||||||
|
|
||||||
|
global set_of_records: set[MyRecord];
|
||||||
|
|
||||||
|
event bro_init()
|
||||||
|
{
|
||||||
|
# Set ctor w/ anonymous record ctor should coerce.
|
||||||
|
set_of_records = set([$user="testuser", $host="testhost", $path="testpath"]);
|
||||||
|
}
|
||||||
|
|
|
||||||
45
testing/btest/scripts/base/frameworks/input/raw/offset.bro
Normal file
45
testing/btest/scripts/base/frameworks/input/raw/offset.bro
Normal file
|
|
@ -0,0 +1,45 @@
|
||||||
|
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||||
|
# @TEST-EXEC: btest-bg-wait 5
|
||||||
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
||||||
|
|
||||||
|
@TEST-START-FILE input.log
|
||||||
|
sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
|
||||||
|
@TEST-END-FILE
|
||||||
|
|
||||||
|
redef exit_only_after_terminate = T;
|
||||||
|
|
||||||
|
global outfile: file;
|
||||||
|
global try: count;
|
||||||
|
|
||||||
|
module A;
|
||||||
|
|
||||||
|
type Val: record {
|
||||||
|
s: string;
|
||||||
|
};
|
||||||
|
|
||||||
|
event line(description: Input::EventDescription, tpe: Input::Event, s: string)
|
||||||
|
{
|
||||||
|
print outfile, s;
|
||||||
|
try = try + 1;
|
||||||
|
if ( try == 2 )
|
||||||
|
{
|
||||||
|
Input::remove("input");
|
||||||
|
close(outfile);
|
||||||
|
terminate();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
event bro_init()
|
||||||
|
{
|
||||||
|
try = 0;
|
||||||
|
outfile = open("../out");
|
||||||
|
local config_strings: table[string] of string = {
|
||||||
|
["offset"] = "2",
|
||||||
|
};
|
||||||
|
local config_strings_two: table[string] of string = {
|
||||||
|
["offset"] = "-3", # 2 characters before end, last char is newline.
|
||||||
|
};
|
||||||
|
|
||||||
|
Input::add_event([$source="../input.log", $config=config_strings, $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input", $fields=Val, $ev=line, $want_record=F]);
|
||||||
|
Input::add_event([$source="../input.log", $config=config_strings_two, $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input2", $fields=Val, $ev=line, $want_record=F]);
|
||||||
|
}
|
||||||
30
testing/btest/scripts/base/protocols/conn/threshold.bro
Normal file
30
testing/btest/scripts/base/protocols/conn/threshold.bro
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# @TEST-EXEC: bro -r $TRACES/irc-dcc-send.trace %INPUT
|
||||||
|
# @TEST-EXEC: btest-diff .stdout
|
||||||
|
|
||||||
|
event connection_established(c: connection)
|
||||||
|
{
|
||||||
|
print fmt("Threshold set for %s", cat(c$id));
|
||||||
|
ConnThreshold::set_bytes_threshold(c, 1, T);
|
||||||
|
ConnThreshold::set_bytes_threshold(c, 2500, T);
|
||||||
|
ConnThreshold::set_bytes_threshold(c, 2700, T);
|
||||||
|
ConnThreshold::set_bytes_threshold(c, 3000, T);
|
||||||
|
ConnThreshold::delete_bytes_threshold(c, 3000, T);
|
||||||
|
ConnThreshold::set_bytes_threshold(c, 2000, F);
|
||||||
|
|
||||||
|
ConnThreshold::set_packets_threshold(c, 50, F);
|
||||||
|
ConnThreshold::set_packets_threshold(c, 51, F);
|
||||||
|
ConnThreshold::set_packets_threshold(c, 52, F);
|
||||||
|
ConnThreshold::delete_packets_threshold(c, 51, F);
|
||||||
|
ConnThreshold::set_packets_threshold(c, 63, T);
|
||||||
|
ConnThreshold::delete_packets_threshold(c, 63, T);
|
||||||
|
}
|
||||||
|
|
||||||
|
event ConnThreshold::bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
|
||||||
|
{
|
||||||
|
print "triggered bytes", c$id, threshold, is_orig;
|
||||||
|
}
|
||||||
|
|
||||||
|
event ConnThreshold::packets_threshold_crossed(c: connection, threshold: count, is_orig: bool)
|
||||||
|
{
|
||||||
|
print "triggered packets", c$id, threshold, is_orig;
|
||||||
|
}
|
||||||
|
|
@ -1,6 +1,10 @@
|
||||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-stapling.trace %INPUT
|
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-stapling.trace %INPUT
|
||||||
# @TEST-EXEC: btest-diff .stdout
|
# @TEST-EXEC: btest-diff .stdout
|
||||||
|
|
||||||
|
redef SSL::root_certs += {
|
||||||
|
["OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US"] = "\x30\x82\x02\x3C\x30\x82\x01\xA5\x02\x10\x70\xBA\xE4\x1D\x10\xD9\x29\x34\xB6\x38\xCA\x7B\x03\xCC\xBA\xBF\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x02\x05\x00\x30\x5F\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x55\x53\x31\x17\x30\x15\x06\x03\x55\x04\x0A\x13\x0E\x56\x65\x72\x69\x53\x69\x67\x6E\x2C\x20\x49\x6E\x63\x2E\x31\x37\x30\x35\x06\x03\x55\x04\x0B\x13\x2E\x43\x6C\x61\x73\x73\x20\x33\x20\x50\x75\x62\x6C\x69\x63\x20\x50\x72\x69\x6D\x61\x72\x79\x20\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x20\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x30\x1E\x17\x0D\x39\x36\x30\x31\x32\x39\x30\x30\x30\x30\x30\x30\x5A\x17\x0D\x32\x38\x30\x38\x30\x31\x32\x33\x35\x39\x35\x39\x5A\x30\x5F\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x55\x53\x31\x17\x30\x15\x06\x03\x55\x04\x0A\x13\x0E\x56\x65\x72\x69\x53\x69\x67\x6E\x2C\x20\x49\x6E\x63\x2E\x31\x37\x30\x35\x06\x03\x55\x04\x0B\x13\x2E\x43\x6C\x61\x73\x73\x20\x33\x20\x50\x75\x62\x6C\x69\x63\x20\x50\x72\x69\x6D\x61\x72\x79\x20\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x20\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x30\x81\x9F\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x01\x05\x00\x03\x81\x8D\x00\x30\x81\x89\x02\x81\x81\x00\xC9\x5C\x59\x9E\xF2\x1B\x8A\x01\x14\xB4\x10\xDF\x04\x40\xDB\xE3\x57\xAF\x6A\x45\x40\x8F\x84\x0C\x0B\xD1\x33\xD9\xD9\x11\xCF\xEE\x02\x58\x1F\x25\xF7\x2A\xA8\x44\x05\xAA\xEC\x03\x1F\x78\x7F\x9E\x93\xB9\x9A\x00\xAA\x23\x7D\xD6\xAC\x85\xA2\x63\x45\xC7\x72\x27\xCC\xF4\x4C\xC6\x75\x71\xD2\x39\xEF\x4F\x42\xF0\x75\xDF\x0A\x90\xC6\x8E\x20\x6F\x98\x0F\xF8\xAC\x23\x5F\x70\x29\x36\xA4\xC9\x86\xE7\xB1\x9A\x20\xCB\x53\xA5\x85\xE7\x3D\xBE\x7D\x9A\xFE\x24\x45\x33\xDC\x76\x15\xED\x0F\xA2\x71\x64\x4C\x65\x2E\x81\x68\x45\xA7\x02\x03\x01\x00\x01\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x02\x05\x00\x03\x81\x81\x00\xBB\x4C\x12\x2B\xCF\x2C\x26\x00\x4F\x14\x13\xDD\xA6\xFB\xFC\x0A\x11\x84\x8C\xF3\x28\x1C\x67\x92\x2F\x7C\xB6\xC5\xFA\xDF\xF0\xE8\x95\xBC\x1D\x8F\x6C\x2C\xA8\x51\xCC\x73\xD8\xA4\xC0\x53\xF0\x4E\xD6\x26\xC0\x76\x01\x57\x81\x92\x5E\x21\xF1\xD1\xB1\xFF\xE7\xD0\x21\x58\xCD\x69\x17\xE3\x44\x1C\x9C\x19\x44\x39\x89\x5C\xDC\x9C\x00\x0F\x56\x8D\x02\x99\xED\xA2\x90\x45\x4C\xE4\xBB\x10\xA4\x3D\xF0\x32\x03\x0E\xF1\xCE\xF8\xE8\xC9\x51\x8C\xE6\x62\x9F\xE6\x9F\xC0\x7D\xB7\x72\x9C\xC9\x36\x3A\x6B\x9F\x4E\xA8\xFF\x64\x0D\x64",
|
||||||
|
};
|
||||||
|
|
||||||
event ssl_stapled_ocsp(c: connection, is_orig: bool, response: string)
|
event ssl_stapled_ocsp(c: connection, is_orig: bool, response: string)
|
||||||
{
|
{
|
||||||
local chain: vector of opaque of x509 = vector();
|
local chain: vector of opaque of x509 = vector();
|
||||||
|
|
|
||||||
53
testing/btest/signatures/udp-packetwise-match.bro
Normal file
53
testing/btest/signatures/udp-packetwise-match.bro
Normal file
|
|
@ -0,0 +1,53 @@
|
||||||
|
# @TEST-EXEC: bro -r $TRACES/udp-signature-test.pcap %INPUT | sort >out
|
||||||
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@load-sigs test.sig
|
||||||
|
|
||||||
|
@TEST-START-FILE test.sig
|
||||||
|
signature xxxx {
|
||||||
|
ip-proto = udp
|
||||||
|
payload /XXXX/
|
||||||
|
event "Found XXXX"
|
||||||
|
}
|
||||||
|
|
||||||
|
signature axxxx {
|
||||||
|
ip-proto = udp
|
||||||
|
payload /^XXXX/
|
||||||
|
event "Found ^XXXX"
|
||||||
|
}
|
||||||
|
|
||||||
|
signature sxxxx {
|
||||||
|
ip-proto = udp
|
||||||
|
payload /.*XXXX/
|
||||||
|
event "Found .*XXXX"
|
||||||
|
}
|
||||||
|
|
||||||
|
signature yyyy {
|
||||||
|
ip-proto = udp
|
||||||
|
payload /YYYY/
|
||||||
|
event "Found YYYY"
|
||||||
|
}
|
||||||
|
|
||||||
|
signature ayyyy {
|
||||||
|
ip-proto = udp
|
||||||
|
payload /^YYYY/
|
||||||
|
event "Found ^YYYY"
|
||||||
|
}
|
||||||
|
|
||||||
|
signature syyyy {
|
||||||
|
ip-proto = udp
|
||||||
|
payload /.*YYYY/
|
||||||
|
event "Found .*YYYY"
|
||||||
|
}
|
||||||
|
|
||||||
|
signature nope {
|
||||||
|
ip-proto = udp
|
||||||
|
payload /.*nope/
|
||||||
|
event "Found .*nope"
|
||||||
|
}
|
||||||
|
@TEST-END-FILE
|
||||||
|
|
||||||
|
event signature_match(state: signature_state, msg: string, data: string)
|
||||||
|
{
|
||||||
|
print "signature match", msg, data;
|
||||||
|
}
|
||||||
158
testing/external/scripts/external-ca-list.bro
vendored
Normal file
158
testing/external/scripts/external-ca-list.bro
vendored
Normal file
File diff suppressed because one or more lines are too long
2
testing/external/scripts/testing-setup.bro
vendored
2
testing/external/scripts/testing-setup.bro
vendored
|
|
@ -1,5 +1,7 @@
|
||||||
# Sets some testing specific options.
|
# Sets some testing specific options.
|
||||||
|
|
||||||
|
@load external-ca-list.bro
|
||||||
|
|
||||||
@ifdef ( SMTP::never_calc_md5 )
|
@ifdef ( SMTP::never_calc_md5 )
|
||||||
# MDD5s can depend on libmagic output.
|
# MDD5s can depend on libmagic output.
|
||||||
redef SMTP::never_calc_md5 = T;
|
redef SMTP::never_calc_md5 = T;
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue