From 232bee4096b29fe98c757d0c1437e48a3293bd44 Mon Sep 17 00:00:00 2001 From: Vlad Grigorescu Date: Wed, 29 May 2019 08:36:25 -0500 Subject: [PATCH 01/25] Remove old NTP analyzer. --- scripts/base/init-bare.zeek | 23 ----- src/NetVar.cc | 6 -- src/NetVar.h | 3 - src/analyzer/protocol/CMakeLists.txt | 1 - src/analyzer/protocol/ntp/CMakeLists.txt | 9 -- src/analyzer/protocol/ntp/NTP.cc | 114 ----------------------- src/analyzer/protocol/ntp/NTP.h | 69 -------------- src/analyzer/protocol/ntp/Plugin.cc | 25 ----- src/analyzer/protocol/ntp/events.bif | 21 ----- 9 files changed, 271 deletions(-) delete mode 100644 src/analyzer/protocol/ntp/CMakeLists.txt delete mode 100644 src/analyzer/protocol/ntp/NTP.cc delete mode 100644 src/analyzer/protocol/ntp/NTP.h delete mode 100644 src/analyzer/protocol/ntp/Plugin.cc delete mode 100644 src/analyzer/protocol/ntp/events.bif diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index 6cfddfeb65..3f469ab340 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -1113,9 +1113,6 @@ const table_expire_delay = 0.01 secs &redef; ## Time to wait before timing out a DNS request. const dns_session_timeout = 10 sec &redef; -## Time to wait before timing out an NTP request. -const ntp_session_timeout = 300 sec &redef; - ## Time to wait before timing out an RPC request. const rpc_timeout = 24 sec &redef; @@ -2529,26 +2526,6 @@ export { }; } -module GLOBAL; - -## An NTP message. -## -## .. zeek:see:: ntp_message -type ntp_msg: record { - id: count; ##< Message ID. - code: count; ##< Message code. - stratum: count; ##< Stratum. - poll: count; ##< Poll. - precision: int; ##< Precision. - distance: interval; ##< Distance. - dispersion: interval; ##< Dispersion. - ref_t: time; ##< Reference time. - originate_t: time; ##< Originating time. - receive_t: time; ##< Receive time. - xmit_t: time; ##< Send time. -}; - - module NTLM; export { diff --git a/src/NetVar.cc b/src/NetVar.cc index 3717f0c90f..b9230bece7 100644 --- a/src/NetVar.cc +++ b/src/NetVar.cc @@ -77,7 +77,6 @@ bool udp_content_deliver_all_orig; bool udp_content_deliver_all_resp; double dns_session_timeout; -double ntp_session_timeout; double rpc_timeout; ListVal* skip_authentication; @@ -103,8 +102,6 @@ TableType* pm_mappings; RecordType* pm_port_request; RecordType* pm_callit_request; -RecordType* ntp_msg; - RecordType* geo_location; RecordType* entropy_test_result; @@ -360,7 +357,6 @@ void init_net_var() bool(internal_val("udp_content_deliver_all_resp")->AsBool()); dns_session_timeout = opt_internal_double("dns_session_timeout"); - ntp_session_timeout = opt_internal_double("ntp_session_timeout"); rpc_timeout = opt_internal_double("rpc_timeout"); watchdog_interval = int(opt_internal_double("watchdog_interval")); @@ -390,8 +386,6 @@ void init_net_var() pm_port_request = internal_type("pm_port_request")->AsRecordType(); pm_callit_request = internal_type("pm_callit_request")->AsRecordType(); - ntp_msg = internal_type("ntp_msg")->AsRecordType(); - geo_location = internal_type("geo_location")->AsRecordType(); entropy_test_result = internal_type("entropy_test_result")->AsRecordType(); diff --git a/src/NetVar.h b/src/NetVar.h index 30c9003dc4..9fa4d75fa6 100644 --- a/src/NetVar.h +++ b/src/NetVar.h @@ -80,7 +80,6 @@ extern bool udp_content_deliver_all_orig; extern bool udp_content_deliver_all_resp; extern double dns_session_timeout; -extern double ntp_session_timeout; extern double rpc_timeout; extern ListVal* skip_authentication; @@ -106,8 +105,6 @@ extern TableType* pm_mappings; extern RecordType* pm_port_request; extern RecordType* pm_callit_request; -extern RecordType* ntp_msg; - extern RecordType* geo_location; extern RecordType* entropy_test_result; diff --git a/src/analyzer/protocol/CMakeLists.txt b/src/analyzer/protocol/CMakeLists.txt index 882ba23da9..30a86ea740 100644 --- a/src/analyzer/protocol/CMakeLists.txt +++ b/src/analyzer/protocol/CMakeLists.txt @@ -28,7 +28,6 @@ add_subdirectory(mysql) add_subdirectory(ncp) add_subdirectory(netbios) add_subdirectory(ntlm) -add_subdirectory(ntp) add_subdirectory(pia) add_subdirectory(pop3) add_subdirectory(radius) diff --git a/src/analyzer/protocol/ntp/CMakeLists.txt b/src/analyzer/protocol/ntp/CMakeLists.txt deleted file mode 100644 index a8b8bb1872..0000000000 --- a/src/analyzer/protocol/ntp/CMakeLists.txt +++ /dev/null @@ -1,9 +0,0 @@ - -include(BroPlugin) - -include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DIR}) - -bro_plugin_begin(Bro NTP) -bro_plugin_cc(NTP.cc Plugin.cc) -bro_plugin_bif(events.bif) -bro_plugin_end() diff --git a/src/analyzer/protocol/ntp/NTP.cc b/src/analyzer/protocol/ntp/NTP.cc deleted file mode 100644 index 61fd92ee84..0000000000 --- a/src/analyzer/protocol/ntp/NTP.cc +++ /dev/null @@ -1,114 +0,0 @@ -// See the file "COPYING" in the main distribution directory for copyright. - -#include "zeek-config.h" - -#include "NetVar.h" -#include "NTP.h" -#include "Sessions.h" -#include "Event.h" - -#include "events.bif.h" - -using namespace analyzer::ntp; - -NTP_Analyzer::NTP_Analyzer(Connection* conn) - : Analyzer("NTP", conn) - { - ADD_ANALYZER_TIMER(&NTP_Analyzer::ExpireTimer, - network_time + ntp_session_timeout, 1, - TIMER_NTP_EXPIRE); - } - -void NTP_Analyzer::Done() - { - Analyzer::Done(); - Event(udp_session_done); - } - -void NTP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, uint64 seq, const IP_Hdr* ip, int caplen) - { - Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen); - - // Actually we could just get rid of the Request/Reply and simply use - // the code of Message(). But for now we use it as an example of how - // to convert an old-style UDP analyzer. - if ( is_orig ) - Request(data, len); - else - Reply(data, len); - } - -int NTP_Analyzer::Request(const u_char* data, int len) - { - Message(data, len); - return 1; - } - -int NTP_Analyzer::Reply(const u_char* data, int len) - { - Message(data, len); - return 1; - } - -void NTP_Analyzer::Message(const u_char* data, int len) - { - if ( (unsigned) len < sizeof(struct ntpdata) ) - { - Weird("truncated_NTP"); - return; - } - - struct ntpdata* ntp_data = (struct ntpdata *) data; - len -= sizeof *ntp_data; - data += sizeof *ntp_data; - - if ( ! ntp_message ) - return; - - RecordVal* msg = new RecordVal(ntp_msg); - - unsigned int code = ntp_data->status & 0x7; - - msg->Assign(0, val_mgr->GetCount((unsigned int) (ntohl(ntp_data->refid)))); - msg->Assign(1, val_mgr->GetCount(code)); - msg->Assign(2, val_mgr->GetCount((unsigned int) ntp_data->stratum)); - msg->Assign(3, val_mgr->GetCount((unsigned int) ntp_data->ppoll)); - msg->Assign(4, val_mgr->GetInt((unsigned int) ntp_data->precision)); - msg->Assign(5, new Val(ShortFloat(ntp_data->distance), TYPE_INTERVAL)); - msg->Assign(6, new Val(ShortFloat(ntp_data->dispersion), TYPE_INTERVAL)); - msg->Assign(7, new Val(LongFloat(ntp_data->reftime), TYPE_TIME)); - msg->Assign(8, new Val(LongFloat(ntp_data->org), TYPE_TIME)); - msg->Assign(9, new Val(LongFloat(ntp_data->rec), TYPE_TIME)); - msg->Assign(10, new Val(LongFloat(ntp_data->xmt), TYPE_TIME)); - - ConnectionEventFast(ntp_message, { - BuildConnVal(), - msg, - new StringVal(new BroString(data, len, 0)), - }); - } - -double NTP_Analyzer::ShortFloat(struct s_fixedpt fp) - { - return ConvertToDouble(ntohs(fp.int_part), ntohs(fp.fraction), 65536.0); - } - -double NTP_Analyzer::LongFloat(struct l_fixedpt fp) - { - double t = ConvertToDouble(ntohl(fp.int_part), ntohl(fp.fraction), - 4294967296.0); - - return t ? t - JAN_1970 : 0.0; - } - -double NTP_Analyzer::ConvertToDouble(unsigned int int_part, - unsigned int fraction, double frac_base) - { - return double(int_part) + double(fraction) / frac_base; - } - -void NTP_Analyzer::ExpireTimer(double /* t */) - { - Event(connection_timeout); - sessions->Remove(Conn()); - } diff --git a/src/analyzer/protocol/ntp/NTP.h b/src/analyzer/protocol/ntp/NTP.h deleted file mode 100644 index 5b5d3d7baa..0000000000 --- a/src/analyzer/protocol/ntp/NTP.h +++ /dev/null @@ -1,69 +0,0 @@ -// See the file "COPYING" in the main distribution directory for copyright. - -#ifndef ANALYZER_PROTOCOL_NTP_NTP_H -#define ANALYZER_PROTOCOL_NTP_NTP_H - -#include "analyzer/protocol/udp/UDP.h" - -// The following are from the tcpdump distribution, credited there -// to the U of MD implementation. - -#define JAN_1970 2208988800.0 /* 1970 - 1900 in seconds */ - -namespace analyzer { namespace ntp { - -struct l_fixedpt { - unsigned int int_part; - unsigned int fraction; -}; - -struct s_fixedpt { - unsigned short int_part; - unsigned short fraction; -}; - -struct ntpdata { - unsigned char status; /* status of local clock and leap info */ - unsigned char stratum; /* Stratum level */ - unsigned char ppoll; /* poll value */ - int precision:8; - struct s_fixedpt distance; - struct s_fixedpt dispersion; - unsigned int refid; - struct l_fixedpt reftime; - struct l_fixedpt org; - struct l_fixedpt rec; - struct l_fixedpt xmt; -}; - -class NTP_Analyzer : public analyzer::Analyzer { -public: - explicit NTP_Analyzer(Connection* conn); - - static analyzer::Analyzer* Instantiate(Connection* conn) - { return new NTP_Analyzer(conn); } - -protected: - void Done() override; - void DeliverPacket(int len, const u_char* data, bool orig, - uint64 seq, const IP_Hdr* ip, int caplen) override; - - int Request(const u_char* data, int len); - int Reply(const u_char* data, int len); - - // NTP is a unidirectional protocol, so no notion of "requests" - // as separate from "replies". - void Message(const u_char* data, int len); - - double ShortFloat(struct s_fixedpt fp); - double LongFloat(struct l_fixedpt fp); - double ConvertToDouble(unsigned int int_part, unsigned int fraction, - double frac_base); - - friend class ConnectionTimer; - void ExpireTimer(double t); -}; - -} } // namespace analyzer::* - -#endif diff --git a/src/analyzer/protocol/ntp/Plugin.cc b/src/analyzer/protocol/ntp/Plugin.cc deleted file mode 100644 index 3399fbb867..0000000000 --- a/src/analyzer/protocol/ntp/Plugin.cc +++ /dev/null @@ -1,25 +0,0 @@ -// See the file in the main distribution directory for copyright. - - -#include "plugin/Plugin.h" - -#include "NTP.h" - -namespace plugin { -namespace Bro_NTP { - -class Plugin : public plugin::Plugin { -public: - plugin::Configuration Configure() - { - AddComponent(new ::analyzer::Component("NTP", ::analyzer::ntp::NTP_Analyzer::Instantiate)); - - plugin::Configuration config; - config.name = "Bro::NTP"; - config.description = "NTP analyzer"; - return config; - } -} plugin; - -} -} diff --git a/src/analyzer/protocol/ntp/events.bif b/src/analyzer/protocol/ntp/events.bif deleted file mode 100644 index d32d680799..0000000000 --- a/src/analyzer/protocol/ntp/events.bif +++ /dev/null @@ -1,21 +0,0 @@ -## Generated for all NTP messages. Different from many other of Bro's events, -## this one is generated for both client-side and server-side messages. -## -## See `Wikipedia `__ for -## more information about the NTP protocol. -## -## u: The connection record describing the corresponding UDP flow. -## -## msg: The parsed NTP message. -## -## excess: The raw bytes of any optional parts of the NTP packet. Bro does not -## further parse any optional fields. -## -## .. zeek:see:: ntp_session_timeout -## -## .. todo:: Bro's current default configuration does not activate the protocol -## analyzer that generates this event; the corresponding script has not yet -## been ported to Bro 2.x. To still enable this event, one needs to -## register a port for it or add a DPD payload signature. -event ntp_message%(u: connection, msg: ntp_msg, excess: string%); - From be4f6eae0eabc5ca74d867e5fadfb79db97b1a9c Mon Sep 17 00:00:00 2001 From: Vlad Grigorescu Date: Wed, 29 May 2019 09:04:48 -0500 Subject: [PATCH 02/25] Ran binpac_quickstart for NTP (UDP, not buffered) --- scripts/base/init-default.zeek | 1 + scripts/base/protocols/ntp/__load__.zeek | 3 ++ scripts/base/protocols/ntp/dpd.sig | 14 ++++++ scripts/base/protocols/ntp/main.zeek | 53 ++++++++++++++++++++++ src/analyzer/protocol/CMakeLists.txt | 3 +- src/analyzer/protocol/ntp/CMakeLists.txt | 11 +++++ src/analyzer/protocol/ntp/NTP.cc | 45 ++++++++++++++++++ src/analyzer/protocol/ntp/NTP.h | 40 ++++++++++++++++ src/analyzer/protocol/ntp/Plugin.cc | 25 ++++++++++ src/analyzer/protocol/ntp/events.bif | 14 ++++++ src/analyzer/protocol/ntp/ntp-analyzer.pac | 13 ++++++ src/analyzer/protocol/ntp/ntp-protocol.pac | 19 ++++++++ src/analyzer/protocol/ntp/ntp.pac | 41 +++++++++++++++++ 13 files changed, 281 insertions(+), 1 deletion(-) create mode 100644 scripts/base/protocols/ntp/__load__.zeek create mode 100644 scripts/base/protocols/ntp/dpd.sig create mode 100644 scripts/base/protocols/ntp/main.zeek create mode 100644 src/analyzer/protocol/ntp/CMakeLists.txt create mode 100644 src/analyzer/protocol/ntp/NTP.cc create mode 100644 src/analyzer/protocol/ntp/NTP.h create mode 100644 src/analyzer/protocol/ntp/Plugin.cc create mode 100644 src/analyzer/protocol/ntp/events.bif create mode 100644 src/analyzer/protocol/ntp/ntp-analyzer.pac create mode 100644 src/analyzer/protocol/ntp/ntp-protocol.pac create mode 100644 src/analyzer/protocol/ntp/ntp.pac diff --git a/scripts/base/init-default.zeek b/scripts/base/init-default.zeek index d8115895dc..5630440e48 100644 --- a/scripts/base/init-default.zeek +++ b/scripts/base/init-default.zeek @@ -56,6 +56,7 @@ @load base/protocols/modbus @load base/protocols/mysql @load base/protocols/ntlm +@load base/protocols/ntp @load base/protocols/pop3 @load base/protocols/radius @load base/protocols/rdp diff --git a/scripts/base/protocols/ntp/__load__.zeek b/scripts/base/protocols/ntp/__load__.zeek new file mode 100644 index 0000000000..9e43682d13 --- /dev/null +++ b/scripts/base/protocols/ntp/__load__.zeek @@ -0,0 +1,3 @@ +# Generated by binpac_quickstart +@load ./main +@load-sigs ./dpd.sig \ No newline at end of file diff --git a/scripts/base/protocols/ntp/dpd.sig b/scripts/base/protocols/ntp/dpd.sig new file mode 100644 index 0000000000..2eb583c6c9 --- /dev/null +++ b/scripts/base/protocols/ntp/dpd.sig @@ -0,0 +1,14 @@ +# Generated by binpac_quickstart + +signature dpd_ntp { + + ip-proto == udp + + + # ## TODO: Define the payload. When Bro sees this regex, on + # ## any port, it will enable your analyzer on that + # ## connection. + # ## payload /^NTP/ + + enable "ntp" +} \ No newline at end of file diff --git a/scripts/base/protocols/ntp/main.zeek b/scripts/base/protocols/ntp/main.zeek new file mode 100644 index 0000000000..74cfa44e77 --- /dev/null +++ b/scripts/base/protocols/ntp/main.zeek @@ -0,0 +1,53 @@ +##! Implements base functionality for NTP analysis. +##! Generates the Ntp.log file. + +# Generated by binpac_quickstart + +module Ntp; + +export { + redef enum Log::ID += { LOG }; + + type Info: record { + ## Timestamp for when the event happened. + ts: time &log; + ## Unique ID for the connection. + uid: string &log; + ## The connection's 4-tuple of endpoint addresses/ports. + id: conn_id &log; + + # ## TODO: Add other fields here that you'd like to log. + }; + + ## Event that can be handled to access the NTP record as it is sent on + ## to the loggin framework. + global log_ntp: event(rec: Info); +} + +# TODO: The recommended method to do dynamic protocol detection +# (DPD) is with the signatures in dpd.sig. If you can't come up +# with any signatures, then you can do port-based detection by +# uncommenting the following and specifying the port(s): + +# const ports = { 1234/udp, 5678/udp }; + + +# redef likely_server_ports += { ports }; + +event bro_init() &priority=5 + { + Log::create_stream(Ntp::LOG, [$columns=Info, $ev=log_ntp, $path="ntp"]); + + # TODO: If you're using port-based DPD, uncomment this. + # Analyzer::register_for_ports(Analyzer::ANALYZER_NTP, ports); + } + +event ntp_event(c: connection) + { + local info: Info; + info$ts = network_time(); + info$uid = c$uid; + info$id = c$id; + + Log::write(Ntp::LOG, info); + } \ No newline at end of file diff --git a/src/analyzer/protocol/CMakeLists.txt b/src/analyzer/protocol/CMakeLists.txt index 30a86ea740..8ebded627b 100644 --- a/src/analyzer/protocol/CMakeLists.txt +++ b/src/analyzer/protocol/CMakeLists.txt @@ -28,6 +28,7 @@ add_subdirectory(mysql) add_subdirectory(ncp) add_subdirectory(netbios) add_subdirectory(ntlm) +add_subdirectory(ntp) add_subdirectory(pia) add_subdirectory(pop3) add_subdirectory(radius) @@ -35,9 +36,9 @@ add_subdirectory(rdp) add_subdirectory(rfb) add_subdirectory(rpc) add_subdirectory(sip) -add_subdirectory(snmp) add_subdirectory(smb) add_subdirectory(smtp) +add_subdirectory(snmp) add_subdirectory(socks) add_subdirectory(ssh) add_subdirectory(ssl) diff --git a/src/analyzer/protocol/ntp/CMakeLists.txt b/src/analyzer/protocol/ntp/CMakeLists.txt new file mode 100644 index 0000000000..b42e467af5 --- /dev/null +++ b/src/analyzer/protocol/ntp/CMakeLists.txt @@ -0,0 +1,11 @@ +# Generated by binpac_quickstart + +include(BroPlugin) + +include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DIR}) + +bro_plugin_begin(Bro NTP) + bro_plugin_cc(NTP.cc Plugin.cc) + bro_plugin_bif(events.bif) + bro_plugin_pac(ntp.pac ntp-analyzer.pac ntp-protocol.pac) +bro_plugin_end() \ No newline at end of file diff --git a/src/analyzer/protocol/ntp/NTP.cc b/src/analyzer/protocol/ntp/NTP.cc new file mode 100644 index 0000000000..6918578a02 --- /dev/null +++ b/src/analyzer/protocol/ntp/NTP.cc @@ -0,0 +1,45 @@ +// Generated by binpac_quickstart + +#include "NTP.h" + +#include "Reporter.h" + +#include "events.bif.h" + +using namespace analyzer::NTP; + +NTP_Analyzer::NTP_Analyzer(Connection* c) + +: analyzer::Analyzer("NTP", c) + + { + interp = new binpac::NTP::NTP_Conn(this); + + } + +NTP_Analyzer::~NTP_Analyzer() + { + delete interp; + } + +void NTP_Analyzer::Done() + { + + Analyzer::Done(); + + } + +void NTP_Analyzer::DeliverPacket(int len, const u_char* data, + bool orig, uint64 seq, const IP_Hdr* ip, int caplen) + { + Analyzer::DeliverPacket(len, data, orig, seq, ip, caplen); + + try + { + interp->NewData(orig, data, data + len); + } + catch ( const binpac::Exception& e ) + { + ProtocolViolation(fmt("Binpac exception: %s", e.c_msg())); + } + } diff --git a/src/analyzer/protocol/ntp/NTP.h b/src/analyzer/protocol/ntp/NTP.h new file mode 100644 index 0000000000..8850addfd1 --- /dev/null +++ b/src/analyzer/protocol/ntp/NTP.h @@ -0,0 +1,40 @@ +// Generated by binpac_quickstart + +#ifndef ANALYZER_PROTOCOL_NTP_NTP_H +#define ANALYZER_PROTOCOL_NTP_NTP_H + +#include "events.bif.h" + + +#include "analyzer/protocol/udp/UDP.h" + +#include "ntp_pac.h" + +namespace analyzer { namespace NTP { + +class NTP_Analyzer + +: public analyzer::Analyzer { + +public: + NTP_Analyzer(Connection* conn); + virtual ~NTP_Analyzer(); + + // Overriden from Analyzer. + virtual void Done(); + + virtual void DeliverPacket(int len, const u_char* data, bool orig, + uint64 seq, const IP_Hdr* ip, int caplen); + + + static analyzer::Analyzer* InstantiateAnalyzer(Connection* conn) + { return new NTP_Analyzer(conn); } + +protected: + binpac::NTP::NTP_Conn* interp; + +}; + +} } // namespace analyzer::* + +#endif \ No newline at end of file diff --git a/src/analyzer/protocol/ntp/Plugin.cc b/src/analyzer/protocol/ntp/Plugin.cc new file mode 100644 index 0000000000..2ff9d52d66 --- /dev/null +++ b/src/analyzer/protocol/ntp/Plugin.cc @@ -0,0 +1,25 @@ +// Generated by binpac_quickstart + +#include "plugin/Plugin.h" + +#include "NTP.h" + +namespace plugin { +namespace Bro_NTP { + +class Plugin : public plugin::Plugin { +public: + plugin::Configuration Configure() + { + AddComponent(new ::analyzer::Component("NTP", + ::analyzer::NTP::NTP_Analyzer::InstantiateAnalyzer)); + + plugin::Configuration config; + config.name = "Bro::NTP"; + config.description = "Network Time Protocol analyzer"; + return config; + } +} plugin; + +} +} \ No newline at end of file diff --git a/src/analyzer/protocol/ntp/events.bif b/src/analyzer/protocol/ntp/events.bif new file mode 100644 index 0000000000..cb2388098c --- /dev/null +++ b/src/analyzer/protocol/ntp/events.bif @@ -0,0 +1,14 @@ +# Generated by binpac_quickstart + +# In this file, you'll define the events that your analyzer will +# generate. A sample event is included. + +# ## TODO: Edit the sample event, and add more events. + +## Generated for NTP connections +## +## See `Google `__ for more information about NTP +## +## c: The connection +## +event ntp_event%(c: connection%); \ No newline at end of file diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac new file mode 100644 index 0000000000..d5fdc54594 --- /dev/null +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -0,0 +1,13 @@ +# Generated by binpac_quickstart + +refine flow NTP_Flow += { + function proc_ntp_message(msg: NTP_PDU): bool + %{ + BifEvent::generate_ntp_event(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn()); + return true; + %} +}; + +refine typeattr NTP_PDU += &let { + proc: bool = $context.flow.proc_ntp_message(this); +}; \ No newline at end of file diff --git a/src/analyzer/protocol/ntp/ntp-protocol.pac b/src/analyzer/protocol/ntp/ntp-protocol.pac new file mode 100644 index 0000000000..7571d9f857 --- /dev/null +++ b/src/analyzer/protocol/ntp/ntp-protocol.pac @@ -0,0 +1,19 @@ +# Generated by binpac_quickstart + +# ## TODO: Add your protocol structures in here. +# ## some examples: + +# Types are your basic building blocks. +# There are some builtins, or you can define your own. +# Here's a definition for a regular expression: +# type NTP_WHITESPACE = RE/[ \t]*/; + +# A record is a collection of types. +# Here's one with the built-in types +# type example = record { +# +# }; + +type NTP_PDU(is_orig: bool) = record { + data: bytestring &restofdata; +} &byteorder=bigendian; \ No newline at end of file diff --git a/src/analyzer/protocol/ntp/ntp.pac b/src/analyzer/protocol/ntp/ntp.pac new file mode 100644 index 0000000000..f1f4e7ed22 --- /dev/null +++ b/src/analyzer/protocol/ntp/ntp.pac @@ -0,0 +1,41 @@ +# Generated by binpac_quickstart + +# Analyzer for Network Time Protocol +# - ntp-protocol.pac: describes the NTP protocol messages +# - ntp-analyzer.pac: describes the NTP analyzer code + +%include binpac.pac +%include bro.pac + +%extern{ + #include "events.bif.h" +%} + +analyzer NTP withcontext { + connection: NTP_Conn; + flow: NTP_Flow; +}; + +# Our connection consists of two flows, one in each direction. +connection NTP_Conn(bro_analyzer: BroAnalyzer) { + upflow = NTP_Flow(true); + downflow = NTP_Flow(false); +}; + +%include ntp-protocol.pac + +# Now we define the flow: +flow NTP_Flow(is_orig: bool) { + + # ## TODO: Determine if you want flowunit or datagram parsing: + + # Using flowunit will cause the anlayzer to buffer incremental input. + # This is needed for &oneline and &length. If you don't need this, you'll + # get better performance with datagram. + + # flowunit = NTP_PDU(is_orig) withcontext(connection, this); + datagram = NTP_PDU(is_orig) withcontext(connection, this); + +}; + +%include ntp-analyzer.pac \ No newline at end of file From 2005a76896ba20637732db1f86911256ae5ef3ea Mon Sep 17 00:00:00 2001 From: Vlad Grigorescu Date: Wed, 29 May 2019 09:37:55 -0500 Subject: [PATCH 03/25] WIP: BinPAC NTP analyzer --- scripts/base/init-bare.zeek | 49 ++ scripts/base/protocols/ntp/__load__.zeek | 2 +- scripts/base/protocols/ntp/consts.zeek | 15 + scripts/base/protocols/ntp/main.zeek | 122 +++-- src/analyzer/protocol/ntp/CMakeLists.txt | 3 +- src/analyzer/protocol/ntp/NTP.h | 4 +- src/analyzer/protocol/ntp/events.bif | 18 +- src/analyzer/protocol/ntp/ntp-analyzer.pac | 98 +++- src/analyzer/protocol/ntp/ntp-protocol.pac | 227 ++++++++- src/analyzer/protocol/ntp/ntp.pac | 10 +- src/analyzer/protocol/ntp/types.bif | 5 + testing/btest/Baseline/plugins.hooks/output | 497 +++++++++++--------- 12 files changed, 743 insertions(+), 307 deletions(-) create mode 100644 scripts/base/protocols/ntp/consts.zeek create mode 100644 src/analyzer/protocol/ntp/types.bif diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index 3f469ab340..dfa00115cc 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -2526,6 +2526,55 @@ export { }; } +module NTP; + +export { + ## NTP message as defined in :rfc:`5905`. + ## Doesn't include fields for mode 7 (reserved for private use), e.g. monlist + type NTP::Message: record { + ## The NTP version number + version: count; + ## The NTP mode being used + mode: count; + ## The stratum (primary server, secondary server, etc.) + stratum: count; + ## The maximum interval between successive messages + poll: interval; + ## The precision of the system clock + precision: interval; + + ## Total round-trip delay to the reference clock + root_delay: interval; + ## Total dispersion to the reference clock + root_disp: interval; + ## For stratum 0, 4 character string used for debugging + kiss_code: string &optional; + ## For stratum 1, ID assigned to the reference clock by IANA + ref_id: string &optional; + ## Above stratum 1, when using IPv4, the IP address of the reference clock + ref_addr: addr &optional; + + ## Above stratum 1, when using IPv6, the first four bytes of the MD5 hash of the + ## IPv6 address of the reference clock + ref_v6_hash_prefix: string &optional; + ## Time when the system clock was last set or correct + ref_time: time; + ## Time at the client when the request departed for the NTP server + org_time: time; + ## Time at the server when the request arrived from the NTP client + rec_time: time; + ## Time at the server when the response departed for the NTP client + xmt_time: time; + ## Key used to designate a secret MD5 key + key_id: count &optional; + ## MD5 hash computed over the key followed by the NTP packet header and extension fields + digest: string &optional; + ## Number of extension fields (which are not currently parsed) + num_exts: count &default=0; + }; +} + + module NTLM; export { diff --git a/scripts/base/protocols/ntp/__load__.zeek b/scripts/base/protocols/ntp/__load__.zeek index 9e43682d13..4ca8806d3b 100644 --- a/scripts/base/protocols/ntp/__load__.zeek +++ b/scripts/base/protocols/ntp/__load__.zeek @@ -1,3 +1,3 @@ # Generated by binpac_quickstart @load ./main -@load-sigs ./dpd.sig \ No newline at end of file +@load ./consts \ No newline at end of file diff --git a/scripts/base/protocols/ntp/consts.zeek b/scripts/base/protocols/ntp/consts.zeek new file mode 100644 index 0000000000..8b6cec2e3d --- /dev/null +++ b/scripts/base/protocols/ntp/consts.zeek @@ -0,0 +1,15 @@ +module NTP; + +export { + ## The descriptions of the NTP mode value, as described + ## in :rfc:`5905`, Figure 1 + const modes: table[count] of string = { + [1] = "symmetric active", + [2] = "symmetric passive", + [3] = "client", + [4] = "server", + [5] = "broadcast server", + [6] = "broadcast client", + [7] = "reserved", + } &default=function(i: count):string { return fmt("unknown-%d", i); } &redef; +} \ No newline at end of file diff --git a/scripts/base/protocols/ntp/main.zeek b/scripts/base/protocols/ntp/main.zeek index 74cfa44e77..b39547d6a6 100644 --- a/scripts/base/protocols/ntp/main.zeek +++ b/scripts/base/protocols/ntp/main.zeek @@ -1,53 +1,119 @@ -##! Implements base functionality for NTP analysis. -##! Generates the Ntp.log file. +module NTP; -# Generated by binpac_quickstart - -module Ntp; +@load ./consts export { redef enum Log::ID += { LOG }; type Info: record { ## Timestamp for when the event happened. - ts: time &log; + ts: time &log; ## Unique ID for the connection. - uid: string &log; + uid: string &log; ## The connection's 4-tuple of endpoint addresses/ports. - id: conn_id &log; - - # ## TODO: Add other fields here that you'd like to log. + id: conn_id &log; + ## The version of NTP + ver: count &log; + ## The stratum (primary, secondary, etc.) of the server + stratum: count &log &optional; + ## The precision of the system clock of the client + precision: interval &log &optional; + ## The time at the client that the request was sent to the server + org_time: time &log &optional; + ## The time at the server when the request was received + rec_time: time &log &optional; + ## The time at the server when the reply was sent + xmt_time: time &log &optional; + ## For stratum 0, 4 character string used for debugging + kiss_code: string &log &optional; + ## For stratum 1, ID assigned to the clock by IANA + ref_id: string &log &optional; + ## The IP of the server's reference clock + ref_clock: addr &log &optional; }; ## Event that can be handled to access the NTP record as it is sent on - ## to the loggin framework. + ## to the logging framework. global log_ntp: event(rec: Info); } -# TODO: The recommended method to do dynamic protocol detection -# (DPD) is with the signatures in dpd.sig. If you can't come up -# with any signatures, then you can do port-based detection by -# uncommenting the following and specifying the port(s): +redef record connection += { + ntp: Info &optional; +}; -# const ports = { 1234/udp, 5678/udp }; +const ports = { 123/udp }; +redef likely_server_ports += { ports }; -# redef likely_server_ports += { ports }; - -event bro_init() &priority=5 +event zeek_init() &priority=5 { - Log::create_stream(Ntp::LOG, [$columns=Info, $ev=log_ntp, $path="ntp"]); + Log::create_stream(NTP::LOG, [$columns=Info, $ev=log_ntp, $path="ntp"]); - # TODO: If you're using port-based DPD, uncomment this. - # Analyzer::register_for_ports(Analyzer::ANALYZER_NTP, ports); + Analyzer::register_for_ports(Analyzer::ANALYZER_NTP, ports); } -event ntp_event(c: connection) +event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) &priority=5 { + # Record initialization local info: Info; - info$ts = network_time(); - info$uid = c$uid; - info$id = c$id; + if ( c?$ntp ) + info = c$ntp; + else + { + info$ts = network_time(); + info$uid = c$uid; + info$id = c$id; + info$ver = msg$version; + } - Log::write(Ntp::LOG, info); - } \ No newline at end of file + # From the request, we get the desired precision + if ( is_orig ) + { + info$precision = msg$precision; + c$ntp = info; + return; + } + + # From the response, we fill out most of the rest of the fields. + info$stratum = msg$stratum; + info$org_time = msg$org_time; + info$rec_time = msg$rec_time; + info$xmt_time = msg$xmt_time; + + # Stratum 1 has the textual reference ID + if ( msg$stratum == 1 ) + info$ref_id = gsub(msg$ref_id, /\x00*/, ""); + + # Higher stratums using IPv4 have the address of the reference server. + if ( msg$stratum > 1 ) + { + if ( is_v4_addr(c$id$orig_h) ) + info$ref_clock = msg$ref_addr; + } + c$ntp = info; + } + +event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) &priority=-5 + { + if ( ! is_orig ) + { + Log::write(NTP::LOG, c$ntp); + delete c$ntp; + } + } + +event connection_state_remove(c: connection) &priority=-5 + { + if ( c?$ntp ) + Log::write(NTP::LOG, c$ntp); + } + +event ntp_mode6_message(c: connection, is_orig: bool, opcode: count) + { + print "Mode 6", opcode; + } + +event ntp_mode7_message(c: connection, is_orig: bool, opcode: count) + { + print "Mode 7", opcode; + } diff --git a/src/analyzer/protocol/ntp/CMakeLists.txt b/src/analyzer/protocol/ntp/CMakeLists.txt index b42e467af5..8d603f49f6 100644 --- a/src/analyzer/protocol/ntp/CMakeLists.txt +++ b/src/analyzer/protocol/ntp/CMakeLists.txt @@ -6,6 +6,7 @@ include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DI bro_plugin_begin(Bro NTP) bro_plugin_cc(NTP.cc Plugin.cc) + bro_plugin_bif(types.bif) bro_plugin_bif(events.bif) bro_plugin_pac(ntp.pac ntp-analyzer.pac ntp-protocol.pac) -bro_plugin_end() \ No newline at end of file +bro_plugin_end() diff --git a/src/analyzer/protocol/ntp/NTP.h b/src/analyzer/protocol/ntp/NTP.h index 8850addfd1..f7d9912131 100644 --- a/src/analyzer/protocol/ntp/NTP.h +++ b/src/analyzer/protocol/ntp/NTP.h @@ -4,7 +4,7 @@ #define ANALYZER_PROTOCOL_NTP_NTP_H #include "events.bif.h" - +#include "types.bif.h" #include "analyzer/protocol/udp/UDP.h" @@ -37,4 +37,4 @@ protected: } } // namespace analyzer::* -#endif \ No newline at end of file +#endif diff --git a/src/analyzer/protocol/ntp/events.bif b/src/analyzer/protocol/ntp/events.bif index cb2388098c..4205b28efd 100644 --- a/src/analyzer/protocol/ntp/events.bif +++ b/src/analyzer/protocol/ntp/events.bif @@ -1,14 +1,12 @@ -# Generated by binpac_quickstart - -# In this file, you'll define the events that your analyzer will -# generate. A sample event is included. - -# ## TODO: Edit the sample event, and add more events. - -## Generated for NTP connections +## Generated for NTP time synchronization messages ## -## See `Google `__ for more information about NTP +## For more information about NTP, refer to :rfc:`5905` ## ## c: The connection ## -event ntp_event%(c: connection%); \ No newline at end of file +## msg: The NTP message record +## +event ntp_message%(c: connection, is_orig: bool, msg: NTP::Message%); + +event ntp_mode6_message%(c: connection, is_orig: bool, opcode: count%); +event ntp_mode7_message%(c: connection, is_orig: bool, opcode: count%); diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index d5fdc54594..d887dd4a25 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -1,13 +1,99 @@ -# Generated by binpac_quickstart +%extern{ +#include +#define FRAC_16 pow(2,-16) +#define FRAC_32 pow(2,-32) +// NTP defines the epoch from 1900, not 1970 +#define EPOCH_OFFSET -2208988800 +%} + +%header{ +Val* proc_ntp_short(const NTP_Short_Time* t); +Val* proc_ntp_timestamp(const NTP_Time* t); +%} + +%code{ +Val* proc_ntp_short(const NTP_Short_Time* t) + { + if ( t->seconds() == 0 && t->fractions() == 0 ) + return new Val(0.0, TYPE_INTERVAL); + return new Val(t->seconds() + t->fractions()*FRAC_16, TYPE_INTERVAL); + } + +Val* proc_ntp_timestamp(const NTP_Time* t) + { + if ( t->seconds() == 0 && t->fractions() == 0) + return new Val(0.0, TYPE_TIME); + return new Val(EPOCH_OFFSET + t->seconds() + (t->fractions()*FRAC_32), TYPE_TIME); + } +%} refine flow NTP_Flow += { - function proc_ntp_message(msg: NTP_PDU): bool + function proc_ntp_association(msg: NTP_Association): bool %{ - BifEvent::generate_ntp_event(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn()); + RecordVal* rv = new RecordVal(BifType::Record::NTP::Message); + rv->Assign(0, new Val(${msg.version}, TYPE_COUNT)); + rv->Assign(1, new Val(${msg.mode}, TYPE_COUNT)); + rv->Assign(2, new Val(${msg.stratum}, TYPE_COUNT)); + rv->Assign(3, new Val(pow(2, ${msg.poll}), TYPE_INTERVAL)); + rv->Assign(4, new Val(pow(2, ${msg.precision}), TYPE_INTERVAL)); + + rv->Assign(5, proc_ntp_short(${msg.root_delay})); + rv->Assign(6, proc_ntp_short(${msg.root_dispersion})); + switch ( ${msg.stratum} ) + { + case 0: + // unknown stratum => kiss code + rv->Assign(7, bytestring_to_val(${msg.reference_id})); + break; + case 1: + // reference clock => ref clock string + rv->Assign(8, bytestring_to_val(${msg.reference_id})); + break; + default: + // TODO: Check for v4/v6 + const uint8* d = ${msg.reference_id}.data(); + rv->Assign(9, new AddrVal(IPAddr(IPv4, (const uint32*) d, IPAddr::Network))); + break; + } + + rv->Assign(11, proc_ntp_timestamp(${msg.reference_ts})); + rv->Assign(12, proc_ntp_timestamp(${msg.origin_ts})); + rv->Assign(13, proc_ntp_timestamp(${msg.receive_ts})); + rv->Assign(14, proc_ntp_timestamp(${msg.transmit_ts})); + + rv->Assign(17, new Val((uint32) ${msg.extensions}->size(), TYPE_COUNT)); + + BifEvent::generate_ntp_message(connection()->bro_analyzer(), + connection()->bro_analyzer()->Conn(), + is_orig(), rv); + return true; + %} + + function proc_ntp_mode6(msg: NTP_Mode6): bool + %{ + BifEvent::generate_ntp_mode6_message(connection()->bro_analyzer(), + connection()->bro_analyzer()->Conn(), + is_orig(), ${msg.opcode}); + return true; + %} + + function proc_ntp_mode7(msg: NTP_Mode7): bool + %{ + BifEvent::generate_ntp_mode7_message(connection()->bro_analyzer(), + connection()->bro_analyzer()->Conn(), + is_orig(), ${msg.request_code}); return true; %} }; -refine typeattr NTP_PDU += &let { - proc: bool = $context.flow.proc_ntp_message(this); -}; \ No newline at end of file +refine typeattr NTP_Association += &let { + proc: bool = $context.flow.proc_ntp_association(this); +}; + +refine typeattr NTP_Mode6 += &let { + proc: bool = $context.flow.proc_ntp_mode6(this); +}; + +refine typeattr NTP_Mode7 += &let { + proc: bool = $context.flow.proc_ntp_mode7(this); +}; diff --git a/src/analyzer/protocol/ntp/ntp-protocol.pac b/src/analyzer/protocol/ntp/ntp-protocol.pac index 7571d9f857..1b36974a0c 100644 --- a/src/analyzer/protocol/ntp/ntp-protocol.pac +++ b/src/analyzer/protocol/ntp/ntp-protocol.pac @@ -1,19 +1,210 @@ -# Generated by binpac_quickstart - -# ## TODO: Add your protocol structures in here. -# ## some examples: - -# Types are your basic building blocks. -# There are some builtins, or you can define your own. -# Here's a definition for a regular expression: -# type NTP_WHITESPACE = RE/[ \t]*/; - -# A record is a collection of types. -# Here's one with the built-in types -# type example = record { -# -# }; - type NTP_PDU(is_orig: bool) = record { - data: bytestring &restofdata; -} &byteorder=bigendian; \ No newline at end of file + first_byte : uint8; + + # Modes 1-5 are standard NTP time sync + mode_chk_1 : case (mode>=1 && mode<=5) of { + true -> msg: NTP_Association(first_byte, mode, version); + false -> unk: empty; + } &requires(version); + + mode_chk_2 : case (mode) of { + 6 -> ctl_msg : NTP_Mode6(first_byte, version) &restofdata; + 7 -> mode_7 : NTP_Mode7(first_byte, version) &restofdata; + default -> unknown: bytestring &restofdata; + } &requires(version); + +} &let { + mode: uint8 = (first_byte & 0x7); # Bytes 6-8 of 8-byte value + version: uint8 = (first_byte & 0x38) >> 3; # Bytes 3-5 of 8-byte value +} &byteorder=bigendian; + +type NTP_Association(first_byte: uint8, mode: uint8, version: uint8) = record { + stratum : uint8; + poll : int8; + precision : int8; + + root_delay : NTP_Short_Time; + root_dispersion: NTP_Short_Time; + reference_id : bytestring &length=4; + reference_ts : NTP_Time; + + origin_ts : NTP_Time; + receive_ts : NTP_Time; + transmit_ts : NTP_Time; + + extensions : Extension_Field[] &until($input.length() <= 18); + have_mac : case (offsetof(have_mac) < length) of { + true -> mac : NTP_MAC; + false -> nil : empty; + } &requires(length); +} &let { + leap: bool = (first_byte & 0xc0); # First 2 bytes of 8-byte value + leap_61: bool = (leap & 0x40) > 0; # leap_indicator == 1 + leap_59: bool = (leap & 0x80) > 0; # leap_indicator == 2 + leap_unk: bool = (leap & 0xc0) > 0; # leap_indicator == 3 + length = sourcedata.length(); +} &exportsourcedata; + +type NTP_MAC = record { + key_id: uint32; + digest: bytestring &length=16; +} &length=18; + +type Extension_Field = record { + field_type: uint16; + length : uint16; + data : bytestring &length=length-4; +}; + +type NTP_Short_Time = record { + seconds: int16; + fractions: int16; +}; + +type NTP_Time = record { + seconds: uint32; + fractions: uint32; +}; + + +# From RFC 1305, Appendix B: +type NTP_Mode6(first_byte: uint8, version: uint8) = record { + rem_op : uint8; + sequence: uint16; + status : uint16; + assoc_id: uint16; + offset : uint16; + count : uint16; + data : bytestring &length=count; + pad : padding[pad_length]; + opt_auth: bytestring &restofdata; +} &let { + response_bit: bool = (rem_op & 0x80) > 0; + error_bit : bool = (rem_op & 0x40) > 0; + more_bit : bool = (rem_op & 0x20) > 0; + opcode : uint8 = (rem_op & 0x1f); + pad_length : uint8 = (count % 32 == 0) ? 0 : 32 - (count % 32); +}; + + +# From ntp/include/ntp_request.h of the ntp-project: +# +# A mode 7 packet is used exchanging data between an NTP server +# and a client for purposes other than time synchronization, e.g. +# monitoring, statistics gathering and configuration. A mode 7 +# packet has the following format: +# +# 0 1 2 3 +# 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# |R|M| VN | Mode|A| Sequence | Implementation| Req Code | +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# | Err | Number of data items | MBZ | Size of data item | +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# | | +# | Data (Minimum 0 octets, maximum 500 octets) | +# | | +# [...] +# | | +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# | Encryption Keyid (when A bit set) | +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# | | +# | Message Authentication Code (when A bit set) | +# | | +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# +# where the fields are (note that the client sends requests, the server +# responses): +# +# Response Bit: This packet is a response (if clear, packet is a request). +# +# More Bit: Set for all packets but the last in a response which +# requires more than one packet. +# +# Version Number: 2 for current version +# +# Mode: Always 7 +# +# Authenticated bit: If set, this packet is authenticated. +# +# Sequence number: For a multipacket response, contains the sequence +# number of this packet. 0 is the first in the sequence, +# 127 (or less) is the last. The More Bit must be set in +# all packets but the last. +# +# Implementation number: The number of the implementation this request code +# is defined by. An implementation number of zero is used +# for requst codes/data formats which all implementations +# agree on. Implementation number 255 is reserved (for +# extensions, in case we run out). +# +# Request code: An implementation-specific code which specifies the +# operation to be (which has been) performed and/or the +# format and semantics of the data included in the packet. +# +# Err: Must be 0 for a request. For a response, holds an error +# code relating to the request. If nonzero, the operation +# requested wasn't performed. +# +# 0 - no error +# 1 - incompatible implementation number +# 2 - unimplemented request code +# 3 - format error (wrong data items, data size, packet size etc.) +# 4 - no data available (e.g. request for details on unknown peer) +# 5-6 I don't know +# 7 - authentication failure (i.e. permission denied) +# +# Number of data items: number of data items in packet. 0 to 500 +# +# MBZ: A reserved data field, must be zero in requests and responses. +# +# Size of data item: size of each data item in packet. 0 to 500 +# +# Data: Variable sized area containing request/response data. For +# requests and responses the size in octets must be greater +# than or equal to the product of the number of data items +# and the size of a data item. For requests the data area +# must be exactly 40 octets in length. For responses the +# data area may be any length between 0 and 500 octets +# inclusive. +# +# Message Authentication Code: Same as NTP spec, in definition and function. +# May optionally be included in requests which require +# authentication, is never included in responses. +# +# The version number, mode and keyid have the same function and are +# in the same location as a standard NTP packet. The request packet +# is the same size as a standard NTP packet to ease receive buffer +# management, and to allow the same encryption procedure to be used +# both on mode 7 and standard NTP packets. The mac is included when +# it is required that a request be authenticated, the keyid should be +# zero in requests in which the mac is not included. +# +# The data format depends on the implementation number/request code pair +# and whether the packet is a request or a response. The only requirement +# is that data items start in the octet immediately following the size +# word and that data items be concatenated without padding between (i.e. +# if the data area is larger than data_items*size, all padding is at +# the end). Padding is ignored, other than for encryption purposes. +# Implementations using encryption might want to include a time stamp +# or other data in the request packet padding. The key used for requests +# is implementation defined, but key 15 is suggested as a default. +# +type NTP_Mode7(first_byte: uint8, version: uint8) = record { + second_byte : uint8; + implementation_num: uint8; + request_code : uint8; + err_and_data_len : uint16; + data : bytestring &length=data_len; + have_mac : case(auth_bit) of { + true -> mac: NTP_MAC; + false -> nil: empty; + }; +} &let { + auth_bit : bool = (second_byte & 0x80) > 0; + sequence : uint8 = (second_byte & 0x7F); + error_code: uint8 = (err_and_data_len & 0xF000) >> 12; + data_len : uint16 = (err_and_data_len & 0x0FFF); +}; + diff --git a/src/analyzer/protocol/ntp/ntp.pac b/src/analyzer/protocol/ntp/ntp.pac index f1f4e7ed22..5ec3957078 100644 --- a/src/analyzer/protocol/ntp/ntp.pac +++ b/src/analyzer/protocol/ntp/ntp.pac @@ -9,6 +9,7 @@ %extern{ #include "events.bif.h" + #include "types.bif.h" %} analyzer NTP withcontext { @@ -26,16 +27,7 @@ connection NTP_Conn(bro_analyzer: BroAnalyzer) { # Now we define the flow: flow NTP_Flow(is_orig: bool) { - - # ## TODO: Determine if you want flowunit or datagram parsing: - - # Using flowunit will cause the anlayzer to buffer incremental input. - # This is needed for &oneline and &length. If you don't need this, you'll - # get better performance with datagram. - - # flowunit = NTP_PDU(is_orig) withcontext(connection, this); datagram = NTP_PDU(is_orig) withcontext(connection, this); - }; %include ntp-analyzer.pac \ No newline at end of file diff --git a/src/analyzer/protocol/ntp/types.bif b/src/analyzer/protocol/ntp/types.bif new file mode 100644 index 0000000000..1a5fd07faa --- /dev/null +++ b/src/analyzer/protocol/ntp/types.bif @@ -0,0 +1,5 @@ +module NTP; + +type NTP::Message: record; + +module GLOBAL; \ No newline at end of file diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output index 950b898ab1..acd598becc 100644 --- a/testing/btest/Baseline/plugins.hooks/output +++ b/testing/btest/Baseline/plugins.hooks/output @@ -37,6 +37,7 @@ 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_MODBUS, 502/tcp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_MYSQL, 1434/tcp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_MYSQL, 3306/tcp)) -> +0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_NTP, 123/udp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_RADIUS, 1812/udp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_RDP, 3389/tcp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_SIP, 5060/udp)) -> @@ -103,6 +104,7 @@ 0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_MODBUS, 502/tcp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_MYSQL, 1434/tcp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_MYSQL, 3306/tcp)) -> +0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_NTP, 123/udp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_RADIUS, 1812/udp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_RDP, 3389/tcp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_SIP, 5060/udp)) -> @@ -145,6 +147,7 @@ 0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_KRB_TCP, {88/tcp})) -> 0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_MODBUS, {502/tcp})) -> 0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_MYSQL, {1434<...>/tcp})) -> +0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_NTP, {123/udp})) -> 0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_RADIUS, {1812/udp})) -> 0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_RDP, {3389/tcp})) -> 0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_SIP, {5060/udp})) -> @@ -202,6 +205,7 @@ 0.000000 MetaHookPost CallFunction(Log::__add_filter, , (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=kerberos, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> 0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=modbus, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> 0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntlm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> 0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_catch_release, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> 0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_drop, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> 0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> @@ -248,6 +252,7 @@ 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (KRB::LOG, [columns=KRB::Info, ev=KRB::log_krb, path=kerberos])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Modbus::LOG, [columns=Modbus::Info, ev=Modbus::log_modbus, path=modbus])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (NTLM::LOG, [columns=NTLM::Info, ev=, path=ntlm])) -> +0.000000 MetaHookPost CallFunction(Log::__create_stream, , (NTP::LOG, [columns=NTP::Info, ev=NTP::log_ntp, path=ntp])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (NetControl::CATCH_RELEASE, [columns=NetControl::CatchReleaseInfo, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (NetControl::DROP, [columns=NetControl::DropInfo, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (NetControl::LOG, [columns=NetControl::Info, ev=NetControl::log_netcontrol, path=netcontrol])) -> @@ -277,7 +282,7 @@ 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> -0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1555986109.036092, node=bro, filter=ip or not ip, init=T, success=T])) -> +0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1559140567.483887, node=bro, filter=ip or not ip, init=T, success=T])) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Broker::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Cluster::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Config::LOG)) -> @@ -295,6 +300,7 @@ 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (KRB::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Modbus::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (NTLM::LOG)) -> +0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (NTP::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (NetControl::CATCH_RELEASE)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (NetControl::DROP)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (NetControl::LOG)) -> @@ -341,6 +347,7 @@ 0.000000 MetaHookPost CallFunction(Log::add_filter, , (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> 0.000000 MetaHookPost CallFunction(Log::add_filter, , (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> 0.000000 MetaHookPost CallFunction(Log::add_filter, , (NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> +0.000000 MetaHookPost CallFunction(Log::add_filter, , (NTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> 0.000000 MetaHookPost CallFunction(Log::add_filter, , (NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> 0.000000 MetaHookPost CallFunction(Log::add_filter, , (NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> 0.000000 MetaHookPost CallFunction(Log::add_filter, , (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) -> @@ -387,6 +394,7 @@ 0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (KRB::LOG, default)) -> 0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (Modbus::LOG, default)) -> 0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (NTLM::LOG, default)) -> +0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (NTP::LOG, default)) -> 0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (NetControl::CATCH_RELEASE, default)) -> 0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (NetControl::DROP, default)) -> 0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (NetControl::LOG, default)) -> @@ -433,6 +441,7 @@ 0.000000 MetaHookPost CallFunction(Log::create_stream, , (KRB::LOG, [columns=KRB::Info, ev=KRB::log_krb, path=kerberos])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (Modbus::LOG, [columns=Modbus::Info, ev=Modbus::log_modbus, path=modbus])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (NTLM::LOG, [columns=NTLM::Info, ev=, path=ntlm])) -> +0.000000 MetaHookPost CallFunction(Log::create_stream, , (NTP::LOG, [columns=NTP::Info, ev=NTP::log_ntp, path=ntp])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (NetControl::CATCH_RELEASE, [columns=NetControl::CatchReleaseInfo, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (NetControl::DROP, [columns=NetControl::DropInfo, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (NetControl::LOG, [columns=NetControl::Info, ev=NetControl::log_netcontrol, path=netcontrol])) -> @@ -462,7 +471,7 @@ 0.000000 MetaHookPost CallFunction(Log::create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> -0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1555986109.036092, node=bro, filter=ip or not ip, init=T, success=T])) -> +0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1559140567.483887, node=bro, filter=ip or not ip, init=T, success=T])) -> 0.000000 MetaHookPost CallFunction(NetControl::check_plugins, , ()) -> 0.000000 MetaHookPost CallFunction(NetControl::init, , ()) -> 0.000000 MetaHookPost CallFunction(Notice::want_pp, , ()) -> @@ -624,6 +633,7 @@ 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NTLM.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NTLM.types.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NTP.events.bif.zeek) -> -1 +0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NTP.types.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NetBIOS.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NetBIOS.functions.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NoneWriter.none.bif.zeek) -> -1 @@ -845,6 +855,7 @@ 0.000000 MetaHookPost LoadFile(0, base<...>/netcontrol) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/notice) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/ntlm) -> -1 +0.000000 MetaHookPost LoadFile(0, base<...>/ntp) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/numbers.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/openflow) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/option.bif.zeek) -> -1 @@ -940,6 +951,7 @@ 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_MODBUS, 502/tcp)) 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_MYSQL, 1434/tcp)) 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_MYSQL, 3306/tcp)) +0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_NTP, 123/udp)) 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_RADIUS, 1812/udp)) 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_RDP, 3389/tcp)) 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_SIP, 5060/udp)) @@ -1006,6 +1018,7 @@ 0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_MODBUS, 502/tcp)) 0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_MYSQL, 1434/tcp)) 0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_MYSQL, 3306/tcp)) +0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_NTP, 123/udp)) 0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_RADIUS, 1812/udp)) 0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_RDP, 3389/tcp)) 0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, , (Analyzer::ANALYZER_SIP, 5060/udp)) @@ -1048,6 +1061,7 @@ 0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_KRB_TCP, {88/tcp})) 0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_MODBUS, {502/tcp})) 0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_MYSQL, {1434<...>/tcp})) +0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_NTP, {123/udp})) 0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_RADIUS, {1812/udp})) 0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_RDP, {3389/tcp})) 0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, , (Analyzer::ANALYZER_SIP, {5060/udp})) @@ -1105,6 +1119,7 @@ 0.000000 MetaHookPre CallFunction(Log::__add_filter, , (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=kerberos, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) 0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=modbus, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) 0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntlm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) 0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_catch_release, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) 0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_drop, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) 0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) @@ -1151,6 +1166,7 @@ 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (KRB::LOG, [columns=KRB::Info, ev=KRB::log_krb, path=kerberos])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Modbus::LOG, [columns=Modbus::Info, ev=Modbus::log_modbus, path=modbus])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (NTLM::LOG, [columns=NTLM::Info, ev=, path=ntlm])) +0.000000 MetaHookPre CallFunction(Log::__create_stream, , (NTP::LOG, [columns=NTP::Info, ev=NTP::log_ntp, path=ntp])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (NetControl::CATCH_RELEASE, [columns=NetControl::CatchReleaseInfo, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (NetControl::DROP, [columns=NetControl::DropInfo, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (NetControl::LOG, [columns=NetControl::Info, ev=NetControl::log_netcontrol, path=netcontrol])) @@ -1180,7 +1196,7 @@ 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1555986109.036092, node=bro, filter=ip or not ip, init=T, success=T])) +0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1559140567.483887, node=bro, filter=ip or not ip, init=T, success=T])) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Broker::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Cluster::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Config::LOG)) @@ -1198,6 +1214,7 @@ 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (KRB::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Modbus::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (NTLM::LOG)) +0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (NTP::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (NetControl::CATCH_RELEASE)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (NetControl::DROP)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (NetControl::LOG)) @@ -1244,6 +1261,7 @@ 0.000000 MetaHookPre CallFunction(Log::add_filter, , (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) 0.000000 MetaHookPre CallFunction(Log::add_filter, , (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) 0.000000 MetaHookPre CallFunction(Log::add_filter, , (NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) +0.000000 MetaHookPre CallFunction(Log::add_filter, , (NTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) 0.000000 MetaHookPre CallFunction(Log::add_filter, , (NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) 0.000000 MetaHookPre CallFunction(Log::add_filter, , (NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) 0.000000 MetaHookPre CallFunction(Log::add_filter, , (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) @@ -1290,6 +1308,7 @@ 0.000000 MetaHookPre CallFunction(Log::add_stream_filters, , (KRB::LOG, default)) 0.000000 MetaHookPre CallFunction(Log::add_stream_filters, , (Modbus::LOG, default)) 0.000000 MetaHookPre CallFunction(Log::add_stream_filters, , (NTLM::LOG, default)) +0.000000 MetaHookPre CallFunction(Log::add_stream_filters, , (NTP::LOG, default)) 0.000000 MetaHookPre CallFunction(Log::add_stream_filters, , (NetControl::CATCH_RELEASE, default)) 0.000000 MetaHookPre CallFunction(Log::add_stream_filters, , (NetControl::DROP, default)) 0.000000 MetaHookPre CallFunction(Log::add_stream_filters, , (NetControl::LOG, default)) @@ -1336,6 +1355,7 @@ 0.000000 MetaHookPre CallFunction(Log::create_stream, , (KRB::LOG, [columns=KRB::Info, ev=KRB::log_krb, path=kerberos])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (Modbus::LOG, [columns=Modbus::Info, ev=Modbus::log_modbus, path=modbus])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (NTLM::LOG, [columns=NTLM::Info, ev=, path=ntlm])) +0.000000 MetaHookPre CallFunction(Log::create_stream, , (NTP::LOG, [columns=NTP::Info, ev=NTP::log_ntp, path=ntp])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (NetControl::CATCH_RELEASE, [columns=NetControl::CatchReleaseInfo, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (NetControl::DROP, [columns=NetControl::DropInfo, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (NetControl::LOG, [columns=NetControl::Info, ev=NetControl::log_netcontrol, path=netcontrol])) @@ -1365,7 +1385,7 @@ 0.000000 MetaHookPre CallFunction(Log::create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1555986109.036092, node=bro, filter=ip or not ip, init=T, success=T])) +0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1559140567.483887, node=bro, filter=ip or not ip, init=T, success=T])) 0.000000 MetaHookPre CallFunction(NetControl::check_plugins, , ()) 0.000000 MetaHookPre CallFunction(NetControl::init, , ()) 0.000000 MetaHookPre CallFunction(Notice::want_pp, , ()) @@ -1527,6 +1547,7 @@ 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NTLM.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NTLM.types.bif.zeek) 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NTP.events.bif.zeek) +0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NTP.types.bif.zeek) 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NetBIOS.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NetBIOS.functions.bif.zeek) 0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NoneWriter.none.bif.zeek) @@ -1748,6 +1769,7 @@ 0.000000 MetaHookPre LoadFile(0, base<...>/netcontrol) 0.000000 MetaHookPre LoadFile(0, base<...>/notice) 0.000000 MetaHookPre LoadFile(0, base<...>/ntlm) +0.000000 MetaHookPre LoadFile(0, base<...>/ntp) 0.000000 MetaHookPre LoadFile(0, base<...>/numbers.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/openflow) 0.000000 MetaHookPre LoadFile(0, base<...>/option.bif.zeek) @@ -1843,6 +1865,7 @@ 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_MODBUS, 502/tcp) 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_MYSQL, 1434/tcp) 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_MYSQL, 3306/tcp) +0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_NTP, 123/udp) 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_RADIUS, 1812/udp) 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_RDP, 3389/tcp) 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_SIP, 5060/udp) @@ -1909,6 +1932,7 @@ 0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_MODBUS, 502/tcp) 0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_MYSQL, 1434/tcp) 0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_MYSQL, 3306/tcp) +0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_NTP, 123/udp) 0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_RADIUS, 1812/udp) 0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_RDP, 3389/tcp) 0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_SIP, 5060/udp) @@ -1951,6 +1975,7 @@ 0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_KRB_TCP, {88/tcp}) 0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_MODBUS, {502/tcp}) 0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_MYSQL, {1434<...>/tcp}) +0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_NTP, {123/udp}) 0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_RADIUS, {1812/udp}) 0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_RDP, {3389/tcp}) 0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_SIP, {5060/udp}) @@ -2007,6 +2032,7 @@ 0.000000 | HookCallFunction Log::__add_filter(KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=kerberos, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) 0.000000 | HookCallFunction Log::__add_filter(Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=modbus, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) 0.000000 | HookCallFunction Log::__add_filter(NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntlm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) +0.000000 | HookCallFunction Log::__add_filter(NTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) 0.000000 | HookCallFunction Log::__add_filter(NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_catch_release, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) 0.000000 | HookCallFunction Log::__add_filter(NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_drop, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) 0.000000 | HookCallFunction Log::__add_filter(NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) @@ -2053,6 +2079,7 @@ 0.000000 | HookCallFunction Log::__create_stream(KRB::LOG, [columns=KRB::Info, ev=KRB::log_krb, path=kerberos]) 0.000000 | HookCallFunction Log::__create_stream(Modbus::LOG, [columns=Modbus::Info, ev=Modbus::log_modbus, path=modbus]) 0.000000 | HookCallFunction Log::__create_stream(NTLM::LOG, [columns=NTLM::Info, ev=, path=ntlm]) +0.000000 | HookCallFunction Log::__create_stream(NTP::LOG, [columns=NTP::Info, ev=NTP::log_ntp, path=ntp]) 0.000000 | HookCallFunction Log::__create_stream(NetControl::CATCH_RELEASE, [columns=NetControl::CatchReleaseInfo, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release]) 0.000000 | HookCallFunction Log::__create_stream(NetControl::DROP, [columns=NetControl::DropInfo, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop]) 0.000000 | HookCallFunction Log::__create_stream(NetControl::LOG, [columns=NetControl::Info, ev=NetControl::log_netcontrol, path=netcontrol]) @@ -2082,7 +2109,7 @@ 0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]) 0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]) 0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]) -0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1555986109.036092, node=bro, filter=ip or not ip, init=T, success=T]) +0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1559140567.483887, node=bro, filter=ip or not ip, init=T, success=T]) 0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Config::LOG) @@ -2100,6 +2127,7 @@ 0.000000 | HookCallFunction Log::add_default_filter(KRB::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Modbus::LOG) 0.000000 | HookCallFunction Log::add_default_filter(NTLM::LOG) +0.000000 | HookCallFunction Log::add_default_filter(NTP::LOG) 0.000000 | HookCallFunction Log::add_default_filter(NetControl::CATCH_RELEASE) 0.000000 | HookCallFunction Log::add_default_filter(NetControl::DROP) 0.000000 | HookCallFunction Log::add_default_filter(NetControl::LOG) @@ -2146,6 +2174,7 @@ 0.000000 | HookCallFunction Log::add_filter(KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) 0.000000 | HookCallFunction Log::add_filter(Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) 0.000000 | HookCallFunction Log::add_filter(NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) +0.000000 | HookCallFunction Log::add_filter(NTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) 0.000000 | HookCallFunction Log::add_filter(NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) 0.000000 | HookCallFunction Log::add_filter(NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) 0.000000 | HookCallFunction Log::add_filter(NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]) @@ -2192,6 +2221,7 @@ 0.000000 | HookCallFunction Log::add_stream_filters(KRB::LOG, default) 0.000000 | HookCallFunction Log::add_stream_filters(Modbus::LOG, default) 0.000000 | HookCallFunction Log::add_stream_filters(NTLM::LOG, default) +0.000000 | HookCallFunction Log::add_stream_filters(NTP::LOG, default) 0.000000 | HookCallFunction Log::add_stream_filters(NetControl::CATCH_RELEASE, default) 0.000000 | HookCallFunction Log::add_stream_filters(NetControl::DROP, default) 0.000000 | HookCallFunction Log::add_stream_filters(NetControl::LOG, default) @@ -2238,6 +2268,7 @@ 0.000000 | HookCallFunction Log::create_stream(KRB::LOG, [columns=KRB::Info, ev=KRB::log_krb, path=kerberos]) 0.000000 | HookCallFunction Log::create_stream(Modbus::LOG, [columns=Modbus::Info, ev=Modbus::log_modbus, path=modbus]) 0.000000 | HookCallFunction Log::create_stream(NTLM::LOG, [columns=NTLM::Info, ev=, path=ntlm]) +0.000000 | HookCallFunction Log::create_stream(NTP::LOG, [columns=NTP::Info, ev=NTP::log_ntp, path=ntp]) 0.000000 | HookCallFunction Log::create_stream(NetControl::CATCH_RELEASE, [columns=NetControl::CatchReleaseInfo, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release]) 0.000000 | HookCallFunction Log::create_stream(NetControl::DROP, [columns=NetControl::DropInfo, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop]) 0.000000 | HookCallFunction Log::create_stream(NetControl::LOG, [columns=NetControl::Info, ev=NetControl::log_netcontrol, path=netcontrol]) @@ -2267,7 +2298,7 @@ 0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]) 0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]) 0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]) -0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1555986109.036092, node=bro, filter=ip or not ip, init=T, success=T]) +0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1559140567.483887, node=bro, filter=ip or not ip, init=T, success=T]) 0.000000 | HookCallFunction NetControl::check_plugins() 0.000000 | HookCallFunction NetControl::init() 0.000000 | HookCallFunction Notice::want_pp() @@ -2429,6 +2460,7 @@ 0.000000 | HookLoadFile .<...>/Bro_NTLM.events.bif.zeek 0.000000 | HookLoadFile .<...>/Bro_NTLM.types.bif.zeek 0.000000 | HookLoadFile .<...>/Bro_NTP.events.bif.zeek +0.000000 | HookLoadFile .<...>/Bro_NTP.types.bif.zeek 0.000000 | HookLoadFile .<...>/Bro_NetBIOS.events.bif.zeek 0.000000 | HookLoadFile .<...>/Bro_NetBIOS.functions.bif.zeek 0.000000 | HookLoadFile .<...>/Bro_NoneWriter.none.bif.zeek @@ -2659,6 +2691,7 @@ 0.000000 | HookLoadFile base<...>/netcontrol 0.000000 | HookLoadFile base<...>/notice 0.000000 | HookLoadFile base<...>/ntlm +0.000000 | HookLoadFile base<...>/ntp 0.000000 | HookLoadFile base<...>/numbers.zeek 0.000000 | HookLoadFile base<...>/openflow 0.000000 | HookLoadFile base<...>/option.bif.zeek @@ -2702,7 +2735,7 @@ 0.000000 | HookLoadFile base<...>/x509 0.000000 | HookLoadFile base<...>/xmpp 0.000000 | HookLogInit packet_filter 1/1 {ts (time), node (string), filter (string), init (bool), success (bool)} -0.000000 | HookLogWrite packet_filter [ts=1555986109.036092, node=bro, filter=ip or not ip, init=T, success=T] +0.000000 | HookLogWrite packet_filter [ts=1559140567.483887, node=bro, filter=ip or not ip, init=T, success=T] 0.000000 | HookQueueEvent NetControl::init() 0.000000 | HookQueueEvent filter_change_tracking() 0.000000 | HookQueueEvent zeek_init() @@ -2711,11 +2744,11 @@ 1362692526.869344 MetaHookPost CallFunction(NetControl::catch_release_seen, , (141.142.228.5)) -> 1362692526.869344 MetaHookPost CallFunction(filter_change_tracking, , ()) -> 1362692526.869344 MetaHookPost CallFunction(get_net_stats, , ()) -> -1362692526.869344 MetaHookPost CallFunction(new_connection, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> +1362692526.869344 MetaHookPost CallFunction(new_connection, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> 1362692526.869344 MetaHookPost DrainEvents() -> 1362692526.869344 MetaHookPost QueueEvent(ChecksumOffloading::check()) -> false 1362692526.869344 MetaHookPost QueueEvent(filter_change_tracking()) -> false -1362692526.869344 MetaHookPost QueueEvent(new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> false +1362692526.869344 MetaHookPost QueueEvent(new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> false 1362692526.869344 MetaHookPost SetupAnalyzerTree(1362692526.869344(1362692526.869344) TCP 141.142.228.5:59856 -> 192.150.187.43:80) -> 1362692526.869344 MetaHookPost UpdateNetworkTime(1362692526.869344) -> 1362692526.869344 MetaHookPre BroObjDtor() @@ -2723,11 +2756,11 @@ 1362692526.869344 MetaHookPre CallFunction(NetControl::catch_release_seen, , (141.142.228.5)) 1362692526.869344 MetaHookPre CallFunction(filter_change_tracking, , ()) 1362692526.869344 MetaHookPre CallFunction(get_net_stats, , ()) -1362692526.869344 MetaHookPre CallFunction(new_connection, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +1362692526.869344 MetaHookPre CallFunction(new_connection, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692526.869344 MetaHookPre DrainEvents() 1362692526.869344 MetaHookPre QueueEvent(ChecksumOffloading::check()) 1362692526.869344 MetaHookPre QueueEvent(filter_change_tracking()) -1362692526.869344 MetaHookPre QueueEvent(new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +1362692526.869344 MetaHookPre QueueEvent(new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692526.869344 MetaHookPre SetupAnalyzerTree(1362692526.869344(1362692526.869344) TCP 141.142.228.5:59856 -> 192.150.187.43:80) 1362692526.869344 MetaHookPre UpdateNetworkTime(1362692526.869344) 1362692526.869344 | HookBroObjDtor @@ -2736,28 +2769,28 @@ 1362692526.869344 | HookCallFunction NetControl::catch_release_seen(141.142.228.5) 1362692526.869344 | HookCallFunction filter_change_tracking() 1362692526.869344 | HookCallFunction get_net_stats() -1362692526.869344 | HookCallFunction new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +1362692526.869344 | HookCallFunction new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692526.869344 | HookDrainEvents 1362692526.869344 | HookQueueEvent ChecksumOffloading::check() 1362692526.869344 | HookQueueEvent filter_change_tracking() -1362692526.869344 | HookQueueEvent new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +1362692526.869344 | HookQueueEvent new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692526.869344 | HookSetupAnalyzerTree 1362692526.869344(1362692526.869344) TCP 141.142.228.5:59856 -> 192.150.187.43:80 1362692526.869344 | RequestObjDtor ChecksumOffloading::check() 1362692526.939084 MetaHookPost CallFunction(NetControl::catch_release_seen, , (141.142.228.5)) -> -1362692526.939084 MetaHookPost CallFunction(connection_established, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> +1362692526.939084 MetaHookPost CallFunction(connection_established, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> 1362692526.939084 MetaHookPost DrainEvents() -> -1362692526.939084 MetaHookPost QueueEvent(connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> false +1362692526.939084 MetaHookPost QueueEvent(connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> false 1362692526.939084 MetaHookPost UpdateNetworkTime(1362692526.939084) -> 1362692526.939084 MetaHookPre CallFunction(NetControl::catch_release_seen, , (141.142.228.5)) -1362692526.939084 MetaHookPre CallFunction(connection_established, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +1362692526.939084 MetaHookPre CallFunction(connection_established, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692526.939084 MetaHookPre DrainEvents() -1362692526.939084 MetaHookPre QueueEvent(connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +1362692526.939084 MetaHookPre QueueEvent(connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692526.939084 MetaHookPre UpdateNetworkTime(1362692526.939084) 1362692526.939084 | HookUpdateNetworkTime 1362692526.939084 1362692526.939084 | HookCallFunction NetControl::catch_release_seen(141.142.228.5) -1362692526.939084 | HookCallFunction connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +1362692526.939084 | HookCallFunction connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692526.939084 | HookDrainEvents -1362692526.939084 | HookQueueEvent connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +1362692526.939084 | HookQueueEvent connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692526.939378 MetaHookPost DrainEvents() -> 1362692526.939378 MetaHookPost UpdateNetworkTime(1362692526.939378) -> 1362692526.939378 MetaHookPre DrainEvents() @@ -2766,118 +2799,118 @@ 1362692526.939378 | HookDrainEvents 1362692526.939527 MetaHookPost CallFunction(Analyzer::__name, , (Analyzer::ANALYZER_HTTP)) -> 1362692526.939527 MetaHookPost CallFunction(Analyzer::name, , (Analyzer::ANALYZER_HTTP)) -> -1362692526.939527 MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -1362692526.939527 MetaHookPost CallFunction(HTTP::new_http_session, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> -1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692526.939527 MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692526.939527 MetaHookPost CallFunction(HTTP::new_http_session, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> +1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692526.939527 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> 1362692526.939527 MetaHookPost CallFunction(cat, , (Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -> 1362692526.939527 MetaHookPost CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)) -> 1362692526.939527 MetaHookPost CallFunction(fmt, , (-%s, HTTP)) -> -1362692526.939527 MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -1362692526.939527 MetaHookPost CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -1362692526.939527 MetaHookPost CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692526.939527 MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692526.939527 MetaHookPost CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692526.939527 MetaHookPost CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> 1362692526.939527 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/*)) -> 1362692526.939527 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0))) -> -1362692526.939527 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive)) -> -1362692526.939527 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org)) -> -1362692526.939527 MetaHookPost CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) -> +1362692526.939527 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive)) -> +1362692526.939527 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org)) -> +1362692526.939527 MetaHookPost CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) -> 1362692526.939527 MetaHookPost CallFunction(http_request, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)) -> 1362692526.939527 MetaHookPost CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856<...>/tcp])) -> 1362692526.939527 MetaHookPost CallFunction(network_time, , ()) -> -1362692526.939527 MetaHookPost CallFunction(protocol_confirmation, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3)) -> +1362692526.939527 MetaHookPost CallFunction(protocol_confirmation, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3)) -> 1362692526.939527 MetaHookPost CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80)) -> 1362692526.939527 MetaHookPost CallFunction(split_string1, , (bro.org, <...>/)) -> 1362692526.939527 MetaHookPost DrainEvents() -> -1362692526.939527 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false -1362692526.939527 MetaHookPost QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false -1362692526.939527 MetaHookPost QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false +1362692526.939527 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false +1362692526.939527 MetaHookPost QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false +1362692526.939527 MetaHookPost QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false 1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/*)) -> false 1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0))) -> false -1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive)) -> false -1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org)) -> false -1362692526.939527 MetaHookPost QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) -> false +1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive)) -> false +1362692526.939527 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org)) -> false +1362692526.939527 MetaHookPost QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) -> false 1362692526.939527 MetaHookPost QueueEvent(http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)) -> false -1362692526.939527 MetaHookPost QueueEvent(protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3)) -> false +1362692526.939527 MetaHookPost QueueEvent(protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3)) -> false 1362692526.939527 MetaHookPost UpdateNetworkTime(1362692526.939527) -> 1362692526.939527 MetaHookPre CallFunction(Analyzer::__name, , (Analyzer::ANALYZER_HTTP)) 1362692526.939527 MetaHookPre CallFunction(Analyzer::name, , (Analyzer::ANALYZER_HTTP)) -1362692526.939527 MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -1362692526.939527 MetaHookPre CallFunction(HTTP::new_http_session, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre CallFunction(HTTP::new_http_session, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) 1362692526.939527 MetaHookPre CallFunction(cat, , (Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) 1362692526.939527 MetaHookPre CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)) 1362692526.939527 MetaHookPre CallFunction(fmt, , (-%s, HTTP)) -1362692526.939527 MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -1362692526.939527 MetaHookPre CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -1362692526.939527 MetaHookPre CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) 1362692526.939527 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/*)) 1362692526.939527 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0))) -1362692526.939527 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive)) -1362692526.939527 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org)) -1362692526.939527 MetaHookPre CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) +1362692526.939527 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive)) +1362692526.939527 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org)) +1362692526.939527 MetaHookPre CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) 1362692526.939527 MetaHookPre CallFunction(http_request, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)) 1362692526.939527 MetaHookPre CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856<...>/tcp])) 1362692526.939527 MetaHookPre CallFunction(network_time, , ()) -1362692526.939527 MetaHookPre CallFunction(protocol_confirmation, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3)) +1362692526.939527 MetaHookPre CallFunction(protocol_confirmation, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3)) 1362692526.939527 MetaHookPre CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80)) 1362692526.939527 MetaHookPre CallFunction(split_string1, , (bro.org, <...>/)) 1362692526.939527 MetaHookPre DrainEvents() -1362692526.939527 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -1362692526.939527 MetaHookPre QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -1362692526.939527 MetaHookPre QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692526.939527 MetaHookPre QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) 1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/*)) 1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0))) -1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive)) -1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org)) -1362692526.939527 MetaHookPre QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) +1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive)) +1362692526.939527 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org)) +1362692526.939527 MetaHookPre QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) 1362692526.939527 MetaHookPre QueueEvent(http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1)) -1362692526.939527 MetaHookPre QueueEvent(protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3)) +1362692526.939527 MetaHookPre QueueEvent(protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3)) 1362692526.939527 MetaHookPre UpdateNetworkTime(1362692526.939527) 1362692526.939527 | HookUpdateNetworkTime 1362692526.939527 1362692526.939527 | HookCallFunction Analyzer::__name(Analyzer::ANALYZER_HTTP) 1362692526.939527 | HookCallFunction Analyzer::name(Analyzer::ANALYZER_HTTP) -1362692526.939527 | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -1362692526.939527 | HookCallFunction HTTP::new_http_session([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) -1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookCallFunction HTTP::new_http_session([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) 1362692526.939527 | HookCallFunction cat(Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80) 1362692526.939527 | HookCallFunction fmt(%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp) 1362692526.939527 | HookCallFunction fmt(-%s, HTTP) -1362692526.939527 | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -1362692526.939527 | HookCallFunction http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -1362692526.939527 | HookCallFunction http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookCallFunction http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookCallFunction http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) 1362692526.939527 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/*) 1362692526.939527 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0)) -1362692526.939527 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive) -1362692526.939527 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org) -1362692526.939527 | HookCallFunction http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124]) +1362692526.939527 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive) +1362692526.939527 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org) +1362692526.939527 | HookCallFunction http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124]) 1362692526.939527 | HookCallFunction http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1) 1362692526.939527 | HookCallFunction id_string([orig_h=141.142.228.5, orig_p=59856<...>/tcp]) 1362692526.939527 | HookCallFunction network_time() -1362692526.939527 | HookCallFunction protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3) +1362692526.939527 | HookCallFunction protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3) 1362692526.939527 | HookCallFunction set_file_handle(Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80) 1362692526.939527 | HookCallFunction split_string1(bro.org, <...>/) 1362692526.939527 | HookDrainEvents -1362692526.939527 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -1362692526.939527 | HookQueueEvent http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -1362692526.939527 | HookQueueEvent http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookQueueEvent http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692526.939527 | HookQueueEvent http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) 1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/*) 1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0)) -1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive) -1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org) -1362692526.939527 | HookQueueEvent http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124]) +1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, CONNECTION, Keep-Alive) +1362692526.939527 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, HOST, bro.org) +1362692526.939527 | HookQueueEvent http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=1362692526.939527, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124]) 1362692526.939527 | HookQueueEvent http_request([id=[orig_h=141.142.228.5, orig_p=59856<...>/CHANGES.bro-aux.txt, 1.1) -1362692526.939527 | HookQueueEvent protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3) +1362692526.939527 | HookQueueEvent protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.070183, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3) 1362692527.008509 MetaHookPost DrainEvents() -> 1362692527.008509 MetaHookPost UpdateNetworkTime(1362692527.008509) -> 1362692527.008509 MetaHookPre DrainEvents() @@ -2886,142 +2919,142 @@ 1362692527.008509 | HookDrainEvents 1362692527.009512 MetaHookPost CallFunction(Files::__enable_reassembly, , (FakNcS1Jfe01uljb3)) -> 1362692527.009512 MetaHookPost CallFunction(Files::__set_reassembly_buffer, , (FakNcS1Jfe01uljb3, 524288)) -> -1362692527.009512 MetaHookPost CallFunction(Files::enable_reassembly, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=])) -> -1362692527.009512 MetaHookPost CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) -> -1362692527.009512 MetaHookPost CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=])) -> -1362692527.009512 MetaHookPost CallFunction(Files::set_reassembly_buffer_size, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=], 524288)) -> +1362692527.009512 MetaHookPost CallFunction(Files::enable_reassembly, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=])) -> +1362692527.009512 MetaHookPost CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) -> +1362692527.009512 MetaHookPost CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=])) -> +1362692527.009512 MetaHookPost CallFunction(Files::set_reassembly_buffer_size, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=], 524288)) -> 1362692527.009512 MetaHookPost CallFunction(HTTP::code_in_range, , (200, 100, 199)) -> -1362692527.009512 MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -1362692527.009512 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -1362692527.009512 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -1362692527.009512 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +1362692527.009512 MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +1362692527.009512 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +1362692527.009512 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +1362692527.009512 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> 1362692527.009512 MetaHookPost CallFunction(cat, , (Analyzer::ANALYZER_HTTP, 1362692526.869344, F, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -> -1362692527.009512 MetaHookPost CallFunction(file_new, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) -> -1362692527.009512 MetaHookPost CallFunction(file_over_new_connection, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +1362692527.009512 MetaHookPost CallFunction(file_new, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) -> +1362692527.009512 MetaHookPost CallFunction(file_over_new_connection, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> 1362692527.009512 MetaHookPost CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)) -> -1362692527.009512 MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -1362692527.009512 MetaHookPost CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes)) -> -1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive)) -> -1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705)) -> -1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -> -1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0")) -> -1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100)) -> -1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) -> +1362692527.009512 MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +1362692527.009512 MetaHookPost CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes)) -> +1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive)) -> +1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705)) -> +1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -> +1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0")) -> +1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100)) -> +1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) -> 1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/2.4.3 (Fedora))) -> 1362692527.009512 MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain; charset=UTF-8)) -> -1362692527.009512 MetaHookPost CallFunction(http_reply, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) -> +1362692527.009512 MetaHookPost CallFunction(http_reply, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) -> 1362692527.009512 MetaHookPost CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856<...>/tcp])) -> 1362692527.009512 MetaHookPost CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTP1362692526.869344F11141.142.228.5:59856 > 192.150.187.43:80)) -> 1362692527.009512 MetaHookPost CallFunction(split_string_all, , (HTTP, <...>/)) -> 1362692527.009512 MetaHookPost DrainEvents() -> -1362692527.009512 MetaHookPost QueueEvent(file_new([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) -> false -1362692527.009512 MetaHookPost QueueEvent(file_over_new_connection([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false -1362692527.009512 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false -1362692527.009512 MetaHookPost QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false -1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes)) -> false -1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive)) -> false -1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705)) -> false -1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -> false -1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0")) -> false -1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100)) -> false -1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) -> false +1362692527.009512 MetaHookPost QueueEvent(file_new([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) -> false +1362692527.009512 MetaHookPost QueueEvent(file_over_new_connection([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false +1362692527.009512 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false +1362692527.009512 MetaHookPost QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false +1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes)) -> false +1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive)) -> false +1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705)) -> false +1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -> false +1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0")) -> false +1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100)) -> false +1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) -> false 1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/2.4.3 (Fedora))) -> false 1362692527.009512 MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain; charset=UTF-8)) -> false -1362692527.009512 MetaHookPost QueueEvent(http_reply([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) -> false +1362692527.009512 MetaHookPost QueueEvent(http_reply([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) -> false 1362692527.009512 MetaHookPost UpdateNetworkTime(1362692527.009512) -> 1362692527.009512 MetaHookPre CallFunction(Files::__enable_reassembly, , (FakNcS1Jfe01uljb3)) 1362692527.009512 MetaHookPre CallFunction(Files::__set_reassembly_buffer, , (FakNcS1Jfe01uljb3, 524288)) -1362692527.009512 MetaHookPre CallFunction(Files::enable_reassembly, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=])) -1362692527.009512 MetaHookPre CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) -1362692527.009512 MetaHookPre CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=])) -1362692527.009512 MetaHookPre CallFunction(Files::set_reassembly_buffer_size, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=], 524288)) +1362692527.009512 MetaHookPre CallFunction(Files::enable_reassembly, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=])) +1362692527.009512 MetaHookPre CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) +1362692527.009512 MetaHookPre CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=])) +1362692527.009512 MetaHookPre CallFunction(Files::set_reassembly_buffer_size, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=], 524288)) 1362692527.009512 MetaHookPre CallFunction(HTTP::code_in_range, , (200, 100, 199)) -1362692527.009512 MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009512 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009512 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009512 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009512 MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009512 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009512 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009512 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) 1362692527.009512 MetaHookPre CallFunction(cat, , (Analyzer::ANALYZER_HTTP, 1362692526.869344, F, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -1362692527.009512 MetaHookPre CallFunction(file_new, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) -1362692527.009512 MetaHookPre CallFunction(file_over_new_connection, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009512 MetaHookPre CallFunction(file_new, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) +1362692527.009512 MetaHookPre CallFunction(file_over_new_connection, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) 1362692527.009512 MetaHookPre CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)) -1362692527.009512 MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009512 MetaHookPre CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes)) -1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive)) -1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705)) -1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0")) -1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100)) -1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) +1362692527.009512 MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009512 MetaHookPre CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes)) +1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive)) +1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705)) +1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) +1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0")) +1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100)) +1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) 1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/2.4.3 (Fedora))) 1362692527.009512 MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain; charset=UTF-8)) -1362692527.009512 MetaHookPre CallFunction(http_reply, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) +1362692527.009512 MetaHookPre CallFunction(http_reply, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) 1362692527.009512 MetaHookPre CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856<...>/tcp])) 1362692527.009512 MetaHookPre CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTP1362692526.869344F11141.142.228.5:59856 > 192.150.187.43:80)) 1362692527.009512 MetaHookPre CallFunction(split_string_all, , (HTTP, <...>/)) 1362692527.009512 MetaHookPre DrainEvents() -1362692527.009512 MetaHookPre QueueEvent(file_new([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) -1362692527.009512 MetaHookPre QueueEvent(file_over_new_connection([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009512 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009512 MetaHookPre QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes)) -1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive)) -1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705)) -1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0")) -1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100)) -1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) +1362692527.009512 MetaHookPre QueueEvent(file_new([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=])) +1362692527.009512 MetaHookPre QueueEvent(file_over_new_connection([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009512 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009512 MetaHookPre QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes)) +1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive)) +1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705)) +1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) +1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0")) +1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100)) +1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) 1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/2.4.3 (Fedora))) 1362692527.009512 MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain; charset=UTF-8)) -1362692527.009512 MetaHookPre QueueEvent(http_reply([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) +1362692527.009512 MetaHookPre QueueEvent(http_reply([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) 1362692527.009512 MetaHookPre UpdateNetworkTime(1362692527.009512) 1362692527.009512 | HookUpdateNetworkTime 1362692527.009512 1362692527.009512 | HookCallFunction Files::__enable_reassembly(FakNcS1Jfe01uljb3) 1362692527.009512 | HookCallFunction Files::__set_reassembly_buffer(FakNcS1Jfe01uljb3, 524288) -1362692527.009512 | HookCallFunction Files::enable_reassembly([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=]) -1362692527.009512 | HookCallFunction Files::set_info([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=]) -1362692527.009512 | HookCallFunction Files::set_info([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=]) -1362692527.009512 | HookCallFunction Files::set_reassembly_buffer_size([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=], 524288) +1362692527.009512 | HookCallFunction Files::enable_reassembly([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=]) +1362692527.009512 | HookCallFunction Files::set_info([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=]) +1362692527.009512 | HookCallFunction Files::set_info([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=]) +1362692527.009512 | HookCallFunction Files::set_reassembly_buffer_size([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=, u2_events=], 524288) 1362692527.009512 | HookCallFunction HTTP::code_in_range(200, 100, 199) -1362692527.009512 | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009512 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009512 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009512 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009512 | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009512 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009512 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009512 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) 1362692527.009512 | HookCallFunction cat(Analyzer::ANALYZER_HTTP, 1362692526.869344, F, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80) -1362692527.009512 | HookCallFunction file_new([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=]) -1362692527.009512 | HookCallFunction file_over_new_connection([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009512 | HookCallFunction file_new([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=]) +1362692527.009512 | HookCallFunction file_over_new_connection([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) 1362692527.009512 | HookCallFunction fmt(%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp) -1362692527.009512 | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009512 | HookCallFunction http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes) -1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive) -1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705) -1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT) -1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0") -1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100) -1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT) +1362692527.009512 | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009512 | HookCallFunction http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes) +1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive) +1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705) +1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT) +1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0") +1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100) +1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT) 1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/2.4.3 (Fedora)) 1362692527.009512 | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain; charset=UTF-8) -1362692527.009512 | HookCallFunction http_reply([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK) +1362692527.009512 | HookCallFunction http_reply([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK) 1362692527.009512 | HookCallFunction id_string([orig_h=141.142.228.5, orig_p=59856<...>/tcp]) 1362692527.009512 | HookCallFunction set_file_handle(Analyzer::ANALYZER_HTTP1362692526.869344F11141.142.228.5:59856 > 192.150.187.43:80) 1362692527.009512 | HookCallFunction split_string_all(HTTP, <...>/) 1362692527.009512 | HookDrainEvents -1362692527.009512 | HookQueueEvent file_new([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=]) -1362692527.009512 | HookQueueEvent file_over_new_connection([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009512 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009512 | HookQueueEvent http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes) -1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive) -1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705) -1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT) -1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0") -1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100) -1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT) +1362692527.009512 | HookQueueEvent file_new([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=1362692527.009512, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=, u2_events=]) +1362692527.009512 | HookQueueEvent file_over_new_connection([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009512 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009512 | HookQueueEvent http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ACCEPT-RANGES, bytes) +1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONNECTION, Keep-Alive) +1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, CONTENT-LENGTH, 4705) +1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, DATE, Thu, 07 Mar 2013 21:43:07 GMT) +1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETAG, "1261-4c870358a6fc0") +1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, KEEP-ALIVE, timeout=5, max=100) +1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT) 1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/2.4.3 (Fedora)) 1362692527.009512 | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain; charset=UTF-8) -1362692527.009512 | HookQueueEvent http_reply([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK) +1362692527.009512 | HookQueueEvent http_reply([id=[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK) 1362692527.009721 MetaHookPost DrainEvents() -> 1362692527.009721 MetaHookPost UpdateNetworkTime(1362692527.009721) -> 1362692527.009721 MetaHookPre DrainEvents() @@ -3037,8 +3070,8 @@ 1362692527.009775 MetaHookPost CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=])) -> 1362692527.009775 MetaHookPost CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=])) -> 1362692527.009775 MetaHookPost CallFunction(HTTP::code_in_range, , (200, 100, 199)) -> -1362692527.009775 MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -1362692527.009775 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +1362692527.009775 MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +1362692527.009775 MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> 1362692527.009775 MetaHookPost CallFunction(Log::__write, , (Files::LOG, [ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.0 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) -> 1362692527.009775 MetaHookPost CallFunction(Log::__write, , (HTTP::LOG, [ts=1362692526.939527, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1])) -> 1362692527.009775 MetaHookPost CallFunction(Log::write, , (Files::LOG, [ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.0 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) -> @@ -3047,9 +3080,9 @@ 1362692527.009775 MetaHookPost CallFunction(file_sniff, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain]], inferred=T])) -> 1362692527.009775 MetaHookPost CallFunction(file_state_remove, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=])) -> 1362692527.009775 MetaHookPost CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)) -> -1362692527.009775 MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -1362692527.009775 MetaHookPost CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -1362692527.009775 MetaHookPost CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) -> +1362692527.009775 MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +1362692527.009775 MetaHookPost CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +1362692527.009775 MetaHookPost CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) -> 1362692527.009775 MetaHookPost CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856<...>/tcp])) -> 1362692527.009775 MetaHookPost CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTP1362692526.869344F11141.142.228.5:59856 > 192.150.187.43:80)) -> 1362692527.009775 MetaHookPost DrainEvents() -> @@ -3059,15 +3092,15 @@ 1362692527.009775 MetaHookPost LogWrite(Log::WRITER_ASCII, default, http(1362692527.009775,0.0,0.0), 30, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])}, ) -> true 1362692527.009775 MetaHookPost QueueEvent(file_sniff([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain]], inferred=T])) -> false 1362692527.009775 MetaHookPost QueueEvent(file_state_remove([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=])) -> false -1362692527.009775 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false -1362692527.009775 MetaHookPost QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false -1362692527.009775 MetaHookPost QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) -> false +1362692527.009775 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false +1362692527.009775 MetaHookPost QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false +1362692527.009775 MetaHookPost QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) -> false 1362692527.009775 MetaHookPost UpdateNetworkTime(1362692527.009775) -> 1362692527.009775 MetaHookPre CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=])) 1362692527.009775 MetaHookPre CallFunction(Files::set_info, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=])) 1362692527.009775 MetaHookPre CallFunction(HTTP::code_in_range, , (200, 100, 199)) -1362692527.009775 MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009775 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009775 MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009775 MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) 1362692527.009775 MetaHookPre CallFunction(Log::__write, , (Files::LOG, [ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.0 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) 1362692527.009775 MetaHookPre CallFunction(Log::__write, , (HTTP::LOG, [ts=1362692526.939527, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1])) 1362692527.009775 MetaHookPre CallFunction(Log::write, , (Files::LOG, [ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.0 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) @@ -3076,9 +3109,9 @@ 1362692527.009775 MetaHookPre CallFunction(file_sniff, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain]], inferred=T])) 1362692527.009775 MetaHookPre CallFunction(file_state_remove, , ([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=])) 1362692527.009775 MetaHookPre CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)) -1362692527.009775 MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009775 MetaHookPre CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009775 MetaHookPre CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) +1362692527.009775 MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009775 MetaHookPre CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009775 MetaHookPre CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) 1362692527.009775 MetaHookPre CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856<...>/tcp])) 1362692527.009775 MetaHookPre CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTP1362692526.869344F11141.142.228.5:59856 > 192.150.187.43:80)) 1362692527.009775 MetaHookPre DrainEvents() @@ -3088,16 +3121,16 @@ 1362692527.009775 MetaHookPre LogWrite(Log::WRITER_ASCII, default, http(1362692527.009775,0.0,0.0), 30, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])}, ) 1362692527.009775 MetaHookPre QueueEvent(file_sniff([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain]], inferred=T])) 1362692527.009775 MetaHookPre QueueEvent(file_state_remove([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=])) -1362692527.009775 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009775 MetaHookPre QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -1362692527.009775 MetaHookPre QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) +1362692527.009775 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009775 MetaHookPre QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +1362692527.009775 MetaHookPre QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) 1362692527.009775 MetaHookPre UpdateNetworkTime(1362692527.009775) 1362692527.009775 | HookUpdateNetworkTime 1362692527.009775 1362692527.009775 | HookCallFunction Files::set_info([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=]) 1362692527.009775 | HookCallFunction Files::set_info([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=]) 1362692527.009775 | HookCallFunction HTTP::code_in_range(200, 100, 199) -1362692527.009775 | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009775 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009775 | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009775 | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) 1362692527.009775 | HookCallFunction Log::__write(Files::LOG, [ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.0 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]) 1362692527.009775 | HookCallFunction Log::__write(HTTP::LOG, [ts=1362692526.939527, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]) 1362692527.009775 | HookCallFunction Log::write(Files::LOG, [ts=1362692527.009512, fuid=FakNcS1Jfe01uljb3, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.0 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]) @@ -3106,9 +3139,9 @@ 1362692527.009775 | HookCallFunction file_sniff([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain]], inferred=T]) 1362692527.009775 | HookCallFunction file_state_remove([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=]) 1362692527.009775 | HookCallFunction fmt(%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp) -1362692527.009775 | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009775 | HookCallFunction http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009775 | HookCallFunction http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280]) +1362692527.009775 | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009775 | HookCallFunction http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009775 | HookCallFunction http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280]) 1362692527.009775 | HookCallFunction id_string([orig_h=141.142.228.5, orig_p=59856<...>/tcp]) 1362692527.009775 | HookCallFunction set_file_handle(Analyzer::ANALYZER_HTTP1362692526.869344F11141.142.228.5:59856 > 192.150.187.43:80) 1362692527.009775 | HookDrainEvents @@ -3118,9 +3151,9 @@ 1362692527.009775 | HookLogWrite http [ts=1362692526.939527, uid=CHhAvVGS1DHFjwGM9, id.orig_h=141.142.228.5, id.orig_p=59856, id.resp_h=192.150.187.43, id.resp_p=80, trans_depth=1, method=GET, host=bro.org, uri=<...>/plain] 1362692527.009775 | HookQueueEvent file_sniff([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain]], inferred=T]) 1362692527.009775 | HookQueueEvent file_state_remove([id=FakNcS1Jfe01uljb3, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=, u2_events=]) -1362692527.009775 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009775 | HookQueueEvent http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -1362692527.009775 | HookQueueEvent http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280]) +1362692527.009775 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009775 | HookQueueEvent http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +1362692527.009775 | HookQueueEvent http_message_done([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=1362692527.009512, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280]) 1362692527.009855 MetaHookPost DrainEvents() -> 1362692527.009855 MetaHookPost UpdateNetworkTime(1362692527.009855) -> 1362692527.009855 MetaHookPre DrainEvents() @@ -3146,19 +3179,19 @@ 1362692527.080828 | HookUpdateNetworkTime 1362692527.080828 1362692527.080828 | HookDrainEvents 1362692527.080972 MetaHookPost CallFunction(ChecksumOffloading::check, , ()) -> -1362692527.080972 MetaHookPost CallFunction(Conn::conn_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp)) -> -1362692527.080972 MetaHookPost CallFunction(Conn::determine_service, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> -1362692527.080972 MetaHookPost CallFunction(Conn::set_conn, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -1362692527.080972 MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -1362692527.080972 MetaHookPost CallFunction(KRB::do_log, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> -1362692527.080972 MetaHookPost CallFunction(KRB::fill_in_subjects, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> +1362692527.080972 MetaHookPost CallFunction(Conn::conn_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp)) -> +1362692527.080972 MetaHookPost CallFunction(Conn::determine_service, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> +1362692527.080972 MetaHookPost CallFunction(Conn::set_conn, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692527.080972 MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692527.080972 MetaHookPost CallFunction(KRB::do_log, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> +1362692527.080972 MetaHookPost CallFunction(KRB::fill_in_subjects, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> 1362692527.080972 MetaHookPost CallFunction(Log::__write, , (Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) -> 1362692527.080972 MetaHookPost CallFunction(Log::write, , (Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) -> 1362692527.080972 MetaHookPost CallFunction(cat, , (Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -> -1362692527.080972 MetaHookPost CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> +1362692527.080972 MetaHookPost CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> 1362692527.080972 MetaHookPost CallFunction(filter_change_tracking, , ()) -> 1362692527.080972 MetaHookPost CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)) -> -1362692527.080972 MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +1362692527.080972 MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> 1362692527.080972 MetaHookPost CallFunction(get_net_stats, , ()) -> 1362692527.080972 MetaHookPost CallFunction(get_port_transport_proto, , (80/tcp)) -> 1362692527.080972 MetaHookPost CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856<...>/tcp])) -> @@ -3173,25 +3206,25 @@ 1362692527.080972 MetaHookPost LogInit(Log::WRITER_ASCII, default, true, true, conn(1362692527.080972,0.0,0.0), 21, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])}) -> 1362692527.080972 MetaHookPost LogWrite(Log::WRITER_ASCII, default, conn(1362692527.080972,0.0,0.0), 21, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])}, ) -> true 1362692527.080972 MetaHookPost QueueEvent(ChecksumOffloading::check()) -> false -1362692527.080972 MetaHookPost QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> false +1362692527.080972 MetaHookPost QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> false 1362692527.080972 MetaHookPost QueueEvent(filter_change_tracking()) -> false -1362692527.080972 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false +1362692527.080972 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false 1362692527.080972 MetaHookPost QueueEvent(zeek_done()) -> false 1362692527.080972 MetaHookPost UpdateNetworkTime(1362692527.080972) -> 1362692527.080972 MetaHookPre CallFunction(ChecksumOffloading::check, , ()) -1362692527.080972 MetaHookPre CallFunction(Conn::conn_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp)) -1362692527.080972 MetaHookPre CallFunction(Conn::determine_service, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -1362692527.080972 MetaHookPre CallFunction(Conn::set_conn, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -1362692527.080972 MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -1362692527.080972 MetaHookPre CallFunction(KRB::do_log, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -1362692527.080972 MetaHookPre CallFunction(KRB::fill_in_subjects, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +1362692527.080972 MetaHookPre CallFunction(Conn::conn_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp)) +1362692527.080972 MetaHookPre CallFunction(Conn::determine_service, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +1362692527.080972 MetaHookPre CallFunction(Conn::set_conn, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692527.080972 MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692527.080972 MetaHookPre CallFunction(KRB::do_log, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +1362692527.080972 MetaHookPre CallFunction(KRB::fill_in_subjects, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692527.080972 MetaHookPre CallFunction(Log::__write, , (Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) 1362692527.080972 MetaHookPre CallFunction(Log::write, , (Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) 1362692527.080972 MetaHookPre CallFunction(cat, , (Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -1362692527.080972 MetaHookPre CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +1362692527.080972 MetaHookPre CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692527.080972 MetaHookPre CallFunction(filter_change_tracking, , ()) 1362692527.080972 MetaHookPre CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp)) -1362692527.080972 MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692527.080972 MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) 1362692527.080972 MetaHookPre CallFunction(get_net_stats, , ()) 1362692527.080972 MetaHookPre CallFunction(get_port_transport_proto, , (80/tcp)) 1362692527.080972 MetaHookPre CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856<...>/tcp])) @@ -3206,26 +3239,26 @@ 1362692527.080972 MetaHookPre LogInit(Log::WRITER_ASCII, default, true, true, conn(1362692527.080972,0.0,0.0), 21, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])}) 1362692527.080972 MetaHookPre LogWrite(Log::WRITER_ASCII, default, conn(1362692527.080972,0.0,0.0), 21, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])}, ) 1362692527.080972 MetaHookPre QueueEvent(ChecksumOffloading::check()) -1362692527.080972 MetaHookPre QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +1362692527.080972 MetaHookPre QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692527.080972 MetaHookPre QueueEvent(filter_change_tracking()) -1362692527.080972 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692527.080972 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) 1362692527.080972 MetaHookPre QueueEvent(zeek_done()) 1362692527.080972 MetaHookPre UpdateNetworkTime(1362692527.080972) 1362692527.080972 | HookUpdateNetworkTime 1362692527.080972 1362692527.080972 | HookCallFunction ChecksumOffloading::check() -1362692527.080972 | HookCallFunction Conn::conn_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp) -1362692527.080972 | HookCallFunction Conn::determine_service([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) -1362692527.080972 | HookCallFunction Conn::set_conn([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -1362692527.080972 | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -1362692527.080972 | HookCallFunction KRB::do_log([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) -1362692527.080972 | HookCallFunction KRB::fill_in_subjects([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +1362692527.080972 | HookCallFunction Conn::conn_state([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp) +1362692527.080972 | HookCallFunction Conn::determine_service([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +1362692527.080972 | HookCallFunction Conn::set_conn([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692527.080972 | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692527.080972 | HookCallFunction KRB::do_log([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +1362692527.080972 | HookCallFunction KRB::fill_in_subjects([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692527.080972 | HookCallFunction Log::__write(Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=]) 1362692527.080972 | HookCallFunction Log::write(Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=]) 1362692527.080972 | HookCallFunction cat(Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80) -1362692527.080972 | HookCallFunction connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +1362692527.080972 | HookCallFunction connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692527.080972 | HookCallFunction filter_change_tracking() 1362692527.080972 | HookCallFunction fmt(%s:%d > %s:%d, 141.142.228.5, 59856<...>/tcp) -1362692527.080972 | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692527.080972 | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) 1362692527.080972 | HookCallFunction get_net_stats() 1362692527.080972 | HookCallFunction get_port_transport_proto(80/tcp) 1362692527.080972 | HookCallFunction id_string([orig_h=141.142.228.5, orig_p=59856<...>/tcp]) @@ -3240,7 +3273,7 @@ 1362692527.080972 | HookLogInit conn 1/1 {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])} 1362692527.080972 | HookLogWrite conn [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id.orig_h=141.142.228.5, id.orig_p=59856, id.resp_h=192.150.187.43, id.resp_p=80, proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=] 1362692527.080972 | HookQueueEvent ChecksumOffloading::check() -1362692527.080972 | HookQueueEvent connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +1362692527.080972 | HookQueueEvent connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692527.080972 | HookQueueEvent filter_change_tracking() -1362692527.080972 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692527.080972 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) 1362692527.080972 | HookQueueEvent zeek_done() From 8b0098a8d44db67d6f133f81fd4f4022303d6444 Mon Sep 17 00:00:00 2001 From: Palumbo Mauro Date: Mon, 3 Jun 2019 17:17:38 +0200 Subject: [PATCH 04/25] remove events ntp_mode6_message and ntp_mode7_message --- aux/broker | 2 +- aux/btest | 2 +- aux/netcontrol-connectors | 2 +- doc | 2 +- src/analyzer/protocol/ntp/events.bif | 3 --- src/analyzer/protocol/ntp/ntp-analyzer.pac | 8 -------- 6 files changed, 4 insertions(+), 15 deletions(-) diff --git a/aux/broker b/aux/broker index bfefac3a88..474a6d902b 160000 --- a/aux/broker +++ b/aux/broker @@ -1 +1 @@ -Subproject commit bfefac3a882b382bfb7ad749974930884da954a6 +Subproject commit 474a6d902b1c41912b216c06a74085ff3b102bad diff --git a/aux/btest b/aux/btest index 539c2d8253..6ece47ba64 160000 --- a/aux/btest +++ b/aux/btest @@ -1 +1 @@ -Subproject commit 539c2d82534345c62ba9a20c2e98ea5cbdea9c7e +Subproject commit 6ece47ba6438e7a6db5c7b85a68b3c16f0911871 diff --git a/aux/netcontrol-connectors b/aux/netcontrol-connectors index 43da5d80fd..e93235aa6e 160000 --- a/aux/netcontrol-connectors +++ b/aux/netcontrol-connectors @@ -1 +1 @@ -Subproject commit 43da5d80fdf0923e790af3c21749f6e6241cda80 +Subproject commit e93235aa6e45820af7e23e97627845a7b2b3d919 diff --git a/doc b/doc index 7f64a90d86..3db2ff8fa6 160000 --- a/doc +++ b/doc @@ -1 +1 @@ -Subproject commit 7f64a90d86fc53506f93fb4c327fdb8c4e3aab0a +Subproject commit 3db2ff8fa65f5acb3f7807a0302d5c81db1e2227 diff --git a/src/analyzer/protocol/ntp/events.bif b/src/analyzer/protocol/ntp/events.bif index 4205b28efd..3d864fc89a 100644 --- a/src/analyzer/protocol/ntp/events.bif +++ b/src/analyzer/protocol/ntp/events.bif @@ -7,6 +7,3 @@ ## msg: The NTP message record ## event ntp_message%(c: connection, is_orig: bool, msg: NTP::Message%); - -event ntp_mode6_message%(c: connection, is_orig: bool, opcode: count%); -event ntp_mode7_message%(c: connection, is_orig: bool, opcode: count%); diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index d887dd4a25..61a7472a49 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -89,11 +89,3 @@ refine flow NTP_Flow += { refine typeattr NTP_Association += &let { proc: bool = $context.flow.proc_ntp_association(this); }; - -refine typeattr NTP_Mode6 += &let { - proc: bool = $context.flow.proc_ntp_mode6(this); -}; - -refine typeattr NTP_Mode7 += &let { - proc: bool = $context.flow.proc_ntp_mode7(this); -}; From 19fd5f66e814baf6f7343721b64592b3ea6564f5 Mon Sep 17 00:00:00 2001 From: Palumbo Mauro Date: Mon, 3 Jun 2019 17:26:46 +0200 Subject: [PATCH 05/25] refactor mode 7 --- src/analyzer/protocol/ntp/CMakeLists.txt | 2 +- src/analyzer/protocol/ntp/ntp-mode7.pac | 123 +++++++++++++++++++++ src/analyzer/protocol/ntp/ntp-protocol.pac | 123 --------------------- src/analyzer/protocol/ntp/ntp.pac | 12 +- 4 files changed, 127 insertions(+), 133 deletions(-) create mode 100644 src/analyzer/protocol/ntp/ntp-mode7.pac diff --git a/src/analyzer/protocol/ntp/CMakeLists.txt b/src/analyzer/protocol/ntp/CMakeLists.txt index 8d603f49f6..ae26c7cdcd 100644 --- a/src/analyzer/protocol/ntp/CMakeLists.txt +++ b/src/analyzer/protocol/ntp/CMakeLists.txt @@ -8,5 +8,5 @@ bro_plugin_begin(Bro NTP) bro_plugin_cc(NTP.cc Plugin.cc) bro_plugin_bif(types.bif) bro_plugin_bif(events.bif) - bro_plugin_pac(ntp.pac ntp-analyzer.pac ntp-protocol.pac) + bro_plugin_pac(ntp.pac ntp-analyzer.pac ntp-mode7.pac ntp-protocol.pac) bro_plugin_end() diff --git a/src/analyzer/protocol/ntp/ntp-mode7.pac b/src/analyzer/protocol/ntp/ntp-mode7.pac new file mode 100644 index 0000000000..33b88ec6c4 --- /dev/null +++ b/src/analyzer/protocol/ntp/ntp-mode7.pac @@ -0,0 +1,123 @@ +# This is a mode7 message as described below. +# The documentation below is taken from the NTP official project (www.ntp.org), +# code v. ntp-4.2.8p13, in include/ntp_request.h. +# +# A mode 7 packet is used exchanging data between an NTP server +# and a client for purposes other than time synchronization, e.g. +# monitoring, statistics gathering and configuration. A mode 7 +# packet has the following format: +# +# 0 1 2 3 +# 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# |R|M| VN | Mode|A| Sequence | Implementation| Req Code | +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# | Err | Number of data items | MBZ | Size of data item | +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# | | +# | Data (Minimum 0 octets, maximum 500 octets) | +# | | +# [...] +# | | +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# | Encryption Keyid (when A bit set) | +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# | | +# | Message Authentication Code (when A bit set) | +# | | +# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +# +# where the fields are (note that the client sends requests, the server +# responses): +# +# Response Bit: This packet is a response (if clear, packet is a request). +# +# More Bit: Set for all packets but the last in a response which +# requires more than one packet. +# +# Version Number: 2 for current version +# +# Mode: Always 7 +# +# Authenticated bit: If set, this packet is authenticated. +# +# Sequence number: For a multipacket response, contains the sequence +# number of this packet. 0 is the first in the sequence, +# 127 (or less) is the last. The More Bit must be set in +# all packets but the last. +# +# Implementation number: The number of the implementation this request code +# is defined by. An implementation number of zero is used +# for requst codes/data formats which all implementations +# agree on. Implementation number 255 is reserved (for +# extensions, in case we run out). +# +# Request code: An implementation-specific code which specifies the +# operation to be (which has been) performed and/or the +# format and semantics of the data included in the packet. +# +# Err: Must be 0 for a request. For a response, holds an error +# code relating to the request. If nonzero, the operation +# requested wasn't performed. +# +# 0 - no error +# 1 - incompatible implementation number +# 2 - unimplemented request code +# 3 - format error (wrong data items, data size, packet size etc.) +# 4 - no data available (e.g. request for details on unknown peer) +# 5-6 I don't know +# 7 - authentication failure (i.e. permission denied) +# +# Number of data items: number of data items in packet. 0 to 500 +# +# MBZ: A reserved data field, must be zero in requests and responses. +# +# Size of data item: size of each data item in packet. 0 to 500 +# +# Data: Variable sized area containing request/response data. For +# requests and responses the size in octets must be greater +# than or equal to the product of the number of data items +# and the size of a data item. For requests the data area +# must be exactly 40 octets in length. For responses the +# data area may be any length between 0 and 500 octets +# inclusive. +# +# Message Authentication Code: Same as NTP spec, in definition and function. +# May optionally be included in requests which require +# authentication, is never included in responses. +# +# The version number, mode and keyid have the same function and are +# in the same location as a standard NTP packet. The request packet +# is the same size as a standard NTP packet to ease receive buffer +# management, and to allow the same encryption procedure to be used +# both on mode 7 and standard NTP packets. The mac is included when +# it is required that a request be authenticated, the keyid should be +# zero in requests in which the mac is not included. +# +# The data format depends on the implementation number/request code pair +# and whether the packet is a request or a response. The only requirement +# is that data items start in the octet immediately following the size +# word and that data items be concatenated without padding between (i.e. +# if the data area is larger than data_items*size, all padding is at +# the end). Padding is ignored, other than for encryption purposes. +# Implementations using encryption might want to include a time stamp +# or other data in the request packet padding. The key used for requests +# is implementation defined, but key 15 is suggested as a default. + +type NTP_mode7_msg = record { + second_byte : uint8; + implementation : uint8; + request_code : uint8; + err_and_data_len : uint16; + data : bytestring &length=data_len; + have_mac : case(auth_bit) of { + true -> mac: NTP_MAC; + false -> nil: empty; + }; +} &let { + auth_bit : bool = (second_byte & 0x80) > 0; + sequence : uint8 = (second_byte & 0x7F); + error_code: uint8 = (err_and_data_len & 0xF000) >> 12; + data_len : uint16 = (err_and_data_len & 0x0FFF); +} &byteorder=bigendian &exportsourcedata; + diff --git a/src/analyzer/protocol/ntp/ntp-protocol.pac b/src/analyzer/protocol/ntp/ntp-protocol.pac index 1b36974a0c..cbac2ee09d 100644 --- a/src/analyzer/protocol/ntp/ntp-protocol.pac +++ b/src/analyzer/protocol/ntp/ntp-protocol.pac @@ -85,126 +85,3 @@ type NTP_Mode6(first_byte: uint8, version: uint8) = record { opcode : uint8 = (rem_op & 0x1f); pad_length : uint8 = (count % 32 == 0) ? 0 : 32 - (count % 32); }; - - -# From ntp/include/ntp_request.h of the ntp-project: -# -# A mode 7 packet is used exchanging data between an NTP server -# and a client for purposes other than time synchronization, e.g. -# monitoring, statistics gathering and configuration. A mode 7 -# packet has the following format: -# -# 0 1 2 3 -# 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 -# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -# |R|M| VN | Mode|A| Sequence | Implementation| Req Code | -# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -# | Err | Number of data items | MBZ | Size of data item | -# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -# | | -# | Data (Minimum 0 octets, maximum 500 octets) | -# | | -# [...] -# | | -# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -# | Encryption Keyid (when A bit set) | -# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -# | | -# | Message Authentication Code (when A bit set) | -# | | -# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -# -# where the fields are (note that the client sends requests, the server -# responses): -# -# Response Bit: This packet is a response (if clear, packet is a request). -# -# More Bit: Set for all packets but the last in a response which -# requires more than one packet. -# -# Version Number: 2 for current version -# -# Mode: Always 7 -# -# Authenticated bit: If set, this packet is authenticated. -# -# Sequence number: For a multipacket response, contains the sequence -# number of this packet. 0 is the first in the sequence, -# 127 (or less) is the last. The More Bit must be set in -# all packets but the last. -# -# Implementation number: The number of the implementation this request code -# is defined by. An implementation number of zero is used -# for requst codes/data formats which all implementations -# agree on. Implementation number 255 is reserved (for -# extensions, in case we run out). -# -# Request code: An implementation-specific code which specifies the -# operation to be (which has been) performed and/or the -# format and semantics of the data included in the packet. -# -# Err: Must be 0 for a request. For a response, holds an error -# code relating to the request. If nonzero, the operation -# requested wasn't performed. -# -# 0 - no error -# 1 - incompatible implementation number -# 2 - unimplemented request code -# 3 - format error (wrong data items, data size, packet size etc.) -# 4 - no data available (e.g. request for details on unknown peer) -# 5-6 I don't know -# 7 - authentication failure (i.e. permission denied) -# -# Number of data items: number of data items in packet. 0 to 500 -# -# MBZ: A reserved data field, must be zero in requests and responses. -# -# Size of data item: size of each data item in packet. 0 to 500 -# -# Data: Variable sized area containing request/response data. For -# requests and responses the size in octets must be greater -# than or equal to the product of the number of data items -# and the size of a data item. For requests the data area -# must be exactly 40 octets in length. For responses the -# data area may be any length between 0 and 500 octets -# inclusive. -# -# Message Authentication Code: Same as NTP spec, in definition and function. -# May optionally be included in requests which require -# authentication, is never included in responses. -# -# The version number, mode and keyid have the same function and are -# in the same location as a standard NTP packet. The request packet -# is the same size as a standard NTP packet to ease receive buffer -# management, and to allow the same encryption procedure to be used -# both on mode 7 and standard NTP packets. The mac is included when -# it is required that a request be authenticated, the keyid should be -# zero in requests in which the mac is not included. -# -# The data format depends on the implementation number/request code pair -# and whether the packet is a request or a response. The only requirement -# is that data items start in the octet immediately following the size -# word and that data items be concatenated without padding between (i.e. -# if the data area is larger than data_items*size, all padding is at -# the end). Padding is ignored, other than for encryption purposes. -# Implementations using encryption might want to include a time stamp -# or other data in the request packet padding. The key used for requests -# is implementation defined, but key 15 is suggested as a default. -# -type NTP_Mode7(first_byte: uint8, version: uint8) = record { - second_byte : uint8; - implementation_num: uint8; - request_code : uint8; - err_and_data_len : uint16; - data : bytestring &length=data_len; - have_mac : case(auth_bit) of { - true -> mac: NTP_MAC; - false -> nil: empty; - }; -} &let { - auth_bit : bool = (second_byte & 0x80) > 0; - sequence : uint8 = (second_byte & 0x7F); - error_code: uint8 = (err_and_data_len & 0xF000) >> 12; - data_len : uint16 = (err_and_data_len & 0x0FFF); -}; - diff --git a/src/analyzer/protocol/ntp/ntp.pac b/src/analyzer/protocol/ntp/ntp.pac index 5ec3957078..6ee6027f76 100644 --- a/src/analyzer/protocol/ntp/ntp.pac +++ b/src/analyzer/protocol/ntp/ntp.pac @@ -1,15 +1,10 @@ -# Generated by binpac_quickstart - -# Analyzer for Network Time Protocol -# - ntp-protocol.pac: describes the NTP protocol messages -# - ntp-analyzer.pac: describes the NTP analyzer code %include binpac.pac %include bro.pac %extern{ + #include "types.bif.h" #include "events.bif.h" - #include "types.bif.h" %} analyzer NTP withcontext { @@ -17,17 +12,16 @@ analyzer NTP withcontext { flow: NTP_Flow; }; -# Our connection consists of two flows, one in each direction. connection NTP_Conn(bro_analyzer: BroAnalyzer) { upflow = NTP_Flow(true); downflow = NTP_Flow(false); }; +%include ntp-mode7.pac %include ntp-protocol.pac -# Now we define the flow: flow NTP_Flow(is_orig: bool) { datagram = NTP_PDU(is_orig) withcontext(connection, this); }; -%include ntp-analyzer.pac \ No newline at end of file +%include ntp-analyzer.pac From 411908a102a2fd97b5092bc3dfadb7213de3564a Mon Sep 17 00:00:00 2001 From: Palumbo Mauro Date: Mon, 3 Jun 2019 17:46:22 +0200 Subject: [PATCH 06/25] extend and refactor several fields --- src/analyzer/protocol/ntp/CMakeLists.txt | 8 +- src/analyzer/protocol/ntp/NTP.cc | 11 +- src/analyzer/protocol/ntp/NTP.h | 24 +-- src/analyzer/protocol/ntp/Plugin.cc | 9 +- src/analyzer/protocol/ntp/events.bif | 14 +- src/analyzer/protocol/ntp/ntp-analyzer.pac | 178 +++++++++++++-------- src/analyzer/protocol/ntp/ntp-protocol.pac | 138 ++++++++-------- src/analyzer/protocol/ntp/types.bif | 5 +- 8 files changed, 209 insertions(+), 178 deletions(-) diff --git a/src/analyzer/protocol/ntp/CMakeLists.txt b/src/analyzer/protocol/ntp/CMakeLists.txt index ae26c7cdcd..14fe87470d 100644 --- a/src/analyzer/protocol/ntp/CMakeLists.txt +++ b/src/analyzer/protocol/ntp/CMakeLists.txt @@ -1,12 +1,10 @@ -# Generated by binpac_quickstart include(BroPlugin) include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DIR}) bro_plugin_begin(Bro NTP) - bro_plugin_cc(NTP.cc Plugin.cc) - bro_plugin_bif(types.bif) - bro_plugin_bif(events.bif) - bro_plugin_pac(ntp.pac ntp-analyzer.pac ntp-mode7.pac ntp-protocol.pac) +bro_plugin_cc(NTP.cc Plugin.cc) +bro_plugin_bif(types.bif events.bif) +bro_plugin_pac(ntp.pac ntp-analyzer.pac ntp-mode7.pac ntp-protocol.pac) bro_plugin_end() diff --git a/src/analyzer/protocol/ntp/NTP.cc b/src/analyzer/protocol/ntp/NTP.cc index 6918578a02..9a88138206 100644 --- a/src/analyzer/protocol/ntp/NTP.cc +++ b/src/analyzer/protocol/ntp/NTP.cc @@ -1,5 +1,3 @@ -// Generated by binpac_quickstart - #include "NTP.h" #include "Reporter.h" @@ -9,12 +7,9 @@ using namespace analyzer::NTP; NTP_Analyzer::NTP_Analyzer(Connection* c) - -: analyzer::Analyzer("NTP", c) - + : analyzer::Analyzer("NTP", c) { interp = new binpac::NTP::NTP_Conn(this); - } NTP_Analyzer::~NTP_Analyzer() @@ -24,13 +19,11 @@ NTP_Analyzer::~NTP_Analyzer() void NTP_Analyzer::Done() { - Analyzer::Done(); - } void NTP_Analyzer::DeliverPacket(int len, const u_char* data, - bool orig, uint64 seq, const IP_Hdr* ip, int caplen) + bool orig, uint64 seq, const IP_Hdr* ip, int caplen) { Analyzer::DeliverPacket(len, data, orig, seq, ip, caplen); diff --git a/src/analyzer/protocol/ntp/NTP.h b/src/analyzer/protocol/ntp/NTP.h index f7d9912131..c155fb3135 100644 --- a/src/analyzer/protocol/ntp/NTP.h +++ b/src/analyzer/protocol/ntp/NTP.h @@ -1,5 +1,3 @@ -// Generated by binpac_quickstart - #ifndef ANALYZER_PROTOCOL_NTP_NTP_H #define ANALYZER_PROTOCOL_NTP_NTP_H @@ -12,29 +10,23 @@ namespace analyzer { namespace NTP { -class NTP_Analyzer - -: public analyzer::Analyzer { - +class NTP_Analyzer : public analyzer::Analyzer { public: - NTP_Analyzer(Connection* conn); - virtual ~NTP_Analyzer(); + explicit NTP_Analyzer(Connection* conn); + ~NTP_Analyzer() override; // Overriden from Analyzer. - virtual void Done(); - - virtual void DeliverPacket(int len, const u_char* data, bool orig, - uint64 seq, const IP_Hdr* ip, int caplen); - + void Done() override; + void DeliverPacket(int len, const u_char* data, bool orig, + uint64 seq, const IP_Hdr* ip, int caplen) override; - static analyzer::Analyzer* InstantiateAnalyzer(Connection* conn) + static analyzer::Analyzer* Instantiate(Connection* conn) { return new NTP_Analyzer(conn); } protected: binpac::NTP::NTP_Conn* interp; - }; -} } // namespace analyzer::* +} } // namespace analyzer::* #endif diff --git a/src/analyzer/protocol/ntp/Plugin.cc b/src/analyzer/protocol/ntp/Plugin.cc index 2ff9d52d66..6a742b9fcc 100644 --- a/src/analyzer/protocol/ntp/Plugin.cc +++ b/src/analyzer/protocol/ntp/Plugin.cc @@ -1,4 +1,4 @@ -// Generated by binpac_quickstart +// See the file in the main distribution directory for copyright. #include "plugin/Plugin.h" @@ -11,15 +11,14 @@ class Plugin : public plugin::Plugin { public: plugin::Configuration Configure() { - AddComponent(new ::analyzer::Component("NTP", - ::analyzer::NTP::NTP_Analyzer::InstantiateAnalyzer)); + AddComponent(new ::analyzer::Component("NTP", ::analyzer::NTP::NTP_Analyzer::Instantiate)); plugin::Configuration config; config.name = "Bro::NTP"; - config.description = "Network Time Protocol analyzer"; + config.description = "NTP analyzer"; return config; } } plugin; } -} \ No newline at end of file +} diff --git a/src/analyzer/protocol/ntp/events.bif b/src/analyzer/protocol/ntp/events.bif index 3d864fc89a..b9f66a1160 100644 --- a/src/analyzer/protocol/ntp/events.bif +++ b/src/analyzer/protocol/ntp/events.bif @@ -1,9 +1,15 @@ -## Generated for NTP time synchronization messages +## Generated for all NTP messages. Different from many other of Bro's events, +## this one is generated for both client-side and server-side messages. ## -## For more information about NTP, refer to :rfc:`5905` +## See `Wikipedia `__ for +## more information about the NTP protocol. ## -## c: The connection +## c: The connection record describing the corresponding UDP flow. ## -## msg: The NTP message record +## is_orig: +## +## msg: The parsed NTP message. +## +## .. zeek:see:: ## event ntp_message%(c: connection, is_orig: bool, msg: NTP::Message%); diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index 61a7472a49..e061439360 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -1,91 +1,131 @@ + %extern{ -#include -#define FRAC_16 pow(2,-16) -#define FRAC_32 pow(2,-32) -// NTP defines the epoch from 1900, not 1970 -#define EPOCH_OFFSET -2208988800 + #include + #define FRAC_16 pow(2,-16) + #define FRAC_32 pow(2,-32) + // NTP defines the epoch from 1900, not 1970 + #define EPOCH_OFFSET -2208988800 %} %header{ -Val* proc_ntp_short(const NTP_Short_Time* t); -Val* proc_ntp_timestamp(const NTP_Time* t); + Val* proc_ntp_short(const NTP_Short_Time* t); + Val* proc_ntp_timestamp(const NTP_Time* t); %} %code{ -Val* proc_ntp_short(const NTP_Short_Time* t) + Val* proc_ntp_short(const NTP_Short_Time* t) { - if ( t->seconds() == 0 && t->fractions() == 0 ) - return new Val(0.0, TYPE_INTERVAL); - return new Val(t->seconds() + t->fractions()*FRAC_16, TYPE_INTERVAL); + if ( t->seconds() == 0 && t->fractions() == 0 ) + return new Val(0.0, TYPE_INTERVAL); + return new Val(t->seconds() + t->fractions()*FRAC_16, TYPE_INTERVAL); } -Val* proc_ntp_timestamp(const NTP_Time* t) - { - if ( t->seconds() == 0 && t->fractions() == 0) - return new Val(0.0, TYPE_TIME); - return new Val(EPOCH_OFFSET + t->seconds() + (t->fractions()*FRAC_32), TYPE_TIME); - } + Val* proc_ntp_timestamp(const NTP_Time* t) + { + if ( t->seconds() == 0 && t->fractions() == 0) + return new Val(0.0, TYPE_TIME); + return new Val(EPOCH_OFFSET + t->seconds() + (t->fractions()*FRAC_32), TYPE_TIME); + } %} refine flow NTP_Flow += { - function proc_ntp_association(msg: NTP_Association): bool - %{ - RecordVal* rv = new RecordVal(BifType::Record::NTP::Message); - rv->Assign(0, new Val(${msg.version}, TYPE_COUNT)); - rv->Assign(1, new Val(${msg.mode}, TYPE_COUNT)); - rv->Assign(2, new Val(${msg.stratum}, TYPE_COUNT)); - rv->Assign(3, new Val(pow(2, ${msg.poll}), TYPE_INTERVAL)); - rv->Assign(4, new Val(pow(2, ${msg.precision}), TYPE_INTERVAL)); - rv->Assign(5, proc_ntp_short(${msg.root_delay})); - rv->Assign(6, proc_ntp_short(${msg.root_dispersion})); - switch ( ${msg.stratum} ) - { - case 0: - // unknown stratum => kiss code - rv->Assign(7, bytestring_to_val(${msg.reference_id})); - break; - case 1: - // reference clock => ref clock string - rv->Assign(8, bytestring_to_val(${msg.reference_id})); - break; - default: - // TODO: Check for v4/v6 - const uint8* d = ${msg.reference_id}.data(); - rv->Assign(9, new AddrVal(IPAddr(IPv4, (const uint32*) d, IPAddr::Network))); - break; - } + # This builds the standard msg record + function BuildNTPStdMsg(nsm: NTP_std_msg): BroVal + %{ + RecordVal* rv = new RecordVal(BifType::Record::NTP::std); - rv->Assign(11, proc_ntp_timestamp(${msg.reference_ts})); - rv->Assign(12, proc_ntp_timestamp(${msg.origin_ts})); - rv->Assign(13, proc_ntp_timestamp(${msg.receive_ts})); - rv->Assign(14, proc_ntp_timestamp(${msg.transmit_ts})); + rv->Assign(0, new Val(${nsm.stratum}, TYPE_COUNT)); + rv->Assign(1, new Val(pow(2, ${nsm.poll}), TYPE_INTERVAL)); + rv->Assign(2, new Val(pow(2, ${nsm.precision}), TYPE_INTERVAL)); + rv->Assign(3, proc_ntp_short(${nsm.root_delay})); + rv->Assign(4, proc_ntp_short(${nsm.root_dispersion})); - rv->Assign(17, new Val((uint32) ${msg.extensions}->size(), TYPE_COUNT)); + switch ( ${nsm.stratum} ) + { + case 0: + // unknown stratum => kiss code + rv->Assign(7, bytestring_to_val(${nsm.reference_id})); + break; + case 1: + // reference clock => ref clock string + rv->Assign(8, bytestring_to_val(${nsm.reference_id})); + break; + default: + // TODO: Check for v4/v6 + const uint8* d = ${nsm.reference_id}.data(); + rv->Assign(9, new AddrVal(IPAddr(IPv4, (const uint32*) d, IPAddr::Network))); + break; + } - BifEvent::generate_ntp_message(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - is_orig(), rv); - return true; - %} + rv->Assign(9, proc_ntp_timestamp(${nsm.reference_ts})); + rv->Assign(10, proc_ntp_timestamp(${nsm.origin_ts})); + rv->Assign(11, proc_ntp_timestamp(${nsm.receive_ts})); + rv->Assign(12, proc_ntp_timestamp(${nsm.transmit_ts})); - function proc_ntp_mode6(msg: NTP_Mode6): bool - %{ - BifEvent::generate_ntp_mode6_message(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - is_orig(), ${msg.opcode}); - return true; - %} + rv->Assign(15, new Val((uint32) ${nsm.extensions}->size(), TYPE_COUNT)); - function proc_ntp_mode7(msg: NTP_Mode7): bool - %{ - BifEvent::generate_ntp_mode7_message(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - is_orig(), ${msg.request_code}); - return true; - %} + return rv; + %} + + # This builds the control msg record + function BuildNTPControlMsg(ncm: NTP_control_msg): BroVal + %{ + RecordVal* rv = new RecordVal(BifType::Record::NTP::control); + + rv->Assign(0, new Val(${ncm.OpCode}, TYPE_COUNT)); + rv->Assign(1, new Val(${ncm.R}, TYPE_BOOL)); + rv->Assign(2, new Val(${ncm.E}, TYPE_BOOL)); + rv->Assign(3, new Val(${ncm.M}, TYPE_BOOL)); + rv->Assign(4, new Val(${ncm.sequence}, TYPE_COUNT)); + rv->Assign(5, new Val(${ncm.status}, TYPE_COUNT)); + rv->Assign(6, new Val(${ncm.association_id}, TYPE_COUNT)); + rv->Assign(7, new Val(${ncm.offs}, TYPE_COUNT)); + rv->Assign(8, new Val(${ncm.c}, TYPE_COUNT)); + rv->Assign(9, bytestring_to_val(${ncm.data})); + + return rv; + %} + + # This builds the mode7 msg record + function BuildNTPMode7Msg(m7: NTP_mode7_msg): BroVal + %{ + RecordVal* rv = new RecordVal(BifType::Record::NTP::mode7); + + rv->Assign(0, new Val(${m7.request_code}, TYPE_COUNT)); + rv->Assign(1, new Val(${m7.auth_bit}, TYPE_BOOL)); + rv->Assign(2, new Val(${m7.sequence}, TYPE_COUNT)); + rv->Assign(3, new Val(${m7.implementation}, TYPE_COUNT)); + rv->Assign(4, new Val(${m7.error_code}, TYPE_COUNT)); + rv->Assign(5, bytestring_to_val(${m7.data})); + + return rv; + %} + + + function proc_ntp_message(msg: NTP_PDU): bool + %{ + + RecordVal* rv = new RecordVal(BifType::Record::NTP::Message); + + rv->Assign(0, new Val(${msg.version}, TYPE_COUNT)); + rv->Assign(1, new Val(${msg.mode}, TYPE_COUNT)); + + // The standard record + if ( ${msg.mode}>0 && ${msg.mode}<6 ) { + rv->Assign(2, BuildNTPStdMsg(${msg.std})); + } else if ( ${msg.mode}==6 ) { + rv->Assign(3, BuildNTPControlMsg(${msg.control})); + } else if ( ${msg.mode}==7 ) { + rv->Assign(4, BuildNTPMode7Msg(${msg.mode7})); + } + + BifEvent::generate_ntp_message(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), is_orig(), rv); + return true; + %} }; -refine typeattr NTP_Association += &let { - proc: bool = $context.flow.proc_ntp_association(this); +refine typeattr NTP_PDU += &let { + proc: bool = $context.flow.proc_ntp_message(this); }; + diff --git a/src/analyzer/protocol/ntp/ntp-protocol.pac b/src/analyzer/protocol/ntp/ntp-protocol.pac index cbac2ee09d..4a1e8af22b 100644 --- a/src/analyzer/protocol/ntp/ntp-protocol.pac +++ b/src/analyzer/protocol/ntp/ntp-protocol.pac @@ -1,49 +1,71 @@ + +# This is the common part in the header format. +# See RFC 5905 for details type NTP_PDU(is_orig: bool) = record { - first_byte : uint8; - - # Modes 1-5 are standard NTP time sync - mode_chk_1 : case (mode>=1 && mode<=5) of { - true -> msg: NTP_Association(first_byte, mode, version); - false -> unk: empty; - } &requires(version); - - mode_chk_2 : case (mode) of { - 6 -> ctl_msg : NTP_Mode6(first_byte, version) &restofdata; - 7 -> mode_7 : NTP_Mode7(first_byte, version) &restofdata; - default -> unknown: bytestring &restofdata; - } &requires(version); - + # The first byte of the NTP header contains the leap indicator, + # the version and the mode + first_byte : uint8; + # Modes 1-5 are standard NTP time sync + standard_modes : case (mode>=1 && mode<=5) of { + true -> std : NTP_std_msg; + false -> emp : empty; + }; + modes_6_7 : case (mode) of { + # mode 6 is for control messages (format is different from modes 6-7) + 6 -> control : NTP_control_msg; + # mode 7 is reserved or private (and implementation dependent). For example used for some commands such as MONLIST + 7 -> mode7 : NTP_mode7_msg; + default -> unknown : bytestring &restofdata; + }; } &let { - mode: uint8 = (first_byte & 0x7); # Bytes 6-8 of 8-byte value - version: uint8 = (first_byte & 0x38) >> 3; # Bytes 3-5 of 8-byte value -} &byteorder=bigendian; + leap: uint8 = (first_byte & 0xc0)>>6; # First 2 bits of 8-bits value + version: uint8 = (first_byte & 0x38)>>3; # Bits 3-5 of 8-bits value + mode: uint8 = (first_byte & 0x07); # Bits 6-8 of 8-bits value +} &byteorder=bigendian &exportsourcedata; -type NTP_Association(first_byte: uint8, mode: uint8, version: uint8) = record { - stratum : uint8; - poll : int8; - precision : int8; - - root_delay : NTP_Short_Time; - root_dispersion: NTP_Short_Time; - reference_id : bytestring &length=4; - reference_ts : NTP_Time; - - origin_ts : NTP_Time; - receive_ts : NTP_Time; - transmit_ts : NTP_Time; +# This is the most common type of message, corresponding to modes 1-5 +# This kind of msg are used for normal operation of syncronization +# See RFC 5905 for details +type NTP_std_msg = record { + stratum : uint8; + poll : int8; + precision : int8; - extensions : Extension_Field[] &until($input.length() <= 18); - have_mac : case (offsetof(have_mac) < length) of { - true -> mac : NTP_MAC; - false -> nil : empty; - } &requires(length); + root_delay : NTP_Short_Time; + root_dispersion: NTP_Short_Time; + reference_id : bytestring &length=4; + reference_ts : NTP_Time; + + origin_ts : NTP_Time; + receive_ts : NTP_Time; + transmit_ts : NTP_Time; + extensions : Extension_Field[] &until($input.length() <= 18); + have_mac : case (offsetof(have_mac) < length) of { + true -> mac : NTP_MAC; + false -> nil : empty; + } &requires(length); } &let { - leap: bool = (first_byte & 0xc0); # First 2 bytes of 8-byte value - leap_61: bool = (leap & 0x40) > 0; # leap_indicator == 1 - leap_59: bool = (leap & 0x80) > 0; # leap_indicator == 2 - leap_unk: bool = (leap & 0xc0) > 0; # leap_indicator == 3 - length = sourcedata.length(); -} &exportsourcedata; + length = sourcedata.length(); +} &byteorder=bigendian &exportsourcedata; + +# This format is for mode==6, control msg +# See RFC 1119 for details +type NTP_control_msg = record { + second_byte : uint8; + sequence : uint16; + status : uint16; #TODO: this must be further specified + association_id : uint16; + offs : uint16; + c : uint16; + data : bytestring &restofdata; + #auth : #TODO +} &let { + R: bool = (second_byte & 0x80) > 0; # First bit of 8-bits value + E: bool = (second_byte & 0x40) > 0; # Second bit of 8-bits value + M: bool = (second_byte & 0x20) > 0; # Third bit of 8-bits value + OpCode: uint8 = (second_byte & 0x1F); # Last 5 bits of 8-bits value +} &byteorder=bigendian &exportsourcedata; + type NTP_MAC = record { key_id: uint32; @@ -51,37 +73,17 @@ type NTP_MAC = record { } &length=18; type Extension_Field = record { - field_type: uint16; - length : uint16; - data : bytestring &length=length-4; + field_type: uint16; + length : uint16; + data : bytestring &length=length-4; }; type NTP_Short_Time = record { - seconds: int16; - fractions: int16; + seconds: int16; + fractions: int16; }; type NTP_Time = record { - seconds: uint32; - fractions: uint32; -}; - - -# From RFC 1305, Appendix B: -type NTP_Mode6(first_byte: uint8, version: uint8) = record { - rem_op : uint8; - sequence: uint16; - status : uint16; - assoc_id: uint16; - offset : uint16; - count : uint16; - data : bytestring &length=count; - pad : padding[pad_length]; - opt_auth: bytestring &restofdata; -} &let { - response_bit: bool = (rem_op & 0x80) > 0; - error_bit : bool = (rem_op & 0x40) > 0; - more_bit : bool = (rem_op & 0x20) > 0; - opcode : uint8 = (rem_op & 0x1f); - pad_length : uint8 = (count % 32 == 0) ? 0 : 32 - (count % 32); + seconds: uint32; + fractions: uint32; }; diff --git a/src/analyzer/protocol/ntp/types.bif b/src/analyzer/protocol/ntp/types.bif index 1a5fd07faa..513bd4dbae 100644 --- a/src/analyzer/protocol/ntp/types.bif +++ b/src/analyzer/protocol/ntp/types.bif @@ -1,5 +1,6 @@ module NTP; +type NTP::std: record; +type NTP::control: record; +type NTP::mode7: record; type NTP::Message: record; - -module GLOBAL; \ No newline at end of file From ce07b10aa82d8149d1877959362e7727bc9fa952 Mon Sep 17 00:00:00 2001 From: Palumbo Mauro Date: Mon, 3 Jun 2019 17:50:32 +0200 Subject: [PATCH 07/25] extend and refact script-side of NTP analyzer --- scripts/base/protocols/ntp/__load__.zeek | 3 +- scripts/base/protocols/ntp/dpd.sig | 14 +- scripts/base/protocols/ntp/main.zeek | 268 +++++++++++++++-------- 3 files changed, 180 insertions(+), 105 deletions(-) diff --git a/scripts/base/protocols/ntp/__load__.zeek b/scripts/base/protocols/ntp/__load__.zeek index 4ca8806d3b..16ffbbf380 100644 --- a/scripts/base/protocols/ntp/__load__.zeek +++ b/scripts/base/protocols/ntp/__load__.zeek @@ -1,3 +1,2 @@ -# Generated by binpac_quickstart @load ./main -@load ./consts \ No newline at end of file +#@load-sigs ./dpd.sig diff --git a/scripts/base/protocols/ntp/dpd.sig b/scripts/base/protocols/ntp/dpd.sig index 2eb583c6c9..3c755ecc4f 100644 --- a/scripts/base/protocols/ntp/dpd.sig +++ b/scripts/base/protocols/ntp/dpd.sig @@ -1,14 +1,12 @@ -# Generated by binpac_quickstart - signature dpd_ntp { - - ip-proto == udp - - # ## TODO: Define the payload. When Bro sees this regex, on + ip-proto == udp + + + # ## TODO: Define the payload. When Bro sees this regex, on # ## any port, it will enable your analyzer on that # ## connection. # ## payload /^NTP/ - enable "ntp" -} \ No newline at end of file + enable "ntp" +} diff --git a/scripts/base/protocols/ntp/main.zeek b/scripts/base/protocols/ntp/main.zeek index b39547d6a6..de65863c39 100644 --- a/scripts/base/protocols/ntp/main.zeek +++ b/scripts/base/protocols/ntp/main.zeek @@ -1,119 +1,197 @@ module NTP; -@load ./consts +# TODO: The recommended method to do dynamic protocol detection +# (DPD) is with the signatures in dpd.sig. +# For the time being, we use port detection. +const ports = { 123/udp }; +redef likely_server_ports += { ports }; export { - redef enum Log::ID += { LOG }; + redef enum Log::ID += { LOG }; - type Info: record { - ## Timestamp for when the event happened. - ts: time &log; - ## Unique ID for the connection. - uid: string &log; - ## The connection's 4-tuple of endpoint addresses/ports. - id: conn_id &log; - ## The version of NTP - ver: count &log; - ## The stratum (primary, secondary, etc.) of the server - stratum: count &log &optional; - ## The precision of the system clock of the client - precision: interval &log &optional; - ## The time at the client that the request was sent to the server - org_time: time &log &optional; - ## The time at the server when the request was received - rec_time: time &log &optional; - ## The time at the server when the reply was sent - xmt_time: time &log &optional; - ## For stratum 0, 4 character string used for debugging - kiss_code: string &log &optional; - ## For stratum 1, ID assigned to the clock by IANA - ref_id: string &log &optional; - ## The IP of the server's reference clock - ref_clock: addr &log &optional; + type Info: record { + ## Timestamp for when the event happened. + ts: time &log; + ## Unique ID for the connection. + uid: string &log; + ## The connection's 4-tuple of endpoint addresses/ports. + id: conn_id &log; + ## The NTP version number (1, 2, 3, 4) + version: count &log; + ## The NTP mode being used + mode: count &log; + ## The stratum (primary server, secondary server, etc.) + stratum: count &log; + ## The maximum interval between successive messages + poll: interval &log; + ## The precision of the system clock + precision: interval &log; + ## Total round-trip delay to the reference clock + root_delay: interval &log; + ## Total dispersion to the reference clock + root_disp: interval &log; + ## For stratum 0, 4 character string used for debugging + kiss_code: string &optional &log; + ## For stratum 1, ID assigned to the reference clock by IANA + ref_id: string &optional &log; + ## Above stratum 1, when using IPv4, the IP address of the reference clock + ref_addr: addr &optional &log; + ## Above stratum 1, when using IPv6, the first four bytes of the MD5 hash of the + ## IPv6 address of the reference clock + ref_v6_hash_prefix: string &optional &log; + ## Time when the system clock was last set or correct + ref_time: time &log; + ## Time at the client when the request departed for the NTP server + org_time: time &log; + ## Time at the server when the request arrived from the NTP client + rec_time: time &log; + ## Time at the server when the response departed for the NTP client + xmt_time: time &log; + ## Key used to designate a secret MD5 key + key_id: count &optional &log; + ## MD5 hash computed over the key followed by the NTP packet header and extension fields + digest: string &optional &log; + ## Number of extension fields (which are not currently parsed) + num_exts: count &default=0 &log; + + ## An integer specifying the command function. Values currently defined includes: + ## 1 read status command/response + ## 2 read variables command/response + ## 3 write variables command/response + ## 4 read clock variables command/response + ## 5 write clock variables command/response + ## 6 set trap address/port command/response + ## 7 trap response + ## Other values are reserved. + OpCode : count &log; + ## The response bit. Set to zero for commands, one for responses. + resp_bit : bool &log; + ## The error bit. Set to zero for normal response, one for error response. + err_bit : bool &log; + ## The more bit. Set to zero for last fragment, one for all others. + more_bit : bool &log; + ## The sequence number of the command or response + sequence : count &log; + ## The current status of the system, peer or clock + status : count &log; + ## A 16-bit integer identifying a valid association + association_id : count &log; + + ## An implementation-specific code which specifies the + ## operation to be (which has been) performed and/or the + ## format and semantics of the data included in the packet. + ReqCode : count &log; + ## The authenticated bit. If set, this packet is authenticated. + auth_bit : bool &log; + ## For a multipacket response, contains the sequence + ## number of this packet. 0 is the first in the sequence, + ## 127 (or less) is the last. The More Bit must be set in + ## all packets but the last. + sequence : count &log; + ## The number of the implementation this request code + ## is defined by. An implementation number of zero is used + ## for requst codes/data formats which all implementations + ## agree on. Implementation number 255 is reserved (for + ## extensions, in case we run out). + implementation : count &log; + ## Must be 0 for a request. For a response, holds an error + ## code relating to the request. If nonzero, the operation + ## requested wasn't performed. + ## + ## 0 - no error + ## 1 - incompatible implementation number + ## 2 - unimplemented request code + ## 3 - format error (wrong data items, data size, packet size etc.) + ## 4 - no data available (e.g. request for details on unknown peer) + ## 5-6 I don't know + ## 7 - authentication failure (i.e. permission denied) + err : count &log; }; - ## Event that can be handled to access the NTP record as it is sent on - ## to the logging framework. - global log_ntp: event(rec: Info); + ## Event that can be handled to access the NTP record as it is sent on + ## to the logging framework. + global log_ntp: event(rec: Info); } redef record connection += { - ntp: Info &optional; + ntp: Info &optional; }; -const ports = { 123/udp }; - -redef likely_server_ports += { ports }; - -event zeek_init() &priority=5 - { - Log::create_stream(NTP::LOG, [$columns=Info, $ev=log_ntp, $path="ntp"]); - - Analyzer::register_for_ports(Analyzer::ANALYZER_NTP, ports); - } - event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) &priority=5 - { - # Record initialization +{ local info: Info; - if ( c?$ntp ) - info = c$ntp; - else - { - info$ts = network_time(); - info$uid = c$uid; - info$id = c$id; - info$ver = msg$version; - } + info$ts = network_time(); + info$uid = c$uid; + info$id = c$id; + info$version = msg$version; + info$mode = msg$mode; - # From the request, we get the desired precision - if ( is_orig ) - { - info$precision = msg$precision; - c$ntp = info; - return; - } + if ( msg$mode < 6 ) { + info$stratum = msg$std_msg$stratum; + info$poll = msg$std_msg$poll; + info$precision = msg$std_msg$precision; + info$root_delay = msg$std_msg$root_delay; + info$root_disp = msg$std_msg$root_disp; - # From the response, we fill out most of the rest of the fields. - info$stratum = msg$stratum; - info$org_time = msg$org_time; - info$rec_time = msg$rec_time; - info$xmt_time = msg$xmt_time; + if ( info?$kiss_code) + info$kiss_code = msg$std_msg$kiss_code; + if ( info?$ref_id) + info$ref_id = msg$std_msg$ref_id; + if ( info?$ref_addr) + info$ref_addr = msg$std_msg$ref_addr; + if ( info?$ref_v6_hash_prefix) + info$ref_v6_hash_prefix = msg$std_msg$ref_v6_hash_prefix; - # Stratum 1 has the textual reference ID - if ( msg$stratum == 1 ) - info$ref_id = gsub(msg$ref_id, /\x00*/, ""); + info$ref_time = msg$std_msg$ref_time; + info$org_time = msg$std_msg$org_time; + info$rec_time = msg$std_msg$rec_time; + info$xmt_time = msg$std_msg$xmt_time; - # Higher stratums using IPv4 have the address of the reference server. - if ( msg$stratum > 1 ) - { - if ( is_v4_addr(c$id$orig_h) ) - info$ref_clock = msg$ref_addr; - } + if ( info?$key_id) + info$key_id = msg$std_msg$key_id; + if ( info?$digest) + info$digest = msg$std_msg$digest; + + info$num_exts = msg$std_msg$num_exts; + } + + if ( msg$mode==6 ) { + info$OpCode = msg$control_msg$OpCode; + info$resp_bit = msg$control_msg$resp_bit; + info$err_bit = msg$control_msg$err_bit; + info$more_bit = msg$control_msg$more_bit; + info$sequence = msg$control_msg$sequence; + info$status = msg$control_msg$status; + info$association_id = msg$control_msg$association_id; + } + + if ( msg$mode==7 ) { + info$ReqCode = msg$mode7_msg$ReqCode; + info$auth_bit = msg$mode7_msg$auth_bit; + info$sequence = msg$mode7_msg$sequence; + info$implementation = msg$mode7_msg$implementation; + info$err = msg$mode7_msg$err; + } + + # Copy the present packet info into the connection record + # If more ntp packets are sent on the same connection, the newest one + # will overwrite the previous c$ntp = info; - } + + # Add the service to the Conn::LOG + add c$service["ntp"]; +} event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) &priority=-5 - { - if ( ! is_orig ) - { - Log::write(NTP::LOG, c$ntp); - delete c$ntp; - } - } +{ + # Log every ntp packet into ntp.log + Log::write(NTP::LOG, c$ntp); +} -event connection_state_remove(c: connection) &priority=-5 - { - if ( c?$ntp ) - Log::write(NTP::LOG, c$ntp); - } +event zeek_init() &priority=5 +{ + Analyzer::register_for_ports(Analyzer::ANALYZER_NTP, ports); -event ntp_mode6_message(c: connection, is_orig: bool, opcode: count) - { - print "Mode 6", opcode; - } + Log::create_stream(NTP::LOG, [$columns = Info, $ev = log_ntp]); +} -event ntp_mode7_message(c: connection, is_orig: bool, opcode: count) - { - print "Mode 7", opcode; - } From c8f4d681850ebceb60013abe5b349b444c328287 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Tue, 4 Jun 2019 12:22:37 +0200 Subject: [PATCH 08/25] update ntp analyzer to val_mgr --- src/analyzer/protocol/ntp/ntp-analyzer.pac | 50 ++++++++++++---------- 1 file changed, 27 insertions(+), 23 deletions(-) diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index e061439360..ed9284ef85 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -12,22 +12,26 @@ Val* proc_ntp_timestamp(const NTP_Time* t); %} + %code{ Val* proc_ntp_short(const NTP_Short_Time* t) { if ( t->seconds() == 0 && t->fractions() == 0 ) - return new Val(0.0, TYPE_INTERVAL); - return new Val(t->seconds() + t->fractions()*FRAC_16, TYPE_INTERVAL); + return new IntervalVal(0.0, Milliseconds); + return new IntervalVal((double)ntohl(t->seconds() + t->fractions()*FRAC_16), Milliseconds); + //return new IntervalVal((double)ntohs(t->seconds() + t->fractions()*FRAC_16), Seconds); } Val* proc_ntp_timestamp(const NTP_Time* t) { if ( t->seconds() == 0 && t->fractions() == 0) return new Val(0.0, TYPE_TIME); - return new Val(EPOCH_OFFSET + t->seconds() + (t->fractions()*FRAC_32), TYPE_TIME); + return new IntervalVal((double)ntohl(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32), Milliseconds); + //return new IntervalVal((double)ntohs(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32), Seconds); } %} + refine flow NTP_Flow += { # This builds the standard msg record @@ -35,9 +39,9 @@ refine flow NTP_Flow += { %{ RecordVal* rv = new RecordVal(BifType::Record::NTP::std); - rv->Assign(0, new Val(${nsm.stratum}, TYPE_COUNT)); - rv->Assign(1, new Val(pow(2, ${nsm.poll}), TYPE_INTERVAL)); - rv->Assign(2, new Val(pow(2, ${nsm.precision}), TYPE_INTERVAL)); + rv->Assign(0, val_mgr->GetCount(${nsm.stratum})); + rv->Assign(1, new IntervalVal(pow(2, ${nsm.poll}), Milliseconds)); + rv->Assign(2, new IntervalVal(pow(2, ${nsm.precision}), Milliseconds)); rv->Assign(3, proc_ntp_short(${nsm.root_delay})); rv->Assign(4, proc_ntp_short(${nsm.root_dispersion})); @@ -63,7 +67,7 @@ refine flow NTP_Flow += { rv->Assign(11, proc_ntp_timestamp(${nsm.receive_ts})); rv->Assign(12, proc_ntp_timestamp(${nsm.transmit_ts})); - rv->Assign(15, new Val((uint32) ${nsm.extensions}->size(), TYPE_COUNT)); + rv->Assign(15, val_mgr->GetCount((uint32) ${nsm.extensions}->size())); return rv; %} @@ -73,15 +77,15 @@ refine flow NTP_Flow += { %{ RecordVal* rv = new RecordVal(BifType::Record::NTP::control); - rv->Assign(0, new Val(${ncm.OpCode}, TYPE_COUNT)); - rv->Assign(1, new Val(${ncm.R}, TYPE_BOOL)); - rv->Assign(2, new Val(${ncm.E}, TYPE_BOOL)); - rv->Assign(3, new Val(${ncm.M}, TYPE_BOOL)); - rv->Assign(4, new Val(${ncm.sequence}, TYPE_COUNT)); - rv->Assign(5, new Val(${ncm.status}, TYPE_COUNT)); - rv->Assign(6, new Val(${ncm.association_id}, TYPE_COUNT)); - rv->Assign(7, new Val(${ncm.offs}, TYPE_COUNT)); - rv->Assign(8, new Val(${ncm.c}, TYPE_COUNT)); + rv->Assign(0, val_mgr->GetCount(${ncm.OpCode})); + rv->Assign(1, val_mgr->GetBool(${ncm.R})); + rv->Assign(2, val_mgr->GetBool(${ncm.E})); + rv->Assign(3, val_mgr->GetBool(${ncm.M})); + rv->Assign(4, val_mgr->GetCount(${ncm.sequence})); + rv->Assign(5, val_mgr->GetCount(${ncm.status})); + rv->Assign(6, val_mgr->GetCount(${ncm.association_id})); + rv->Assign(7, val_mgr->GetCount(${ncm.offs})); + rv->Assign(8, val_mgr->GetCount(${ncm.c})); rv->Assign(9, bytestring_to_val(${ncm.data})); return rv; @@ -92,11 +96,11 @@ refine flow NTP_Flow += { %{ RecordVal* rv = new RecordVal(BifType::Record::NTP::mode7); - rv->Assign(0, new Val(${m7.request_code}, TYPE_COUNT)); - rv->Assign(1, new Val(${m7.auth_bit}, TYPE_BOOL)); - rv->Assign(2, new Val(${m7.sequence}, TYPE_COUNT)); - rv->Assign(3, new Val(${m7.implementation}, TYPE_COUNT)); - rv->Assign(4, new Val(${m7.error_code}, TYPE_COUNT)); + rv->Assign(0, val_mgr->GetCount(${m7.request_code})); + rv->Assign(1, val_mgr->GetBool(${m7.auth_bit})); + rv->Assign(2, val_mgr->GetCount(${m7.sequence})); + rv->Assign(3, val_mgr->GetCount(${m7.implementation})); + rv->Assign(4, val_mgr->GetCount(${m7.error_code})); rv->Assign(5, bytestring_to_val(${m7.data})); return rv; @@ -108,8 +112,8 @@ refine flow NTP_Flow += { RecordVal* rv = new RecordVal(BifType::Record::NTP::Message); - rv->Assign(0, new Val(${msg.version}, TYPE_COUNT)); - rv->Assign(1, new Val(${msg.mode}, TYPE_COUNT)); + rv->Assign(0, val_mgr->GetCount(${msg.version})); + rv->Assign(1, val_mgr->GetCount(${msg.mode})); // The standard record if ( ${msg.mode}>0 && ${msg.mode}<6 ) { From 208768c0e928c28330e76049568e57f67d35e154 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Tue, 4 Jun 2019 16:09:32 +0200 Subject: [PATCH 09/25] add ntp records to init-bare.zeek --- scripts/base/init-bare.zeek | 143 ++++++++++++++++++++++++++++++++++++ 1 file changed, 143 insertions(+) diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index cebd952abc..42e0eea538 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -4979,6 +4979,149 @@ export { const max_frame_size = 65536 &redef; } +module NTP; + +export { + + ## NTP standard message as defined in :rfc:`5905` for mode=1-5 + ## This record contains the standard fields used by the NTP protocol + ## for standard syncronization operations. + type NTP::std: record { + ## The stratum (primary server, secondary server, etc.) + stratum: count; + ## The maximum interval between successive messages + poll: interval; + ## The precision of the system clock + precision: interval; + ## Total round-trip delay to the reference clock + root_delay: interval; + ## Total dispersion to the reference clock + root_disp: interval; + ## For stratum 0, 4 character string used for debugging + kiss_code: string &optional; + ## For stratum 1, ID assigned to the reference clock by IANA + ref_id: string &optional; + ## Above stratum 1, when using IPv4, the IP address of the reference clock + ref_addr: addr &optional; + ## Above stratum 1, when using IPv6, the first four bytes of the MD5 hash of the + ## IPv6 address of the reference clock + ref_v6_hash_prefix: string &optional; + ## Time when the system clock was last set or correct + ref_time: time; + ## Time at the client when the request departed for the NTP server + org_time: time; + ## Time at the server when the request arrived from the NTP client + rec_time: time; + ## Time at the server when the response departed for the NTP client + xmt_time: time; + ## Key used to designate a secret MD5 key + key_id: count &optional; + ## MD5 hash computed over the key followed by the NTP packet header and extension fields + digest: string &optional; + ## Number of extension fields (which are not currently parsed) + num_exts: count &default=0; + }; + + ## NTP control message as defined in :rfc:`1119` for mode=6 + ## This record contains the fields used by the NTP protocol + ## for control operations. + type NTP::control: record { + ## An integer specifying the command function. Values currently defined includes: + ## 1 read status command/response + ## 2 read variables command/response + ## 3 write variables command/response + ## 4 read clock variables command/response + ## 5 write clock variables command/response + ## 6 set trap address/port command/response + ## 7 trap response + ## Other values are reserved. + OpCode : count; + ## The response bit. Set to zero for commands, one for responses. + resp_bit : bool; + ## The error bit. Set to zero for normal response, one for error response. + err_bit : bool; + ## The more bit. Set to zero for last fragment, one for all others. + more_bit : bool; + ## The sequence number of the command or response + sequence : count; + ## The current status of the system, peer or clock + status : count; #TODO: this must be further specified + ## A 16-bit integer identifying a valid association + association_id : count; + ## A 16-bit integer indicating the offset, in octets, of the first octet in the data area + offs : count; + ## A 16-bit integer indicating the length of the data field, in octets + c : count; + ## The message data for the command or response + Authenticator (optional) + data : string &optional; # TODO: distinguish data and authenticator + }; + + ## NTP mode7 message for mode=7. Note that this is not defined in any RFC + ## and is implementation dependent. We used the official implementation from + ## the NTP official project (www.ntp.org). + ## A mode 7 packet is used exchanging data between an NTP server + ## and a client for purposes other than time synchronization, e.g. + ## monitoring, statistics gathering and configuration. + ## For details see the documentation from the NTP official project (www.ntp.org), + ## code v. ntp-4.2.8p13, in include/ntp_request.h. + type NTP::mode7: record { + ## An implementation-specific code which specifies the + ## operation to be (which has been) performed and/or the + ## format and semantics of the data included in the packet. + ReqCode : count; + ## The authenticated bit. If set, this packet is authenticated. + auth_bit : bool; + ## For a multipacket response, contains the sequence + ## number of this packet. 0 is the first in the sequence, + ## 127 (or less) is the last. The More Bit must be set in + ## all packets but the last. + sequence : count; + ## The number of the implementation this request code + ## is defined by. An implementation number of zero is used + ## for requst codes/data formats which all implementations + ## agree on. Implementation number 255 is reserved (for + ## extensions, in case we run out). + implementation : count; + ## Must be 0 for a request. For a response, holds an error + ## code relating to the request. If nonzero, the operation + ## requested wasn't performed. + ## + ## 0 - no error + ## 1 - incompatible implementation number + ## 2 - unimplemented request code + ## 3 - format error (wrong data items, data size, packet size etc.) + ## 4 - no data available (e.g. request for details on unknown peer) + ## 5-6 I don't know + ## 7 - authentication failure (i.e. permission denied) + err : count; + ## Rest of data + data : string &optional; # TODO: can be further parsed + }; + + ## NTP message as defined in :rfc:`5905`. + ## Doesn't include fields for mode 7 (reserved for private use), e.g. monlist + type NTP::Message: record { + ## The NTP version number (1, 2, 3, 4) + version: count; + ## The NTP mode being used + mode: count; + ## If mode=1-5, the standard fields for syncronization operations are here. + ## See :rfc:`5905` + std_msg: NTP::std &optional; + ## If mode=6, the fields for control operations are here. + ## See :rfc:`1119` + control_msg: NTP::control &optional; + ## If mode=7, the fields for extra operations are here. + ## Note that this is not defined in any RFC + ## and is implementation dependent. We used the official implementation from + ## the NTP official project (www.ntp.org). + ## A mode 7 packet is used exchanging data between an NTP server + ## and a client for purposes other than time synchronization, e.g. + ## monitoring, statistics gathering and configuration. + mode7_msg: NTP::mode7 &optional; + }; +} + module Cluster; export { type Cluster::Pool: record {}; From 75b7be302f044752f7e7146ca66c36059c695974 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Tue, 4 Jun 2019 17:10:57 +0200 Subject: [PATCH 10/25] fix problem with time vals --- aux/broker | 2 +- aux/btest | 2 +- aux/netcontrol-connectors | 2 +- doc | 2 +- src/analyzer/protocol/ntp/ntp-analyzer.pac | 12 +++++------- 5 files changed, 9 insertions(+), 11 deletions(-) diff --git a/aux/broker b/aux/broker index 474a6d902b..bfefac3a88 160000 --- a/aux/broker +++ b/aux/broker @@ -1 +1 @@ -Subproject commit 474a6d902b1c41912b216c06a74085ff3b102bad +Subproject commit bfefac3a882b382bfb7ad749974930884da954a6 diff --git a/aux/btest b/aux/btest index 6ece47ba64..539c2d8253 160000 --- a/aux/btest +++ b/aux/btest @@ -1 +1 @@ -Subproject commit 6ece47ba6438e7a6db5c7b85a68b3c16f0911871 +Subproject commit 539c2d82534345c62ba9a20c2e98ea5cbdea9c7e diff --git a/aux/netcontrol-connectors b/aux/netcontrol-connectors index e93235aa6e..6501fef1ff 160000 --- a/aux/netcontrol-connectors +++ b/aux/netcontrol-connectors @@ -1 +1 @@ -Subproject commit e93235aa6e45820af7e23e97627845a7b2b3d919 +Subproject commit 6501fef1fffc0b49dda59b3716b03034edcfeee6 diff --git a/doc b/doc index 3db2ff8fa6..7f64a90d86 160000 --- a/doc +++ b/doc @@ -1 +1 @@ -Subproject commit 3db2ff8fa65f5acb3f7807a0302d5c81db1e2227 +Subproject commit 7f64a90d86fc53506f93fb4c327fdb8c4e3aab0a diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index ed9284ef85..8a94db1d18 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -17,17 +17,15 @@ Val* proc_ntp_short(const NTP_Short_Time* t) { if ( t->seconds() == 0 && t->fractions() == 0 ) - return new IntervalVal(0.0, Milliseconds); - return new IntervalVal((double)ntohl(t->seconds() + t->fractions()*FRAC_16), Milliseconds); - //return new IntervalVal((double)ntohs(t->seconds() + t->fractions()*FRAC_16), Seconds); + return new Val(0.0, TYPE_INTERVAL); + return new Val(t->seconds() + t->fractions()*FRAC_16, TYPE_INTERVAL); } Val* proc_ntp_timestamp(const NTP_Time* t) { if ( t->seconds() == 0 && t->fractions() == 0) return new Val(0.0, TYPE_TIME); - return new IntervalVal((double)ntohl(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32), Milliseconds); - //return new IntervalVal((double)ntohs(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32), Seconds); + return new Val(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32, TYPE_TIME); } %} @@ -40,8 +38,8 @@ refine flow NTP_Flow += { RecordVal* rv = new RecordVal(BifType::Record::NTP::std); rv->Assign(0, val_mgr->GetCount(${nsm.stratum})); - rv->Assign(1, new IntervalVal(pow(2, ${nsm.poll}), Milliseconds)); - rv->Assign(2, new IntervalVal(pow(2, ${nsm.precision}), Milliseconds)); + rv->Assign(1, new Val(pow(2, ${nsm.poll}), TYPE_INTERVAL)); + rv->Assign(2, new Val(pow(2, ${nsm.precision}), TYPE_INTERVAL)); rv->Assign(3, proc_ntp_short(${nsm.root_delay})); rv->Assign(4, proc_ntp_short(${nsm.root_dispersion})); From 50f265353bb47c8e54a3daa5f5c7d4f21622423b Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Tue, 4 Jun 2019 17:59:18 +0200 Subject: [PATCH 11/25] add tests for ntp protocol (WIP) --- .../scripts.base.protocols.ntp.ntp/.stdout | 16 +++++++ .../scripts.base.protocols.ntp.ntp/ntp.log | 25 +++++++++++ .../scripts.base.protocols.ntp.ntp2/.stdout | 18 ++++++++ .../scripts.base.protocols.ntp.ntp2/ntp.log | 27 ++++++++++++ .../scripts.base.protocols.ntp.ntp3/.stdout | 30 ++++++++++++++ .../scripts.base.protocols.ntp.ntp3/ntp.log | 39 ++++++++++++++++++ testing/btest/Traces/ntp/NTP_sync.pcap | Bin 0 -> 3851 bytes testing/btest/Traces/ntp/ntp.pcap | Bin 0 -> 3416 bytes testing/btest/Traces/ntp/ntp2.pcap | Bin 0 -> 3734 bytes testing/btest/Traces/ntp/ntpmode67.pcap | Bin 0 -> 1194 bytes .../btest/scripts/base/protocols/ntp/ntp.test | 11 +++++ .../scripts/base/protocols/ntp/ntp2.test | 11 +++++ .../scripts/base/protocols/ntp/ntp3.test | 11 +++++ .../scripts/base/protocols/ntp/ntpmode67.test | 9 ++++ 14 files changed, 197 insertions(+) create mode 100644 testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout create mode 100644 testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log create mode 100644 testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout create mode 100644 testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log create mode 100644 testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/.stdout create mode 100644 testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log create mode 100644 testing/btest/Traces/ntp/NTP_sync.pcap create mode 100644 testing/btest/Traces/ntp/ntp.pcap create mode 100644 testing/btest/Traces/ntp/ntp2.pcap create mode 100644 testing/btest/Traces/ntp/ntpmode67.pcap create mode 100644 testing/btest/scripts/base/protocols/ntp/ntp.test create mode 100644 testing/btest/scripts/base/protocols/ntp/ntp2.test create mode 100644 testing/btest/scripts/base/protocols/ntp/ntp3.test create mode 100644 testing/btest/scripts/base/protocols/ntp/ntpmode67.test diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout new file mode 100644 index 0000000000..01f587e829 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout @@ -0,0 +1,16 @@ +ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.048843, root_disp=0.07135, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245852.721794, org_time=1559246614.027421, rec_time=1559246614.048376, xmt_time=1559246614.048407, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.003799, root_disp=0.032959, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245541.537424, org_time=1559246617.027452, rec_time=1559246617.040799, xmt_time=1559246617.040813, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.040375, root_disp=0.001266, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246560.207644, org_time=1559246619.027384, rec_time=1559246619.054018, xmt_time=1559246619.054053, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.003235, root_disp=0.000275, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246481.481997, org_time=1559246620.027461, rec_time=1559246620.040139, xmt_time=1559246620.040206, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013397, root_disp=0.053787, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559244627.070973, org_time=1559246620.027408, rec_time=1559246620.043959, xmt_time=1559246620.043985, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000001, root_delay=0.00351, root_disp=0.036545, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245278.44239, org_time=1559246620.027475, rec_time=1559246620.048058, xmt_time=1559246620.048074, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.01091, root_disp=0.033463, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245577.265702, org_time=1559246621.027421, rec_time=1559246621.073143, xmt_time=1559246621.073172, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013733, root_disp=0.041672, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245709.302032, org_time=1559246622.027446, rec_time=1559246622.071899, xmt_time=1559246622.071924, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000002, root_delay=0.00351, root_disp=0.038559, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245178.020777, org_time=1559246622.027478, rec_time=1559246622.068521, xmt_time=1559246622.06856, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.0, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=GPS\x00, ref_time=1559246622.0, org_time=1559246622.027384, rec_time=1559246622.073734, xmt_time=1559246622.07374, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.03743, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246622.027464, rec_time=1559246622.086267, xmt_time=1559246622.086348, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.025391, root_disp=0.011642, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246412.455332, org_time=1559246623.027478, rec_time=1559246623.041209, xmt_time=1559246623.04122, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.036835, root_disp=0.046951, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245789.870424, org_time=1559246623.027521, rec_time=1559246623.04836, xmt_time=1559246623.048416, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013535, root_disp=0.025497, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246283.180069, org_time=1559246626.027514, rec_time=1559246626.044105, xmt_time=1559246626.044139, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.037491, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246626.027432, rec_time=1559246626.058084, xmt_time=1559246626.058151, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=4, std_msg=[stratum=3, poll=64.0, precision=0.000001, root_delay=0.011765, root_disp=0.001526, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245638.390748, org_time=1559246627.027459, rec_time=1559246627.050401, xmt_time=1559246627.050438, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log new file mode 100644 index 0000000000..d5ef690ea5 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log @@ -0,0 +1,25 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path ntp +#open 2019-06-04-15-48-36 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ReqCode auth_bit sequence implementation err +#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count bool count count count +1559246614.074475 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 4 4 64.000000 0.000000 0.048843 0.071350 - - - - 1559245852.721794 1559246614.027421 1559246614.048376 1559246614.048407 - - 0 - - - - - - - - - - - - +1559246617.063504 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 4 2 64.000000 0.000000 0.003799 0.032959 - - - - 1559245541.537424 1559246617.027452 1559246617.040799 1559246617.040813 - - 0 - - - - - - - - - - - - +1559246619.074513 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 4 2 64.000000 0.000000 0.040375 0.001266 - - - - 1559246560.207644 1559246619.027384 1559246619.054018 1559246619.054053 - - 0 - - - - - - - - - - - - +1559246620.059693 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 185.19.184.35 123 4 4 2 64.000000 0.000008 0.003235 0.000275 - - - - 1559246481.481997 1559246620.027461 1559246620.040139 1559246620.040206 - - 0 - - - - - - - - - - - - +1559246620.065302 CtPZjS20MLrsMUOJi2 192.168.43.118 123 188.213.165.209 123 4 4 2 64.000000 0.000000 0.013397 0.053787 - - - - 1559244627.070973 1559246620.027408 1559246620.043959 1559246620.043985 - - 0 - - - - - - - - - - - - +1559246620.065335 CmES5u32sYpV7JYN 192.168.43.118 123 212.45.144.3 123 4 4 2 64.000000 0.000001 0.003510 0.036545 - - - - 1559245278.442390 1559246620.027475 1559246620.048058 1559246620.048074 - - 0 - - - - - - - - - - - - +1559246621.095645 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 4 2 64.000000 0.000000 0.010910 0.033463 - - - - 1559245577.265702 1559246621.027421 1559246621.073143 1559246621.073172 - - 0 - - - - - - - - - - - - +1559246622.092519 C3eiCBGOLw3VtHfOj 192.168.43.118 123 94.177.187.22 123 4 4 2 64.000000 0.000000 0.013733 0.041672 - - - - 1559245709.302032 1559246622.027446 1559246622.071899 1559246622.071924 - - 0 - - - - - - - - - - - - +1559246622.092556 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 4 2 64.000000 0.000002 0.003510 0.038559 - - - - 1559245178.020777 1559246622.027478 1559246622.068521 1559246622.068560 - - 0 - - - - - - - - - - - - +1559246622.100109 C37jN32gN3y3AZzyf6 192.168.43.118 123 85.199.214.99 123 4 4 1 16.000000 0.000000 0.000000 0.000000 - - - - 1559246622.000000 1559246622.027384 1559246622.073734 1559246622.073740 - - 0 - - - - - - - - - - - - +1559246622.100152 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 147.135.207.214 123 4 4 2 64.000000 0.000008 0.042236 0.037430 - - - - 1559245356.576177 1559246622.027464 1559246622.086267 1559246622.086348 - - 0 - - - - - - - - - - - - +1559246623.062844 CFLRIC3zaTU1loLGxh 192.168.43.118 123 93.41.196.243 123 4 4 2 64.000000 0.000000 0.025391 0.011642 - - - - 1559246412.455332 1559246623.027478 1559246623.041209 1559246623.041220 - - 0 - - - - - - - - - - - - +1559246623.070217 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.171.177 123 4 4 4 64.000000 0.000000 0.036835 0.046951 - - - - 1559245789.870424 1559246623.027521 1559246623.048360 1559246623.048416 - - 0 - - - - - - - - - - - - +1559246626.065984 C9mvWx3ezztgzcexV7 192.168.43.118 123 80.211.155.206 123 4 4 2 64.000000 0.000000 0.013535 0.025497 - - - - 1559246283.180069 1559246626.027514 1559246626.044105 1559246626.044139 - - 0 - - - - - - - - - - - - +1559246626.075079 Ck51lg1bScffFj34Ri 192.168.43.118 123 147.135.207.213 123 4 4 2 64.000000 0.000008 0.042236 0.037491 - - - - 1559245356.576177 1559246626.027432 1559246626.058084 1559246626.058151 - - 0 - - - - - - - - - - - - +1559246627.073485 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.88.132 123 3 4 3 64.000000 0.000001 0.011765 0.001526 - - - - 1559245638.390748 1559246627.027459 1559246627.050401 1559246627.050438 - - 0 - - - - - - - - - - - - +#close 2019-06-04-15-48-36 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout new file mode 100644 index 0000000000..4d29c17d7d --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout @@ -0,0 +1,18 @@ +ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.048843, root_disp=0.075409, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245852.721794, org_time=1559246885.027449, rec_time=1559246885.069212, xmt_time=1559246885.069247, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.003799, root_disp=0.037018, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245541.537424, org_time=1559246887.027425, rec_time=1559246887.050758, xmt_time=1559246887.050774, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.003235, root_disp=0.000565, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246481.481997, org_time=1559246888.030021, rec_time=1559246888.22033, xmt_time=1559246888.220401, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.040375, root_disp=0.001236, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246882.967102, org_time=1559246888.027454, rec_time=1559246888.234035, xmt_time=1559246888.234061, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000001, root_delay=0.00351, root_disp=0.040573, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245278.44239, org_time=1559246889.027449, rec_time=1559246889.061203, xmt_time=1559246889.06122, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013596, root_disp=0.025208, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246828.086879, org_time=1559246890.027523, rec_time=1559246890.060644, xmt_time=1559246890.060687, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.01091, root_disp=0.037491, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245577.265702, org_time=1559246890.027512, rec_time=1559246890.069012, xmt_time=1559246890.069048, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.0, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=GPS\x00, ref_time=1559246890.0, org_time=1559246890.027469, rec_time=1559246890.070262, xmt_time=1559246890.070268, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.025391, root_disp=0.015671, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246412.455332, org_time=1559246891.027395, rec_time=1559246891.051818, xmt_time=1559246891.051827, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013657, root_disp=0.025818, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246788.670839, org_time=1559246891.029953, rec_time=1559246891.061992, xmt_time=1559246891.062023, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000002, root_delay=0.00351, root_disp=0.042603, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245178.020777, org_time=1559246892.027401, rec_time=1559246892.05139, xmt_time=1559246892.051436, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.041504, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246894.027491, rec_time=1559246894.059304, xmt_time=1559246894.05938, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=4, std_msg=[stratum=3, poll=64.0, precision=0.000001, root_delay=0.011917, root_disp=0.000565, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246667.219303, org_time=1559246898.027403, rec_time=1559246898.077958, xmt_time=1559246898.078029, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.036819, root_disp=0.050842, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246822.40751, org_time=1559246898.029953, rec_time=1559246898.078347, xmt_time=1559246898.07843, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013535, root_disp=0.029602, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246283.180069, org_time=1559246900.030036, rec_time=1559246900.08881, xmt_time=1559246900.088844, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.041595, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246900.027439, rec_time=1559246900.103765, xmt_time=1559246900.103887, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=4, mode=3, std_msg=[stratum=0, poll=16.0, precision=0.015625, root_delay=1.0, root_disp=1.0, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1101309131.444112, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.000122, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=CTD\x00, ref_time=1559246910.937978, org_time=1101309131.444112, rec_time=1559246940.281161, xmt_time=1559246940.281191, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log new file mode 100644 index 0000000000..e49c170785 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log @@ -0,0 +1,27 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path ntp +#open 2019-06-04-15-48-51 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ReqCode auth_bit sequence implementation err +#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count bool count count count +1559246885.088815 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 4 4 64.000000 0.000000 0.048843 0.075409 - - - - 1559245852.721794 1559246885.027449 1559246885.069212 1559246885.069247 - - 0 - - - - - - - - - - - - +1559246887.060766 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 4 2 64.000000 0.000000 0.003799 0.037018 - - - - 1559245541.537424 1559246887.027425 1559246887.050758 1559246887.050774 - - 0 - - - - - - - - - - - - +1559246888.422200 CtPZjS20MLrsMUOJi2 192.168.43.118 123 185.19.184.35 123 4 4 2 64.000000 0.000008 0.003235 0.000565 - - - - 1559246481.481997 1559246888.030021 1559246888.220330 1559246888.220401 - - 0 - - - - - - - - - - - - +1559246888.422229 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 4 2 64.000000 0.000000 0.040375 0.001236 - - - - 1559246882.967102 1559246888.027454 1559246888.234035 1559246888.234061 - - 0 - - - - - - - - - - - - +1559246889.075261 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 212.45.144.3 123 4 4 2 64.000000 0.000001 0.003510 0.040573 - - - - 1559245278.442390 1559246889.027449 1559246889.061203 1559246889.061220 - - 0 - - - - - - - - - - - - +1559246890.076319 C37jN32gN3y3AZzyf6 192.168.43.118 123 188.213.165.209 123 4 4 2 64.000000 0.000000 0.013596 0.025208 - - - - 1559246828.086879 1559246890.027523 1559246890.060644 1559246890.060687 - - 0 - - - - - - - - - - - - +1559246890.082370 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 4 2 64.000000 0.000000 0.010910 0.037491 - - - - 1559245577.265702 1559246890.027512 1559246890.069012 1559246890.069048 - - 0 - - - - - - - - - - - - +1559246890.094824 CmES5u32sYpV7JYN 192.168.43.118 123 85.199.214.99 123 4 4 1 16.000000 0.000000 0.000000 0.000000 - - - - 1559246890.000000 1559246890.027469 1559246890.070262 1559246890.070268 - - 0 - - - - - - - - - - - - +1559246891.068733 C3eiCBGOLw3VtHfOj 192.168.43.118 123 93.41.196.243 123 4 4 2 64.000000 0.000000 0.025391 0.015671 - - - - 1559246412.455332 1559246891.027395 1559246891.051818 1559246891.051827 - - 0 - - - - - - - - - - - - +1559246891.075965 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 94.177.187.22 123 4 4 2 64.000000 0.000000 0.013657 0.025818 - - - - 1559246788.670839 1559246891.029953 1559246891.061992 1559246891.062023 - - 0 - - - - - - - - - - - - +1559246892.077560 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 4 2 64.000000 0.000002 0.003510 0.042603 - - - - 1559245178.020777 1559246892.027401 1559246892.051390 1559246892.051436 - - 0 - - - - - - - - - - - - +1559246894.070325 CFLRIC3zaTU1loLGxh 192.168.43.118 123 147.135.207.214 123 4 4 2 64.000000 0.000008 0.042236 0.041504 - - - - 1559245356.576177 1559246894.027491 1559246894.059304 1559246894.059380 - - 0 - - - - - - - - - - - - +1559246898.094782 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.88.132 123 3 4 3 64.000000 0.000001 0.011917 0.000565 - - - - 1559246667.219303 1559246898.027403 1559246898.077958 1559246898.078029 - - 0 - - - - - - - - - - - - +1559246898.094827 Ck51lg1bScffFj34Ri 192.168.43.118 123 80.211.171.177 123 4 4 4 64.000000 0.000000 0.036819 0.050842 - - - - 1559246822.407510 1559246898.029953 1559246898.078347 1559246898.078430 - - 0 - - - - - - - - - - - - +1559246900.102991 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.155.206 123 4 4 2 64.000000 0.000000 0.013535 0.029602 - - - - 1559246283.180069 1559246900.030036 1559246900.088810 1559246900.088844 - - 0 - - - - - - - - - - - - +1559246900.111834 C9mvWx3ezztgzcexV7 192.168.43.118 123 147.135.207.213 123 4 4 2 64.000000 0.000008 0.042236 0.041595 - - - - 1559245356.576177 1559246900.027439 1559246900.103765 1559246900.103887 - - 0 - - - - - - - - - - - - +1559246940.262220 C7fIlMZDuRiqjpYbb 192.168.43.118 58229 193.204.114.232 123 4 3 0 16.000000 0.015625 1.000000 1.000000 - - - - 0.000000 0.000000 0.000000 1101309131.444112 - - 0 - - - - - - - - - - - - +1559246940.304152 C7fIlMZDuRiqjpYbb 192.168.43.118 58229 193.204.114.232 123 4 4 1 16.000000 0.000000 0.000000 0.000122 - - - - 1559246910.937978 1101309131.444112 1559246940.281161 1559246940.281191 - - 0 - - - - - - - - - - - - +#close 2019-06-04-15-48-51 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/.stdout new file mode 100644 index 0000000000..f472ab8a40 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/.stdout @@ -0,0 +1,30 @@ +ntp_message 192.168.50.50 -> 67.129.68.9:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 69.44.57.60:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 207.234.209.181:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 209.132.176.4:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 216.27.185.42:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 24.34.79.42:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 24.123.202.230:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 63.164.62.249:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 64.112.189.11:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 65.125.233.206:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.33.206.5:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.33.216.11:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.92.68.246:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.111.46.200:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.115.136.4:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 69.44.57.60:123 [version=3, mode=2, std_msg=[stratum=3, poll=1024.0, precision=0.000004, root_delay=0.109238, root_disp=0.081726, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254668.551001, org_time=1096255084.922896, rec_time=1096255083.809713, xmt_time=1096255083.80976, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 24.123.202.230:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.030319, root_disp=0.185547, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096252181.259041, org_time=1096255084.922896, rec_time=1096255083.821124, xmt_time=1096255083.821134, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 67.129.68.9:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000008, root_delay=0.060455, root_disp=7.46431, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1095788645.064548, org_time=1096255084.922896, rec_time=1096255083.848508, xmt_time=1096255083.848601, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 65.125.233.206:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000031, root_delay=0.023254, root_disp=0.012848, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254901.858123, org_time=1096255084.922896, rec_time=1096255083.828025, xmt_time=1096255083.828189, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 63.164.62.249:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.015015, root_disp=0.037491, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254668.213801, org_time=1096255084.922896, rec_time=1096255083.829249, xmt_time=1096255083.829301, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 207.234.209.181:123 [version=3, mode=2, std_msg=[stratum=3, poll=1024.0, precision=0.000008, root_delay=0.072678, root_disp=0.035049, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254326.1896, org_time=1096255084.922896, rec_time=1096255083.824154, xmt_time=1096255083.824174, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.92.68.246:123 [version=3, mode=2, std_msg=[stratum=1, poll=1024.0, precision=0.000015, root_delay=0.0, root_disp=0.00032, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=GPS\x00, ref_time=1096255078.223498, org_time=1096255084.932911, rec_time=1096255083.836845, xmt_time=1096255083.83687, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 24.34.79.42:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000031, root_delay=0.123322, root_disp=0.039917, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254970.010788, org_time=1096255084.922896, rec_time=1096255083.825662, xmt_time=1096255083.825692, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.115.136.4:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000008, root_delay=0.016632, root_disp=0.028641, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254406.517429, org_time=1096255084.932911, rec_time=1096255083.853291, xmt_time=1096255083.853336, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.33.206.5:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000004, root_delay=0.01236, root_disp=0.022202, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096255027.694744, org_time=1096255084.932911, rec_time=1096255083.850895, xmt_time=1096255083.850907, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.33.216.11:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.009857, root_disp=0.043747, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254508.255586, org_time=1096255084.932911, rec_time=1096255083.850965, xmt_time=1096255083.851024, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.111.46.200:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.056396, root_disp=0.062164, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096253376.841474, org_time=1096255084.932911, rec_time=1096255083.847619, xmt_time=1096255083.847644, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 64.112.189.11:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000015, root_delay=0.081268, root_disp=0.029877, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254706.14029, org_time=1096255084.922896, rec_time=1096255083.850451, xmt_time=1096255083.850465, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 216.27.185.42:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000004, root_delay=0.029846, root_disp=0.045456, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254209.896379, org_time=1096255084.922896, rec_time=1096255083.849099, xmt_time=1096255083.849269, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 209.132.176.4:123 [version=3, mode=2, std_msg=[stratum=1, poll=1024.0, precision=0.000015, root_delay=0.0, root_disp=0.000504, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=CDMA, ref_time=1096255068.944018, org_time=1096255084.922896, rec_time=1096255083.827772, xmt_time=1096255083.828313, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log new file mode 100644 index 0000000000..c0f8be47a8 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log @@ -0,0 +1,39 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path ntp +#open 2019-06-04-15-48-57 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ReqCode auth_bit sequence implementation err +#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count bool count count count +1096255084.954975 ClEkJM2Vm5giqnMf4h 192.168.50.50 123 67.129.68.9 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - +1096255084.955306 C4J4Th3PJpwUYZZ6gc 192.168.50.50 123 69.44.57.60 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - +1096255084.955760 CtPZjS20MLrsMUOJi2 192.168.50.50 123 207.234.209.181 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - +1096255084.956155 CUM0KZ3MLUfNB0cl11 192.168.50.50 123 209.132.176.4 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - +1096255084.956577 CmES5u32sYpV7JYN 192.168.50.50 123 216.27.185.42 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - +1096255084.956975 CP5puj4I8PtEU4qzYg 192.168.50.50 123 24.34.79.42 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - +1096255084.957457 C37jN32gN3y3AZzyf6 192.168.50.50 123 24.123.202.230 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - +1096255084.957903 C3eiCBGOLw3VtHfOj 192.168.50.50 123 63.164.62.249 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - +1096255084.958625 CwjjYJ2WqgTbAqiHl6 192.168.50.50 123 64.112.189.11 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - +1096255084.959273 C0LAHyvtKSQHyJxIl 192.168.50.50 123 65.125.233.206 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - +1096255084.960065 CFLRIC3zaTU1loLGxh 192.168.50.50 123 66.33.206.5 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - +1096255084.960866 C9rXSW3KSpTYvPrlI1 192.168.50.50 123 66.33.216.11 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - +1096255084.961475 Ck51lg1bScffFj34Ri 192.168.50.50 123 66.92.68.246 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - +1096255084.962222 C9mvWx3ezztgzcexV7 192.168.50.50 123 66.111.46.200 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - +1096255084.962915 CNnMIj2QSd84NKf7U3 192.168.50.50 123 66.115.136.4 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - +1096255085.012029 C4J4Th3PJpwUYZZ6gc 192.168.50.50 123 69.44.57.60 123 3 2 3 1024.000000 0.000004 0.109238 0.081726 - - - - 1096254668.551001 1096255084.922896 1096255083.809713 1096255083.809760 - - 0 - - - - - - - - - - - - +1096255085.049280 C37jN32gN3y3AZzyf6 192.168.50.50 123 24.123.202.230 123 3 2 2 1024.000000 0.000001 0.030319 0.185547 - - - - 1096252181.259041 1096255084.922896 1096255083.821124 1096255083.821134 - - 0 - - - - - - - - - - - - +1096255085.092991 ClEkJM2Vm5giqnMf4h 192.168.50.50 123 67.129.68.9 123 3 2 2 1024.000000 0.000008 0.060455 7.464310 - - - - 1095788645.064548 1096255084.922896 1096255083.848508 1096255083.848601 - - 0 - - - - - - - - - - - - +1096255085.120557 C0LAHyvtKSQHyJxIl 192.168.50.50 123 65.125.233.206 123 3 2 2 1024.000000 0.000031 0.023254 0.012848 - - - - 1096254901.858123 1096255084.922896 1096255083.828025 1096255083.828189 - - 0 - - - - - - - - - - - - +1096255085.185955 C3eiCBGOLw3VtHfOj 192.168.50.50 123 63.164.62.249 123 3 2 2 1024.000000 0.000001 0.015015 0.037491 - - - - 1096254668.213801 1096255084.922896 1096255083.829249 1096255083.829301 - - 0 - - - - - - - - - - - - +1096255085.223026 CtPZjS20MLrsMUOJi2 192.168.50.50 123 207.234.209.181 123 3 2 3 1024.000000 0.000008 0.072678 0.035049 - - - - 1096254326.189600 1096255084.922896 1096255083.824154 1096255083.824174 - - 0 - - - - - - - - - - - - +1096255085.280949 Ck51lg1bScffFj34Ri 192.168.50.50 123 66.92.68.246 123 3 2 1 1024.000000 0.000015 0.000000 0.000320 - - - - 1096255078.223498 1096255084.932911 1096255083.836845 1096255083.836870 - - 0 - - - - - - - - - - - - +1096255085.304774 CP5puj4I8PtEU4qzYg 192.168.50.50 123 24.34.79.42 123 3 2 2 1024.000000 0.000031 0.123322 0.039917 - - - - 1096254970.010788 1096255084.922896 1096255083.825662 1096255083.825692 - - 0 - - - - - - - - - - - - +1096255085.353360 CNnMIj2QSd84NKf7U3 192.168.50.50 123 66.115.136.4 123 3 2 2 1024.000000 0.000008 0.016632 0.028641 - - - - 1096254406.517429 1096255084.932911 1096255083.853291 1096255083.853336 - - 0 - - - - - - - - - - - - +1096255085.406368 CFLRIC3zaTU1loLGxh 192.168.50.50 123 66.33.206.5 123 3 2 2 1024.000000 0.000004 0.012360 0.022202 - - - - 1096255027.694744 1096255084.932911 1096255083.850895 1096255083.850907 - - 0 - - - - - - - - - - - - +1096255085.439833 C9rXSW3KSpTYvPrlI1 192.168.50.50 123 66.33.216.11 123 3 2 2 1024.000000 0.000001 0.009857 0.043747 - - - - 1096254508.255586 1096255084.932911 1096255083.850965 1096255083.851024 - - 0 - - - - - - - - - - - - +1096255085.480955 C9mvWx3ezztgzcexV7 192.168.50.50 123 66.111.46.200 123 3 2 2 1024.000000 0.000001 0.056396 0.062164 - - - - 1096253376.841474 1096255084.932911 1096255083.847619 1096255083.847644 - - 0 - - - - - - - - - - - - +1096255085.522297 CwjjYJ2WqgTbAqiHl6 192.168.50.50 123 64.112.189.11 123 3 2 2 1024.000000 0.000015 0.081268 0.029877 - - - - 1096254706.140290 1096255084.922896 1096255083.850451 1096255083.850465 - - 0 - - - - - - - - - - - - +1096255085.562197 CmES5u32sYpV7JYN 192.168.50.50 123 216.27.185.42 123 3 2 2 1024.000000 0.000004 0.029846 0.045456 - - - - 1096254209.896379 1096255084.922896 1096255083.849099 1096255083.849269 - - 0 - - - - - - - - - - - - +1096255085.599961 CUM0KZ3MLUfNB0cl11 192.168.50.50 123 209.132.176.4 123 3 2 1 1024.000000 0.000015 0.000000 0.000504 - - - - 1096255068.944018 1096255084.922896 1096255083.827772 1096255083.828313 - - 0 - - - - - - - - - - - - +#close 2019-06-04-15-48-57 diff --git a/testing/btest/Traces/ntp/NTP_sync.pcap b/testing/btest/Traces/ntp/NTP_sync.pcap new file mode 100644 index 0000000000000000000000000000000000000000..997d9fbf5a658bf09d0b38e05c0273255abc6148 GIT binary patch literal 3851 zcmbW)2~ZPP7y#gZH-UsmgNxvxcnmnzqKF)#c#;GJu|X(kTOG$5AYOzdO@arsok$(j zY3X50TdU4UMT^yXwP>r=k|K^{8L8ay8tqiZBK4}ZfED`ww-A<(dDWj-}X*jB&!`vqZJ6Li6&f4jNg z_ccr6AN9L#3Om=YZQU%DrlzE5`))3au@7zpUy0EgAJ9ScCW~#oZLNvTTq(RBAlI$Y8*RB3og!mpj&=hLg;|8mOUVy!<>tEB=!v8 zA&{PrnBj@J^4eA$A8jLtI%K?mUm*F;E+Q;`HN|ex& z+BA2zqV&~AqEZ}6KL(glWo4*M4wEdi;r~L}s#`JK2sB zP5@r&s&hvw`Ak$wKy8)qS9QH7LTM7 zSq^w<$76S-nw_Fj5=y79ql60$FEJJFNF}>OrFkf+=(>wb7%vsva7PN+Eh>?H#m@PL zV@$X>^3p=L#!06SPTkBjTq82}iAu>RjY;OE=AOIff88Ca za=)lFAEjessYJF4KBlr0?nnm@ib^RcRja5(HX&X*-QbRtc|=r7Maj}lC9=KolD_y^ zr5rL&Pr~>egYFu%Z0V~oKpUB$f=OIi04)kgR`8P7tHULVI{<-y1NgPQbkKghij`=K zl*@na-6hERc1_Zv7JAkib5OEZh)Dn{2vESUF0y(T({i#bz^oJ7NEr1_Q})6-?ynLTTaSk|sP)q`LqsY+BN|q>-IOx)0#-5I{1opyuH{(qr`H zuOGAtrMeDFB1-krh*KzKHnIc71fU%{R|R3*nH#jYa!Kqq{_aVd0lc>Peh8y*oTi-I z_nuIyPulk>m6ClKlpq1=hFv@CQ<0cw&F>4MO zY9Biepj7*Wi$N(jN%|CNGFNS*1)fW)4jaxW?)4NY{)wsSKzeMMHg$XqO1S!<&^Ti~ zf1WkMfl}e#r%7SlgFITgx+HcoKTe~!0w`kM&Sn&(=RCF&wxfi#5K47Ri%IsA^Rgm2 zN~u{M1I5&nd*NJBtcJ|mzAR5S@wq1@HJWT8pAl@r#x>K2q0}4GrPmWzqjbqOJqx8} zQJx~wf-f;69^Rtmvn!^UcZo!1u4FvPze5$?L;OgO-yFGgnvPSiT zJzoV;+-->lOMI7f_A)Oi&1Ckr@@qtws%dqTQYbY)dEXnQ=I+Qml%}@QW^Cq&&zh$3X+rH&a9NaFojeX2TZ zB$Ij1=SUGf-7W%8{e-B%Ft^~&-VdRFw@iFDC|@C zEu@^j{>9INr-auWJWX@*v`BfbdoB3Y8309ww;rvHJY7$)hvuaV?;4@svC4gLZt zt%^Z1^Fd2`fME8hpZAoKxa09iTFfL#MkA?rEs`J=E<@QXWss6pMb;1?B)bJoSr& z23e%1cabD}fjtsQXDmV@TyhA}UJyuMwdu#ltfM683#!`q+h(fa`+h-ED3f$(HqKM2 z0V^kxCK-YB0Q__l;+g`a-mbD^mR#d1Om#U2)k4+8Z}g`+ubhkoQaH0u_ua5hXC@-W zSGP4!=u^=XhdzZmWzVcXkUItlX3t2QH)sXyy~{|dSk0QJloFh$6f06hPqVv)>Peen zM|?K4BeqA#HF5TnQT39hn6L z`);q~q%}{G#C~do1|sS2n@F0(R7D)+APx1^T z-BTfHcYbS!KuWmCBDr6kFcV4MZ~Is&iR*iYq*Ny9F(tjoMiS)jsz6G#GDyj)y_!ZK zB=hxM@sy;zR*R%%S*%3(ev9+uC&S7iO(5kAKq6q`UADlMJt`!^rj1V=?4&0{wNUlT z22!YIl~Gb5lcYL8NDx1%8~uo+!sS4EI5bapgn9aAK%Q8ES*zs011kSXSs>LN<7c2J zZ9dCW9-Q|+-|!yhOC$xh1W05(K%%cXrUe8~#1E7NSwq!#g<>*5_f;S%j7jngBxEA* zH;8EvNmp>5VDG7}!Hy_y=OkNTN7U}#G;cm7K>|=c+>6&x_3pmm3#1%oA|&u6H1gvf zAti0x`QL>;>9#r~V!HD@DJORZ0U=fU(mfKiic>acA?Z^lX*faBj3^|T+K$!Sjxw}7**z>e22dn2UM~bO!@fM*^#b-u{zcpq#^(kGoWZJJlNO#-m zsRga(xWeN|()zMI?Kj{vcep1~L{CixJ}!8VaB+bJWW{?E+{-UomAV`DlTkH2!|)eC JwWe>I$A6bF*b4vv literal 0 HcmV?d00001 diff --git a/testing/btest/Traces/ntp/ntp2.pcap b/testing/btest/Traces/ntp/ntp2.pcap new file mode 100644 index 0000000000000000000000000000000000000000..d242cc5c54a1443ccb12f06ec62caf736276a050 GIT binary patch literal 3734 zcma)h17**83kPeBaqPq<&r50 zOuBe0Z^&xG3W$l4kz#`e3RoHtfhC9+Mn_2ot@k~L?d+^G-*lL>5Btye+vj=T@7CU^ z|Js}g3I7O*8GLb746RtYhL9NeAK(1+-JxGu?yYULbeLp8-mN3yy-x#30P|^?U1@G6oGJ zqcUgy2xj#=&zaMJ6h`$V_d`#&Es@ghS+tBJMLjg~G~dKiygXM>3xs&PF0nc2F^MQr zj-z$XvYdL((@t+APyQyJl-A0CLLeyZg3NA$mP;glfk+BZ=RLjJ z5n-p1RMdl{v$l0pI8y8Z3Q1+v-7y^qD(gJ=8!YKm>IEbzG-66eXc+8>3}2-1>FqoU z={X%w1i4(Rs@jQ%!5ss98Wr11*Abj#w`WX zqDD>8Lm2U!;o{+8mIP^``VG`Ju{xNt*&RqR)H-c>1Jg^)LJD++V66A{7^Szsq)sYX z_j3UdR7~a4C!ohA;=V#8y>O+?r|Z99@2$y13h(LmL-2GT{QL#Jl#pJ3kG3*S6Ofi< z7#UTr6HR9Igj1gfkP@h#bPeb!o$Uzx?VKmaVk1xQn0Qj#^m|SKg4%Iq(`nEOiN(Cf zNXn*?@{5r4rXKw`%eH26q@p1TDM7mJP&E(|nCdGQENQ&R9ZC6A(!53_Rjou)eaDgO z94S&xAtgGW^ZFeKiD9*iuX3b|T}X2Fpw&sG#4i6b11Wr+${4Qq1X+ZL)3`d-uC@0+ zmuVOoRle<`GFA(GMv?SGAdS?Ui(THHj>++)xtScvyct%bJ!7j;L9oawoFj?cQJIQn zTwyDilWw6%Qm4{Lx&}hlF?qYO>O85e)WuAA7kZCf^)L{UtVdfDS&~k497)+$wDf)pCS*OcYBKua({mI;onX%u zZze=2;ObO;HLd7Si@^h`G-xQA)!@RpNILIEBk7~D_jah!4^O%h0VLR;1e<`imm}2% z>+0?A7(AfLyX(AJ?Ya1329O-6b=soB^i*o3z>4%Um)@dyqx1qz>ZF#RKA8pt^@Q1V z<3LYH1dUoG{q05b)SF4j3}(3%Qg~0L=n3{}cHQge=F_PW(V~60^RXkNN~aAvvg*-i z?FFP9swaIvdU`t-DaCm$H^S|>E4A;F=bI=c;-kfA70q%qXDRhM^o-yDI z+pKW$Uup1wYWq|sWA%CE4J56hlC*(1pBn3<+H_SsX-hJ9hP6y4L@EqjEyP_yrH=j_ z>!g=}2UI&*Deg~tJKJaHeSkzi!|p1_^gg(R6zGbMvEI96lwPPwoivQj-6w*3r%fN>~SjSvzfwL`;DpMMf6uFDm<*|1$ zJ^4sfTba?!?P`QBAA~x60(XrPZst~pdA&x$3?rl3*Zb*Ny^xlTq}$ar(isPwPdPG7 zj<1uCr_p>mYBHbLw2&~dDCQ8WyO(vX08%*ItMKlGugPf{ZZ!_}g!nQG>yU!Ky)PXq zrAWx`Bf=5(3WnD(%5y1lN|>f9`U#R85A&o~?;0vMOt0YxQaDe*Qq)|7Js0m9_*ewJ zAB;QSg(2sND~6HbduPaq8=js!Lq^@BkrcaDLh&TMgB>ycp21W3RP;1?k^>QVaG?M9 F`7f+)NZSAa literal 0 HcmV?d00001 diff --git a/testing/btest/Traces/ntp/ntpmode67.pcap b/testing/btest/Traces/ntp/ntpmode67.pcap new file mode 100644 index 0000000000000000000000000000000000000000..ca0a8ca105eb384ddf6b6eec4bd9b3ef10639dfb GIT binary patch literal 1194 zcmca|c+)~A1{MYcU}0bca<-&Ci@6iP!e9nugD^7SU~pw%(BORRz~CTg^q`)Bff0n~ zJ2F%=i2PF*V+0!j)&Mf)VK81(o`OxehhYj60}}&-*L#pLAXD;V@tX1mY|3>krZ59d z`2aHIAkdU(ekO)jKsE>?1F(7H41v1<8;F$ACV+D8+-v z=VH1bpQ}EC`Fy(@+~- %s:%d %s", c$id$orig_h, c$id$resp_h, c$id$resp_p, msg); +} + diff --git a/testing/btest/scripts/base/protocols/ntp/ntp2.test b/testing/btest/scripts/base/protocols/ntp/ntp2.test new file mode 100644 index 0000000000..b59363e90e --- /dev/null +++ b/testing/btest/scripts/base/protocols/ntp/ntp2.test @@ -0,0 +1,11 @@ +# @TEST-EXEC: bro -r $TRACES/ntp/ntp2.pcap %INPUT +# @TEST-EXEC: btest-diff ntp.log +# @TEST-EXEC: btest-diff .stdout + +@load base/protocols/ntp + +event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) +{ + print fmt("ntp_message %s -> %s:%d %s", c$id$orig_h, c$id$resp_h, c$id$resp_p, msg); +} + diff --git a/testing/btest/scripts/base/protocols/ntp/ntp3.test b/testing/btest/scripts/base/protocols/ntp/ntp3.test new file mode 100644 index 0000000000..01feb9ed3b --- /dev/null +++ b/testing/btest/scripts/base/protocols/ntp/ntp3.test @@ -0,0 +1,11 @@ +# @TEST-EXEC: bro -r $TRACES/ntp/NTP_sync.pcap %INPUT +# @TEST-EXEC: btest-diff ntp.log +# @TEST-EXEC: btest-diff .stdout + +@load base/protocols/ntp + +event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) +{ + print fmt("ntp_message %s -> %s:%d %s", c$id$orig_h, c$id$resp_h, c$id$resp_p, msg); +} + diff --git a/testing/btest/scripts/base/protocols/ntp/ntpmode67.test b/testing/btest/scripts/base/protocols/ntp/ntpmode67.test new file mode 100644 index 0000000000..b2100ae840 --- /dev/null +++ b/testing/btest/scripts/base/protocols/ntp/ntpmode67.test @@ -0,0 +1,9 @@ +# @TEST-EXEC: bro -r $TRACES/ntp/ntpmode67.pcap %INPUT + +@load base/protocols/ntp + +event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) +{ + print fmt("ntp_message %s -> %s:%d %s", c$id$orig_h, c$id$resp_h, c$id$resp_p, msg); +} + From 48cda6a81dd1255403d32dd29a635a922c647849 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Wed, 5 Jun 2019 11:17:40 +0200 Subject: [PATCH 12/25] add tests for ntp protocol (finished) --- .../scripts.base.protocols.ntp.ntp/.stdout | 16 ++++++++++++++ .../scripts.base.protocols.ntp.ntp/ntp.log | 20 ++++++++++++++++-- .../scripts.base.protocols.ntp.ntp2/.stdout | 17 +++++++++++++++ .../scripts.base.protocols.ntp.ntp2/ntp.log | 21 +++++++++++++++++-- .../scripts.base.protocols.ntp.ntp3/ntp.log | 4 ++-- .../.stdout | 9 ++++++++ .../ntp.log | 18 ++++++++++++++++ .../btest/scripts/base/protocols/ntp/ntp.test | 2 +- .../scripts/base/protocols/ntp/ntp2.test | 2 +- .../scripts/base/protocols/ntp/ntp3.test | 2 +- .../scripts/base/protocols/ntp/ntpmode67.test | 4 +++- 11 files changed, 105 insertions(+), 10 deletions(-) create mode 100644 testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout create mode 100644 testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout index 01f587e829..ffb4b4f91d 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout @@ -1,16 +1,32 @@ +ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02417, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246548.048352, rec_time=1559246548.076756, xmt_time=1559246614.027421, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.048843, root_disp=0.07135, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245852.721794, org_time=1559246614.027421, rec_time=1559246614.048376, xmt_time=1559246614.048407, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024216, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246550.040662, rec_time=1559246550.063198, xmt_time=1559246617.027452, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.003799, root_disp=0.032959, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245541.537424, org_time=1559246617.027452, rec_time=1559246617.040799, xmt_time=1559246617.040813, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024246, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.074199, rec_time=1559246553.094855, xmt_time=1559246619.027384, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.040375, root_disp=0.001266, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246560.207644, org_time=1559246619.027384, rec_time=1559246619.054018, xmt_time=1559246619.054053, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024261, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246551.034239, rec_time=1559246551.058223, xmt_time=1559246620.027408, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024261, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.067084, rec_time=1559246553.088704, xmt_time=1559246620.027461, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024261, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246554.041266, rec_time=1559246554.063055, xmt_time=1559246620.027475, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.003235, root_disp=0.000275, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246481.481997, org_time=1559246620.027461, rec_time=1559246620.040139, xmt_time=1559246620.040206, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013397, root_disp=0.053787, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559244627.070973, org_time=1559246620.027408, rec_time=1559246620.043959, xmt_time=1559246620.043985, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000001, root_delay=0.00351, root_disp=0.036545, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245278.44239, org_time=1559246620.027475, rec_time=1559246620.048058, xmt_time=1559246620.048074, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024277, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.072776, rec_time=1559246553.094814, xmt_time=1559246621.027421, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.01091, root_disp=0.033463, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245577.265702, org_time=1559246621.027421, rec_time=1559246621.073143, xmt_time=1559246621.073172, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246556.043833, rec_time=1559246556.073681, xmt_time=1559246622.027384, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.078959, rec_time=1559246553.100708, xmt_time=1559246622.027446, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.085177, rec_time=1559246553.102587, xmt_time=1559246622.027464, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246554.041367, rec_time=1559246554.069181, xmt_time=1559246622.027478, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013733, root_disp=0.041672, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245709.302032, org_time=1559246622.027446, rec_time=1559246622.071899, xmt_time=1559246622.071924, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000002, root_delay=0.00351, root_disp=0.038559, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245178.020777, org_time=1559246622.027478, rec_time=1559246622.068521, xmt_time=1559246622.06856, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.0, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=GPS\x00, ref_time=1559246622.0, org_time=1559246622.027384, rec_time=1559246622.073734, xmt_time=1559246622.07374, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.03743, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246622.027464, rec_time=1559246622.086267, xmt_time=1559246622.086348, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024307, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246556.032041, rec_time=1559246556.054612, xmt_time=1559246623.027478, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024307, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246555.051459, rec_time=1559246555.077253, xmt_time=1559246623.027521, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.025391, root_disp=0.011642, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246412.455332, org_time=1559246623.027478, rec_time=1559246623.041209, xmt_time=1559246623.04122, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.036835, root_disp=0.046951, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245789.870424, org_time=1559246623.027521, rec_time=1559246623.04836, xmt_time=1559246623.048416, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024353, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246557.07812, rec_time=1559246557.097844, xmt_time=1559246626.027432, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024353, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246558.043947, rec_time=1559246558.067904, xmt_time=1559246626.027514, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013535, root_disp=0.025497, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246283.180069, org_time=1559246626.027514, rec_time=1559246626.044105, xmt_time=1559246626.044139, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.037491, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246626.027432, rec_time=1559246626.058084, xmt_time=1559246626.058151, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024368, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246560.040576, rec_time=1559246560.064668, xmt_time=1559246627.027459, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=4, std_msg=[stratum=3, poll=64.0, precision=0.000001, root_delay=0.011765, root_disp=0.001526, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245638.390748, org_time=1559246627.027459, rec_time=1559246627.050401, xmt_time=1559246627.050438, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log index d5ef690ea5..382f3f6ed7 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log @@ -3,23 +3,39 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-04-15-48-36 +#open 2019-06-05-09-15-37 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ReqCode auth_bit sequence implementation err #types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count bool count count count +1559246614.027454 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 3 2 64.000000 0.000000 0.046280 0.024170 - - - - 1559246556.073681 1559246548.048352 1559246548.076756 1559246614.027421 - - 0 - - - - - - - - - - - - 1559246614.074475 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 4 4 64.000000 0.000000 0.048843 0.071350 - - - - 1559245852.721794 1559246614.027421 1559246614.048376 1559246614.048407 - - 0 - - - - - - - - - - - - +1559246617.027486 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 3 2 64.000000 0.000000 0.046280 0.024216 - - - - 1559246556.073681 1559246550.040662 1559246550.063198 1559246617.027452 - - 0 - - - - - - - - - - - - 1559246617.063504 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 4 2 64.000000 0.000000 0.003799 0.032959 - - - - 1559245541.537424 1559246617.027452 1559246617.040799 1559246617.040813 - - 0 - - - - - - - - - - - - +1559246619.027413 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 3 2 64.000000 0.000000 0.046280 0.024246 - - - - 1559246556.073681 1559246553.074199 1559246553.094855 1559246619.027384 - - 0 - - - - - - - - - - - - 1559246619.074513 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 4 2 64.000000 0.000000 0.040375 0.001266 - - - - 1559246560.207644 1559246619.027384 1559246619.054018 1559246619.054053 - - 0 - - - - - - - - - - - - +1559246620.027437 CtPZjS20MLrsMUOJi2 192.168.43.118 123 188.213.165.209 123 4 3 2 64.000000 0.000000 0.046280 0.024261 - - - - 1559246556.073681 1559246551.034239 1559246551.058223 1559246620.027408 - - 0 - - - - - - - - - - - - +1559246620.027466 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 185.19.184.35 123 4 3 2 64.000000 0.000000 0.046280 0.024261 - - - - 1559246556.073681 1559246553.067084 1559246553.088704 1559246620.027461 - - 0 - - - - - - - - - - - - +1559246620.027480 CmES5u32sYpV7JYN 192.168.43.118 123 212.45.144.3 123 4 3 2 64.000000 0.000000 0.046280 0.024261 - - - - 1559246556.073681 1559246554.041266 1559246554.063055 1559246620.027475 - - 0 - - - - - - - - - - - - 1559246620.059693 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 185.19.184.35 123 4 4 2 64.000000 0.000008 0.003235 0.000275 - - - - 1559246481.481997 1559246620.027461 1559246620.040139 1559246620.040206 - - 0 - - - - - - - - - - - - 1559246620.065302 CtPZjS20MLrsMUOJi2 192.168.43.118 123 188.213.165.209 123 4 4 2 64.000000 0.000000 0.013397 0.053787 - - - - 1559244627.070973 1559246620.027408 1559246620.043959 1559246620.043985 - - 0 - - - - - - - - - - - - 1559246620.065335 CmES5u32sYpV7JYN 192.168.43.118 123 212.45.144.3 123 4 4 2 64.000000 0.000001 0.003510 0.036545 - - - - 1559245278.442390 1559246620.027475 1559246620.048058 1559246620.048074 - - 0 - - - - - - - - - - - - +1559246621.027458 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 3 2 64.000000 0.000000 0.046280 0.024277 - - - - 1559246556.073681 1559246553.072776 1559246553.094814 1559246621.027421 - - 0 - - - - - - - - - - - - 1559246621.095645 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 4 2 64.000000 0.000000 0.010910 0.033463 - - - - 1559245577.265702 1559246621.027421 1559246621.073143 1559246621.073172 - - 0 - - - - - - - - - - - - +1559246622.027418 C37jN32gN3y3AZzyf6 192.168.43.118 123 85.199.214.99 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - - - 1559246556.073681 1559246556.043833 1559246556.073681 1559246622.027384 - - 0 - - - - - - - - - - - - +1559246622.027454 C3eiCBGOLw3VtHfOj 192.168.43.118 123 94.177.187.22 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - - - 1559246556.073681 1559246553.078959 1559246553.100708 1559246622.027446 - - 0 - - - - - - - - - - - - +1559246622.027471 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 147.135.207.214 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - - - 1559246556.073681 1559246553.085177 1559246553.102587 1559246622.027464 - - 0 - - - - - - - - - - - - +1559246622.027484 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - - - 1559246556.073681 1559246554.041367 1559246554.069181 1559246622.027478 - - 0 - - - - - - - - - - - - 1559246622.092519 C3eiCBGOLw3VtHfOj 192.168.43.118 123 94.177.187.22 123 4 4 2 64.000000 0.000000 0.013733 0.041672 - - - - 1559245709.302032 1559246622.027446 1559246622.071899 1559246622.071924 - - 0 - - - - - - - - - - - - 1559246622.092556 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 4 2 64.000000 0.000002 0.003510 0.038559 - - - - 1559245178.020777 1559246622.027478 1559246622.068521 1559246622.068560 - - 0 - - - - - - - - - - - - 1559246622.100109 C37jN32gN3y3AZzyf6 192.168.43.118 123 85.199.214.99 123 4 4 1 16.000000 0.000000 0.000000 0.000000 - - - - 1559246622.000000 1559246622.027384 1559246622.073734 1559246622.073740 - - 0 - - - - - - - - - - - - 1559246622.100152 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 147.135.207.214 123 4 4 2 64.000000 0.000008 0.042236 0.037430 - - - - 1559245356.576177 1559246622.027464 1559246622.086267 1559246622.086348 - - 0 - - - - - - - - - - - - +1559246623.027502 CFLRIC3zaTU1loLGxh 192.168.43.118 123 93.41.196.243 123 4 3 2 64.000000 0.000000 0.046280 0.024307 - - - - 1559246556.073681 1559246556.032041 1559246556.054612 1559246623.027478 - - 0 - - - - - - - - - - - - +1559246623.027531 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.171.177 123 4 3 2 64.000000 0.000000 0.046280 0.024307 - - - - 1559246556.073681 1559246555.051459 1559246555.077253 1559246623.027521 - - 0 - - - - - - - - - - - - 1559246623.062844 CFLRIC3zaTU1loLGxh 192.168.43.118 123 93.41.196.243 123 4 4 2 64.000000 0.000000 0.025391 0.011642 - - - - 1559246412.455332 1559246623.027478 1559246623.041209 1559246623.041220 - - 0 - - - - - - - - - - - - 1559246623.070217 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.171.177 123 4 4 4 64.000000 0.000000 0.036835 0.046951 - - - - 1559245789.870424 1559246623.027521 1559246623.048360 1559246623.048416 - - 0 - - - - - - - - - - - - +1559246626.027461 Ck51lg1bScffFj34Ri 192.168.43.118 123 147.135.207.213 123 4 3 2 64.000000 0.000000 0.046280 0.024353 - - - - 1559246556.073681 1559246557.078120 1559246557.097844 1559246626.027432 - - 0 - - - - - - - - - - - - +1559246626.027518 C9mvWx3ezztgzcexV7 192.168.43.118 123 80.211.155.206 123 4 3 2 64.000000 0.000000 0.046280 0.024353 - - - - 1559246556.073681 1559246558.043947 1559246558.067904 1559246626.027514 - - 0 - - - - - - - - - - - - 1559246626.065984 C9mvWx3ezztgzcexV7 192.168.43.118 123 80.211.155.206 123 4 4 2 64.000000 0.000000 0.013535 0.025497 - - - - 1559246283.180069 1559246626.027514 1559246626.044105 1559246626.044139 - - 0 - - - - - - - - - - - - 1559246626.075079 Ck51lg1bScffFj34Ri 192.168.43.118 123 147.135.207.213 123 4 4 2 64.000000 0.000008 0.042236 0.037491 - - - - 1559245356.576177 1559246626.027432 1559246626.058084 1559246626.058151 - - 0 - - - - - - - - - - - - +1559246627.027502 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.88.132 123 3 3 2 64.000000 0.000000 0.046280 0.024368 - - - - 1559246556.073681 1559246560.040576 1559246560.064668 1559246627.027459 - - 0 - - - - - - - - - - - - 1559246627.073485 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.88.132 123 3 4 3 64.000000 0.000001 0.011765 0.001526 - - - - 1559245638.390748 1559246627.027459 1559246627.050401 1559246627.050438 - - 0 - - - - - - - - - - - - -#close 2019-06-04-15-48-36 +#close 2019-06-05-09-15-37 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout index 4d29c17d7d..ac82db736a 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout @@ -1,18 +1,35 @@ +ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028229, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246818.058351, rec_time=1559246818.079217, xmt_time=1559246885.027449, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.048843, root_disp=0.075409, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245852.721794, org_time=1559246885.027449, rec_time=1559246885.069212, xmt_time=1559246885.069247, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028259, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246820.060608, rec_time=1559246820.081498, xmt_time=1559246887.027425, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.003799, root_disp=0.037018, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245541.537424, org_time=1559246887.027425, rec_time=1559246887.050758, xmt_time=1559246887.050774, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028275, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246819.064014, rec_time=1559246819.079147, xmt_time=1559246888.027454, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028275, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246822.050275, rec_time=1559246822.064562, xmt_time=1559246888.030021, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.003235, root_disp=0.000565, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246481.481997, org_time=1559246888.030021, rec_time=1559246888.22033, xmt_time=1559246888.220401, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.040375, root_disp=0.001236, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246882.967102, org_time=1559246888.027454, rec_time=1559246888.234035, xmt_time=1559246888.234061, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02829, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246822.05809, rec_time=1559246822.069097, xmt_time=1559246889.027449, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000001, root_delay=0.00351, root_disp=0.040573, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245278.44239, org_time=1559246889.027449, rec_time=1559246889.061203, xmt_time=1559246889.06122, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028305, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246824.073855, rec_time=1559246824.095227, xmt_time=1559246890.027469, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028305, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246821.052836, rec_time=1559246821.069165, xmt_time=1559246890.027512, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028305, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246823.12395, rec_time=1559246823.295751, xmt_time=1559246890.027523, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013596, root_disp=0.025208, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246828.086879, org_time=1559246890.027523, rec_time=1559246890.060644, xmt_time=1559246890.060687, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.01091, root_disp=0.037491, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245577.265702, org_time=1559246890.027512, rec_time=1559246890.069012, xmt_time=1559246890.069048, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.0, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=GPS\x00, ref_time=1559246890.0, org_time=1559246890.027469, rec_time=1559246890.070262, xmt_time=1559246890.070268, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02832, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246822.05173, rec_time=1559246822.067161, xmt_time=1559246891.027395, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02832, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246825.052045, rec_time=1559246825.066358, xmt_time=1559246891.029953, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.025391, root_disp=0.015671, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246412.455332, org_time=1559246891.027395, rec_time=1559246891.051818, xmt_time=1559246891.051827, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013657, root_disp=0.025818, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246788.670839, org_time=1559246891.029953, rec_time=1559246891.061992, xmt_time=1559246891.062023, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028336, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246824.061335, rec_time=1559246824.08282, xmt_time=1559246892.027401, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000002, root_delay=0.00351, root_disp=0.042603, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245178.020777, org_time=1559246892.027401, rec_time=1559246892.05139, xmt_time=1559246892.051436, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028366, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246825.064608, rec_time=1559246825.074985, xmt_time=1559246894.027491, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.041504, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246894.027491, rec_time=1559246894.059304, xmt_time=1559246894.05938, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028427, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246829.060691, rec_time=1559246829.079018, xmt_time=1559246898.027403, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028427, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246830.0714, rec_time=1559246830.08971, xmt_time=1559246898.029953, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=4, std_msg=[stratum=3, poll=64.0, precision=0.000001, root_delay=0.011917, root_disp=0.000565, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246667.219303, org_time=1559246898.027403, rec_time=1559246898.077958, xmt_time=1559246898.078029, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.036819, root_disp=0.050842, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246822.40751, org_time=1559246898.029953, rec_time=1559246898.078347, xmt_time=1559246898.07843, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028458, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246833.067975, rec_time=1559246833.07965, xmt_time=1559246900.027439, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028458, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246831.053954, rec_time=1559246831.069547, xmt_time=1559246900.030036, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013535, root_disp=0.029602, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246283.180069, org_time=1559246900.030036, rec_time=1559246900.08881, xmt_time=1559246900.088844, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.041595, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246900.027439, rec_time=1559246900.103765, xmt_time=1559246900.103887, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=4, mode=3, std_msg=[stratum=0, poll=16.0, precision=0.015625, root_delay=1.0, root_disp=1.0, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1101309131.444112, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.000122, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=CTD\x00, ref_time=1559246910.937978, org_time=1101309131.444112, rec_time=1559246940.281161, xmt_time=1559246940.281191, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=42, auth_bit=F, sequence=0, implementation=3, err=0, data=]] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log index e49c170785..4c56431bf0 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log @@ -3,25 +3,42 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-04-15-48-51 +#open 2019-06-05-09-15-43 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ReqCode auth_bit sequence implementation err #types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count bool count count count +1559246885.027478 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 3 2 64.000000 0.000000 0.046280 0.028229 - - - - 1559246556.073681 1559246818.058351 1559246818.079217 1559246885.027449 - - 0 - - - - - - - - - - - - 1559246885.088815 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 4 4 64.000000 0.000000 0.048843 0.075409 - - - - 1559245852.721794 1559246885.027449 1559246885.069212 1559246885.069247 - - 0 - - - - - - - - - - - - +1559246887.027467 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 3 2 64.000000 0.000000 0.046280 0.028259 - - - - 1559246556.073681 1559246820.060608 1559246820.081498 1559246887.027425 - - 0 - - - - - - - - - - - - 1559246887.060766 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 4 2 64.000000 0.000000 0.003799 0.037018 - - - - 1559245541.537424 1559246887.027425 1559246887.050758 1559246887.050774 - - 0 - - - - - - - - - - - - +1559246888.027489 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 3 2 64.000000 0.000000 0.046280 0.028275 - - - - 1559246556.073681 1559246819.064014 1559246819.079147 1559246888.027454 - - 0 - - - - - - - - - - - - +1559246888.030028 CtPZjS20MLrsMUOJi2 192.168.43.118 123 185.19.184.35 123 4 3 2 64.000000 0.000000 0.046280 0.028275 - - - - 1559246556.073681 1559246822.050275 1559246822.064562 1559246888.030021 - - 0 - - - - - - - - - - - - 1559246888.422200 CtPZjS20MLrsMUOJi2 192.168.43.118 123 185.19.184.35 123 4 4 2 64.000000 0.000008 0.003235 0.000565 - - - - 1559246481.481997 1559246888.030021 1559246888.220330 1559246888.220401 - - 0 - - - - - - - - - - - - 1559246888.422229 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 4 2 64.000000 0.000000 0.040375 0.001236 - - - - 1559246882.967102 1559246888.027454 1559246888.234035 1559246888.234061 - - 0 - - - - - - - - - - - - +1559246889.027482 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 212.45.144.3 123 4 3 2 64.000000 0.000000 0.046280 0.028290 - - - - 1559246556.073681 1559246822.058090 1559246822.069097 1559246889.027449 - - 0 - - - - - - - - - - - - 1559246889.075261 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 212.45.144.3 123 4 4 2 64.000000 0.000001 0.003510 0.040573 - - - - 1559245278.442390 1559246889.027449 1559246889.061203 1559246889.061220 - - 0 - - - - - - - - - - - - +1559246890.027493 CmES5u32sYpV7JYN 192.168.43.118 123 85.199.214.99 123 4 3 2 64.000000 0.000000 0.046280 0.028305 - - - - 1559246556.073681 1559246824.073855 1559246824.095227 1559246890.027469 - - 0 - - - - - - - - - - - - +1559246890.027517 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 3 2 64.000000 0.000000 0.046280 0.028305 - - - - 1559246556.073681 1559246821.052836 1559246821.069165 1559246890.027512 - - 0 - - - - - - - - - - - - +1559246890.027528 C37jN32gN3y3AZzyf6 192.168.43.118 123 188.213.165.209 123 4 3 2 64.000000 0.000000 0.046280 0.028305 - - - - 1559246556.073681 1559246823.123950 1559246823.295751 1559246890.027523 - - 0 - - - - - - - - - - - - 1559246890.076319 C37jN32gN3y3AZzyf6 192.168.43.118 123 188.213.165.209 123 4 4 2 64.000000 0.000000 0.013596 0.025208 - - - - 1559246828.086879 1559246890.027523 1559246890.060644 1559246890.060687 - - 0 - - - - - - - - - - - - 1559246890.082370 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 4 2 64.000000 0.000000 0.010910 0.037491 - - - - 1559245577.265702 1559246890.027512 1559246890.069012 1559246890.069048 - - 0 - - - - - - - - - - - - 1559246890.094824 CmES5u32sYpV7JYN 192.168.43.118 123 85.199.214.99 123 4 4 1 16.000000 0.000000 0.000000 0.000000 - - - - 1559246890.000000 1559246890.027469 1559246890.070262 1559246890.070268 - - 0 - - - - - - - - - - - - +1559246891.027431 C3eiCBGOLw3VtHfOj 192.168.43.118 123 93.41.196.243 123 4 3 2 64.000000 0.000000 0.046280 0.028320 - - - - 1559246556.073681 1559246822.051730 1559246822.067161 1559246891.027395 - - 0 - - - - - - - - - - - - +1559246891.029967 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 94.177.187.22 123 4 3 2 64.000000 0.000000 0.046280 0.028320 - - - - 1559246556.073681 1559246825.052045 1559246825.066358 1559246891.029953 - - 0 - - - - - - - - - - - - 1559246891.068733 C3eiCBGOLw3VtHfOj 192.168.43.118 123 93.41.196.243 123 4 4 2 64.000000 0.000000 0.025391 0.015671 - - - - 1559246412.455332 1559246891.027395 1559246891.051818 1559246891.051827 - - 0 - - - - - - - - - - - - 1559246891.075965 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 94.177.187.22 123 4 4 2 64.000000 0.000000 0.013657 0.025818 - - - - 1559246788.670839 1559246891.029953 1559246891.061992 1559246891.062023 - - 0 - - - - - - - - - - - - +1559246892.027415 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 3 2 64.000000 0.000000 0.046280 0.028336 - - - - 1559246556.073681 1559246824.061335 1559246824.082820 1559246892.027401 - - 0 - - - - - - - - - - - - 1559246892.077560 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 4 2 64.000000 0.000002 0.003510 0.042603 - - - - 1559245178.020777 1559246892.027401 1559246892.051390 1559246892.051436 - - 0 - - - - - - - - - - - - +1559246894.027523 CFLRIC3zaTU1loLGxh 192.168.43.118 123 147.135.207.214 123 4 3 2 64.000000 0.000000 0.046280 0.028366 - - - - 1559246556.073681 1559246825.064608 1559246825.074985 1559246894.027491 - - 0 - - - - - - - - - - - - 1559246894.070325 CFLRIC3zaTU1loLGxh 192.168.43.118 123 147.135.207.214 123 4 4 2 64.000000 0.000008 0.042236 0.041504 - - - - 1559245356.576177 1559246894.027491 1559246894.059304 1559246894.059380 - - 0 - - - - - - - - - - - - +1559246898.027422 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.88.132 123 3 3 2 64.000000 0.000000 0.046280 0.028427 - - - - 1559246556.073681 1559246829.060691 1559246829.079018 1559246898.027403 - - 0 - - - - - - - - - - - - +1559246898.029960 Ck51lg1bScffFj34Ri 192.168.43.118 123 80.211.171.177 123 4 3 2 64.000000 0.000000 0.046280 0.028427 - - - - 1559246556.073681 1559246830.071400 1559246830.089710 1559246898.029953 - - 0 - - - - - - - - - - - - 1559246898.094782 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.88.132 123 3 4 3 64.000000 0.000001 0.011917 0.000565 - - - - 1559246667.219303 1559246898.027403 1559246898.077958 1559246898.078029 - - 0 - - - - - - - - - - - - 1559246898.094827 Ck51lg1bScffFj34Ri 192.168.43.118 123 80.211.171.177 123 4 4 4 64.000000 0.000000 0.036819 0.050842 - - - - 1559246822.407510 1559246898.029953 1559246898.078347 1559246898.078430 - - 0 - - - - - - - - - - - - +1559246900.027467 C9mvWx3ezztgzcexV7 192.168.43.118 123 147.135.207.213 123 4 3 2 64.000000 0.000000 0.046280 0.028458 - - - - 1559246556.073681 1559246833.067975 1559246833.079650 1559246900.027439 - - 0 - - - - - - - - - - - - +1559246900.030051 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.155.206 123 4 3 2 64.000000 0.000000 0.046280 0.028458 - - - - 1559246556.073681 1559246831.053954 1559246831.069547 1559246900.030036 - - 0 - - - - - - - - - - - - 1559246900.102991 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.155.206 123 4 4 2 64.000000 0.000000 0.013535 0.029602 - - - - 1559246283.180069 1559246900.030036 1559246900.088810 1559246900.088844 - - 0 - - - - - - - - - - - - 1559246900.111834 C9mvWx3ezztgzcexV7 192.168.43.118 123 147.135.207.213 123 4 4 2 64.000000 0.000008 0.042236 0.041595 - - - - 1559245356.576177 1559246900.027439 1559246900.103765 1559246900.103887 - - 0 - - - - - - - - - - - - 1559246940.262220 C7fIlMZDuRiqjpYbb 192.168.43.118 58229 193.204.114.232 123 4 3 0 16.000000 0.015625 1.000000 1.000000 - - - - 0.000000 0.000000 0.000000 1101309131.444112 - - 0 - - - - - - - - - - - - 1559246940.304152 C7fIlMZDuRiqjpYbb 192.168.43.118 58229 193.204.114.232 123 4 4 1 16.000000 0.000000 0.000000 0.000122 - - - - 1559246910.937978 1101309131.444112 1559246940.281161 1559246940.281191 - - 0 - - - - - - - - - - - - -#close 2019-06-04-15-48-51 +1559246940.486493 CykQaM33ztNt0csB9a 192.168.43.118 43046 193.204.114.232 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - 42 F - 3 0 +#close 2019-06-05-09-15-44 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log index c0f8be47a8..5075ab04ed 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log @@ -3,7 +3,7 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-04-15-48-57 +#open 2019-06-05-09-15-50 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ReqCode auth_bit sequence implementation err #types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count bool count count count 1096255084.954975 ClEkJM2Vm5giqnMf4h 192.168.50.50 123 67.129.68.9 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - @@ -36,4 +36,4 @@ 1096255085.522297 CwjjYJ2WqgTbAqiHl6 192.168.50.50 123 64.112.189.11 123 3 2 2 1024.000000 0.000015 0.081268 0.029877 - - - - 1096254706.140290 1096255084.922896 1096255083.850451 1096255083.850465 - - 0 - - - - - - - - - - - - 1096255085.562197 CmES5u32sYpV7JYN 192.168.50.50 123 216.27.185.42 123 3 2 2 1024.000000 0.000004 0.029846 0.045456 - - - - 1096254209.896379 1096255084.922896 1096255083.849099 1096255083.849269 - - 0 - - - - - - - - - - - - 1096255085.599961 CUM0KZ3MLUfNB0cl11 192.168.50.50 123 209.132.176.4 123 3 2 1 1024.000000 0.000015 0.000000 0.000504 - - - - 1096255068.944018 1096255084.922896 1096255083.827772 1096255083.828313 - - 0 - - - - - - - - - - - - -#close 2019-06-04-15-48-57 +#close 2019-06-05-09-15-50 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout new file mode 100644 index 0000000000..be9c6ad425 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout @@ -0,0 +1,9 @@ +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=1, resp_bit=F, err_bit=F, more_bit=F, sequence=1, status=0, association_id=0, offs=0, c=0, data=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=2, status=0, association_id=19183, offs=0, c=0, data=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=3, status=0, association_id=19184, offs=0, c=0, data=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=1, auth_bit=F, sequence=0, implementation=3, err=0, data=]] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=42, auth_bit=F, sequence=0, implementation=3, err=0, data=]] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=1, resp_bit=F, err_bit=F, more_bit=F, sequence=1, status=0, association_id=0, offs=0, c=0, data=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=2, status=0, association_id=19183, offs=0, c=0, data=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=3, status=0, association_id=19184, offs=0, c=0, data=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=1, auth_bit=F, sequence=0, implementation=3, err=0, data=]] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log new file mode 100644 index 0000000000..fdfd021186 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log @@ -0,0 +1,18 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path ntp +#open 2019-06-05-09-15-16 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ReqCode auth_bit sequence implementation err +#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count bool count count count +1558603188.282844 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 1 F F F 1 0 0 - - - - - +1558603188.283617 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 2 0 19183 - - - - - +1558603188.286063 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 3 0 19184 - - - - - +1558603201.135003 ClEkJM2Vm5giqnMf4h 127.0.0.1 57531 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - 1 F - 3 0 +1558603206.793297 C4J4Th3PJpwUYZZ6gc 127.0.0.1 46918 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - 42 F - 3 0 +1558603213.886044 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 1 F F F 1 0 0 - - - - - +1558603213.886779 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 2 0 19183 - - - - - +1558603213.889030 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 3 0 19184 - - - - - +1558603219.996399 CUM0KZ3MLUfNB0cl11 127.0.0.1 55675 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - 1 F - 3 0 +#close 2019-06-05-09-15-16 diff --git a/testing/btest/scripts/base/protocols/ntp/ntp.test b/testing/btest/scripts/base/protocols/ntp/ntp.test index 9ad4daa8af..022a708962 100644 --- a/testing/btest/scripts/base/protocols/ntp/ntp.test +++ b/testing/btest/scripts/base/protocols/ntp/ntp.test @@ -1,4 +1,4 @@ -# @TEST-EXEC: bro -r $TRACES/ntp/ntp.pcap %INPUT +# @TEST-EXEC: zeek -C -r $TRACES/ntp/ntp.pcap %INPUT # @TEST-EXEC: btest-diff ntp.log # @TEST-EXEC: btest-diff .stdout diff --git a/testing/btest/scripts/base/protocols/ntp/ntp2.test b/testing/btest/scripts/base/protocols/ntp/ntp2.test index b59363e90e..89c93f68e2 100644 --- a/testing/btest/scripts/base/protocols/ntp/ntp2.test +++ b/testing/btest/scripts/base/protocols/ntp/ntp2.test @@ -1,4 +1,4 @@ -# @TEST-EXEC: bro -r $TRACES/ntp/ntp2.pcap %INPUT +# @TEST-EXEC: zeek -C -r $TRACES/ntp/ntp2.pcap %INPUT # @TEST-EXEC: btest-diff ntp.log # @TEST-EXEC: btest-diff .stdout diff --git a/testing/btest/scripts/base/protocols/ntp/ntp3.test b/testing/btest/scripts/base/protocols/ntp/ntp3.test index 01feb9ed3b..a72596b5e4 100644 --- a/testing/btest/scripts/base/protocols/ntp/ntp3.test +++ b/testing/btest/scripts/base/protocols/ntp/ntp3.test @@ -1,4 +1,4 @@ -# @TEST-EXEC: bro -r $TRACES/ntp/NTP_sync.pcap %INPUT +# @TEST-EXEC: zeek -C -r $TRACES/ntp/NTP_sync.pcap %INPUT # @TEST-EXEC: btest-diff ntp.log # @TEST-EXEC: btest-diff .stdout diff --git a/testing/btest/scripts/base/protocols/ntp/ntpmode67.test b/testing/btest/scripts/base/protocols/ntp/ntpmode67.test index b2100ae840..7407795a48 100644 --- a/testing/btest/scripts/base/protocols/ntp/ntpmode67.test +++ b/testing/btest/scripts/base/protocols/ntp/ntpmode67.test @@ -1,4 +1,6 @@ -# @TEST-EXEC: bro -r $TRACES/ntp/ntpmode67.pcap %INPUT +# @TEST-EXEC: zeek -C -r $TRACES/ntp/ntpmode67.pcap %INPUT +# @TEST-EXEC: btest-diff .stdout +# @TEST-EXEC: btest-diff ntp.log @load base/protocols/ntp From 2dc7695d875b324f41c67026a883dc3ae3771a87 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Wed, 5 Jun 2019 15:26:45 +0200 Subject: [PATCH 13/25] fix wrong Assign with reference_id --- src/analyzer/protocol/ntp/ntp-analyzer.pac | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index 8a94db1d18..2cb3c664b6 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -46,18 +46,18 @@ refine flow NTP_Flow += { switch ( ${nsm.stratum} ) { case 0: - // unknown stratum => kiss code - rv->Assign(7, bytestring_to_val(${nsm.reference_id})); - break; + // unknown stratum => kiss code + rv->Assign(5, bytestring_to_val(${nsm.reference_id})); + break; case 1: // reference clock => ref clock string - rv->Assign(8, bytestring_to_val(${nsm.reference_id})); + rv->Assign(6, bytestring_to_val(${nsm.reference_id})); break; default: - // TODO: Check for v4/v6 - const uint8* d = ${nsm.reference_id}.data(); - rv->Assign(9, new AddrVal(IPAddr(IPv4, (const uint32*) d, IPAddr::Network))); - break; + // TODO: Check for v4/v6 + const uint8* d = ${nsm.reference_id}.data(); + rv->Assign(7, new AddrVal(IPAddr(IPv4, (const uint32*) d, IPAddr::Network))); + break; } rv->Assign(9, proc_ntp_timestamp(${nsm.reference_ts})); From df0a4b9bb7d4366d63201b290f0a9e971620c557 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Wed, 5 Jun 2019 18:15:18 +0200 Subject: [PATCH 14/25] fix key_id and digest (WIP) --- src/analyzer/protocol/ntp/ntp-analyzer.pac | 5 +++++ src/analyzer/protocol/ntp/ntp-protocol.pac | 8 ++++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index 2cb3c664b6..8ab14bb0bf 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -65,6 +65,11 @@ refine flow NTP_Flow += { rv->Assign(11, proc_ntp_timestamp(${nsm.receive_ts})); rv->Assign(12, proc_ntp_timestamp(${nsm.transmit_ts})); + if (${nsm.mac.key_id}) { + //rv->Assign(13, val_mgr->GetCount(${nsm.mac.key_id})); + //rv->Assign(14, bytestring_to_val(${nsm.mac.digest})); + cout<<"booo"<Assign(15, val_mgr->GetCount((uint32) ${nsm.extensions}->size())); return rv; diff --git a/src/analyzer/protocol/ntp/ntp-protocol.pac b/src/analyzer/protocol/ntp/ntp-protocol.pac index 4a1e8af22b..721780c261 100644 --- a/src/analyzer/protocol/ntp/ntp-protocol.pac +++ b/src/analyzer/protocol/ntp/ntp-protocol.pac @@ -57,13 +57,17 @@ type NTP_control_msg = record { association_id : uint16; offs : uint16; c : uint16; - data : bytestring &restofdata; - #auth : #TODO + data : bytestring &length=c; + have_mac : case (offsetof(have_mac) < length) of { + true -> mac : NTP_MAC; + false -> nil : empty; + } &requires(length); } &let { R: bool = (second_byte & 0x80) > 0; # First bit of 8-bits value E: bool = (second_byte & 0x40) > 0; # Second bit of 8-bits value M: bool = (second_byte & 0x20) > 0; # Third bit of 8-bits value OpCode: uint8 = (second_byte & 0x1F); # Last 5 bits of 8-bits value + length = sourcedata.length(); } &byteorder=bigendian &exportsourcedata; From c8253e04999d228d6d17d8e44b1a452e50fbca0f Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Thu, 6 Jun 2019 11:50:12 +0200 Subject: [PATCH 15/25] remove old NTP record in init-bare.zeek --- scripts/base/init-bare.zeek | 49 ------------------------------------- 1 file changed, 49 deletions(-) diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index 42e0eea538..0c677d3b37 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -2526,55 +2526,6 @@ export { }; } -module NTP; - -export { - ## NTP message as defined in :rfc:`5905`. - ## Doesn't include fields for mode 7 (reserved for private use), e.g. monlist - type NTP::Message: record { - ## The NTP version number - version: count; - ## The NTP mode being used - mode: count; - ## The stratum (primary server, secondary server, etc.) - stratum: count; - ## The maximum interval between successive messages - poll: interval; - ## The precision of the system clock - precision: interval; - - ## Total round-trip delay to the reference clock - root_delay: interval; - ## Total dispersion to the reference clock - root_disp: interval; - ## For stratum 0, 4 character string used for debugging - kiss_code: string &optional; - ## For stratum 1, ID assigned to the reference clock by IANA - ref_id: string &optional; - ## Above stratum 1, when using IPv4, the IP address of the reference clock - ref_addr: addr &optional; - - ## Above stratum 1, when using IPv6, the first four bytes of the MD5 hash of the - ## IPv6 address of the reference clock - ref_v6_hash_prefix: string &optional; - ## Time when the system clock was last set or correct - ref_time: time; - ## Time at the client when the request departed for the NTP server - org_time: time; - ## Time at the server when the request arrived from the NTP client - rec_time: time; - ## Time at the server when the response departed for the NTP client - xmt_time: time; - ## Key used to designate a secret MD5 key - key_id: count &optional; - ## MD5 hash computed over the key followed by the NTP packet header and extension fields - digest: string &optional; - ## Number of extension fields (which are not currently parsed) - num_exts: count &default=0; - }; -} - - module NTLM; export { From 2cd2c65fe37669218b1131d253574afcfe79c7a6 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Thu, 6 Jun 2019 16:38:05 +0200 Subject: [PATCH 16/25] fix auth field (key_id and mac) in standard and control msg --- scripts/base/init-bare.zeek | 63 +++------------------- scripts/base/protocols/ntp/main.zeek | 24 ++++++--- src/analyzer/protocol/ntp/ntp-analyzer.pac | 10 ++-- src/analyzer/protocol/ntp/ntp-protocol.pac | 32 ++++++----- 4 files changed, 51 insertions(+), 78 deletions(-) diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index 42e0eea538..884fa1f738 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -2526,54 +2526,6 @@ export { }; } -module NTP; - -export { - ## NTP message as defined in :rfc:`5905`. - ## Doesn't include fields for mode 7 (reserved for private use), e.g. monlist - type NTP::Message: record { - ## The NTP version number - version: count; - ## The NTP mode being used - mode: count; - ## The stratum (primary server, secondary server, etc.) - stratum: count; - ## The maximum interval between successive messages - poll: interval; - ## The precision of the system clock - precision: interval; - - ## Total round-trip delay to the reference clock - root_delay: interval; - ## Total dispersion to the reference clock - root_disp: interval; - ## For stratum 0, 4 character string used for debugging - kiss_code: string &optional; - ## For stratum 1, ID assigned to the reference clock by IANA - ref_id: string &optional; - ## Above stratum 1, when using IPv4, the IP address of the reference clock - ref_addr: addr &optional; - - ## Above stratum 1, when using IPv6, the first four bytes of the MD5 hash of the - ## IPv6 address of the reference clock - ref_v6_hash_prefix: string &optional; - ## Time when the system clock was last set or correct - ref_time: time; - ## Time at the client when the request departed for the NTP server - org_time: time; - ## Time at the server when the request arrived from the NTP client - rec_time: time; - ## Time at the server when the response departed for the NTP client - xmt_time: time; - ## Key used to designate a secret MD5 key - key_id: count &optional; - ## MD5 hash computed over the key followed by the NTP packet header and extension fields - digest: string &optional; - ## Number of extension fields (which are not currently parsed) - num_exts: count &default=0; - }; -} - module NTLM; @@ -5045,15 +4997,16 @@ export { ## The sequence number of the command or response sequence : count; ## The current status of the system, peer or clock - status : count; #TODO: this must be further specified + status : count; #TODO: this can be further parsed internally ## A 16-bit integer identifying a valid association association_id : count; - ## A 16-bit integer indicating the offset, in octets, of the first octet in the data area - offs : count; - ## A 16-bit integer indicating the length of the data field, in octets - c : count; ## The message data for the command or response + Authenticator (optional) - data : string &optional; # TODO: distinguish data and authenticator + data : string &optional; + ## This is an integer identifying the cryptographic + ## key used to generate the message-authentication code + key_id : count &optional; + ## This is a crypto-checksum computed by the encryption procedure + crypto_checksum : string &optional; }; ## NTP mode7 message for mode=7. Note that this is not defined in any RFC @@ -5095,7 +5048,7 @@ export { ## 7 - authentication failure (i.e. permission denied) err : count; ## Rest of data - data : string &optional; # TODO: can be further parsed + data : string &optional; }; ## NTP message as defined in :rfc:`5905`. diff --git a/scripts/base/protocols/ntp/main.zeek b/scripts/base/protocols/ntp/main.zeek index de65863c39..40b2b9caf0 100644 --- a/scripts/base/protocols/ntp/main.zeek +++ b/scripts/base/protocols/ntp/main.zeek @@ -76,6 +76,12 @@ export { status : count &log; ## A 16-bit integer identifying a valid association association_id : count &log; + ## This is an integer identifying the cryptographic + ## key used to generate the message-authentication code + ctrl_key_id : count &optional &log; + ## This is a crypto-checksum computed by the encryption procedure + crypto_checksum : string &optional &log; + ## An implementation-specific code which specifies the ## operation to be (which has been) performed and/or the @@ -133,13 +139,13 @@ event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) &priority=5 info$root_delay = msg$std_msg$root_delay; info$root_disp = msg$std_msg$root_disp; - if ( info?$kiss_code) + if ( msg$std_msg?$kiss_code) info$kiss_code = msg$std_msg$kiss_code; - if ( info?$ref_id) + if ( msg$std_msg?$ref_id) info$ref_id = msg$std_msg$ref_id; - if ( info?$ref_addr) + if ( msg$std_msg?$ref_addr) info$ref_addr = msg$std_msg$ref_addr; - if ( info?$ref_v6_hash_prefix) + if ( msg$std_msg?$ref_v6_hash_prefix) info$ref_v6_hash_prefix = msg$std_msg$ref_v6_hash_prefix; info$ref_time = msg$std_msg$ref_time; @@ -147,9 +153,9 @@ event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) &priority=5 info$rec_time = msg$std_msg$rec_time; info$xmt_time = msg$std_msg$xmt_time; - if ( info?$key_id) + if ( msg$std_msg?$key_id) info$key_id = msg$std_msg$key_id; - if ( info?$digest) + if ( msg$std_msg?$digest) info$digest = msg$std_msg$digest; info$num_exts = msg$std_msg$num_exts; @@ -163,6 +169,12 @@ event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) &priority=5 info$sequence = msg$control_msg$sequence; info$status = msg$control_msg$status; info$association_id = msg$control_msg$association_id; + + if ( msg$control_msg?$key_id) + info$ctrl_key_id = msg$control_msg$key_id; + if ( msg$control_msg?$crypto_checksum) + info$crypto_checksum = msg$control_msg$crypto_checksum; + } if ( msg$mode==7 ) { diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index 8ab14bb0bf..af42ddf9d1 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -65,12 +65,12 @@ refine flow NTP_Flow += { rv->Assign(11, proc_ntp_timestamp(${nsm.receive_ts})); rv->Assign(12, proc_ntp_timestamp(${nsm.transmit_ts})); - if (${nsm.mac.key_id}) { - //rv->Assign(13, val_mgr->GetCount(${nsm.mac.key_id})); - //rv->Assign(14, bytestring_to_val(${nsm.mac.digest})); - cout<<"booo"<Assign(13, val_mgr->GetCount(${nsm.mac.key_id})); + rv->Assign(14, bytestring_to_val(${nsm.mac.digest})); } - rv->Assign(15, val_mgr->GetCount((uint32) ${nsm.extensions}->size())); + // TODO: add extension fields + //rv->Assign(15, val_mgr->GetCount((uint32) ${nsm.extensions}->size())); return rv; %} diff --git a/src/analyzer/protocol/ntp/ntp-protocol.pac b/src/analyzer/protocol/ntp/ntp-protocol.pac index 721780c261..fd3a43f9c9 100644 --- a/src/analyzer/protocol/ntp/ntp-protocol.pac +++ b/src/analyzer/protocol/ntp/ntp-protocol.pac @@ -39,13 +39,14 @@ type NTP_std_msg = record { origin_ts : NTP_Time; receive_ts : NTP_Time; transmit_ts : NTP_Time; - extensions : Extension_Field[] &until($input.length() <= 18); - have_mac : case (offsetof(have_mac) < length) of { + #extensions : Extension_Field[] &until($input.length() == 20); #TODO: this need to be properly parsed + mac_fields : case (has_mac) of { true -> mac : NTP_MAC; false -> nil : empty; - } &requires(length); + } &requires(has_mac); } &let { length = sourcedata.length(); + has_mac: bool = (length - offsetof(mac_fields)) == 20; } &byteorder=bigendian &exportsourcedata; # This format is for mode==6, control msg @@ -53,33 +54,40 @@ type NTP_std_msg = record { type NTP_control_msg = record { second_byte : uint8; sequence : uint16; - status : uint16; #TODO: this must be further specified + status : uint16; #TODO: this can be further parsed internally association_id : uint16; offs : uint16; c : uint16; data : bytestring &length=c; - have_mac : case (offsetof(have_mac) < length) of { - true -> mac : NTP_MAC; + mac_fields : case (has_control_mac) of { + true -> mac : NTP_CONTROL_MAC; false -> nil : empty; - } &requires(length); + } &requires(has_control_mac); } &let { R: bool = (second_byte & 0x80) > 0; # First bit of 8-bits value E: bool = (second_byte & 0x40) > 0; # Second bit of 8-bits value M: bool = (second_byte & 0x20) > 0; # Third bit of 8-bits value - OpCode: uint8 = (second_byte & 0x1F); # Last 5 bits of 8-bits value + OpCode: uint8 = (second_byte & 0x1F); # Last 5 bits of 8-bits value length = sourcedata.length(); + has_control_mac: bool = (length - offsetof(mac_fields)) == 12; } &byteorder=bigendian &exportsourcedata; - +# As in RFC 5905 type NTP_MAC = record { key_id: uint32; digest: bytestring &length=16; -} &length=18; +} &length=20; + +# As in RFC 1119 +type NTP_CONTROL_MAC = record { + key_id: uint32; + crypto_checksum: bytestring &length=8; +} &length=12; type Extension_Field = record { field_type: uint16; - length : uint16; - data : bytestring &length=length-4; + ext_len : uint16; + data : bytestring &length=ext_len-4; }; type NTP_Short_Time = record { From 38ad64808258f84c4128ef70d6623f8a3595704b Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Thu, 6 Jun 2019 16:45:09 +0200 Subject: [PATCH 17/25] update tests and add a new one for key_id and mac --- .../.stdout | 40 +++++++++ .../ntp.log | 49 +++++++++++ .../scripts.base.protocols.ntp.ntp/.stdout | 64 +++++++------- .../scripts.base.protocols.ntp.ntp/ntp.log | 72 ++++++++-------- .../scripts.base.protocols.ntp.ntp2/.stdout | 68 +++++++-------- .../scripts.base.protocols.ntp.ntp2/ntp.log | 78 +++++++++--------- .../scripts.base.protocols.ntp.ntp3/.stdout | 60 +++++++------- .../scripts.base.protocols.ntp.ntp3/ntp.log | 68 +++++++-------- .../.stdout | 12 +-- .../ntp.log | 26 +++--- testing/btest/Traces/ntp/NTP-digest.pcap | Bin 0 -> 5864 bytes .../base/protocols/ntp/ntp-digest.test | 11 +++ 12 files changed, 324 insertions(+), 224 deletions(-) create mode 100644 testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/.stdout create mode 100644 testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/ntp.log create mode 100644 testing/btest/Traces/ntp/NTP-digest.pcap create mode 100644 testing/btest/scripts/base/protocols/ntp/ntp-digest.test diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/.stdout new file mode 100644 index 0000000000..c92443bb33 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/.stdout @@ -0,0 +1,40 @@ +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.02623, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495804929.482904, key_id=1, digest=\xac\x01{i\x91\\xe5\xa7\xa9\xfbs\xac\x8b\xd1`;, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.0271, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495804987.483591, key_id=1, digest=3\x03\x03\xf0\xaa\x15`\xf5i\xd8=\xfa\x10S\x80\xd4, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.027374, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805006.483955, key_id=1, digest=\xbb\xdc\x86&\xa6\xfd\x0d\xd5q.4I\x04\xad\xeb\xe1, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.027939, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805043.484331, key_id=1, digest=\x97\x99\x90\x18t\xf8-k\xcdo0\x9945\xe1\xbf, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.028503, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805081.484917, key_id=1, digest=}\xb9\x12\xfe\x8fT\xd2\x0fA\x8c\x86\x90\x9b\xf9\xd1p, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.02887, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805105.48515, key_id=1, digest=\x8e\xb7\xe1\x0e\x86T\xdcsB\x05j\xe0|\xc9i\xa6, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.029678, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805159.485867, key_id=1, digest=.\x16\x11\x9e\xd1\xadJ\x16x}\x03f\x91\x11\x85_, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.030334, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805203.486536, key_id=1, digest=\x1bu\x87"U\xa3\xbb*\xe7-\xecu`\x88\xb8z, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.030396, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805207.486593, key_id=1, digest=\x10\x8eb\x92\x85\xc1\xd0#\x09\x93\x97\xff\x0a$&/, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.031128, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805256.487243, key_id=1, digest=\xcc\x1f~\xa1\xdf\xe0.\x9f_,\xa65\x1a[\x01s, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.031479, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805279.487564, key_id=1, digest=}\xfd\xbf\x81\xae\x16\x07\x1b\x987kd\x9255\xf9, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.032242, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805330.48824, key_id=1, digest=\x90\xfc\x8c\x02\xa6w\x1f\xf2\x0aU\xfb\x04\x10\xe9\xe3\xfb, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.032639, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805357.488596, key_id=1, digest=\x96@\x0b\x95\x99W\xd7\xa8\xf6\x06\xf9\xa0B,\x1d\xd8, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.03302, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805382.488826, key_id=1, digest=\xd3\xd7\xd1Vn\xb7\x0e\xceg\xb9C\x0b\xc2\xac\xcc\xab, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.03392, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805442.489609, key_id=1, digest=\x93E\xaa\xdaj\xfc3d\x0c\xd1\xad\xb3\x83ce\xc9, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.034058, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805451.489738, key_id=1, digest={\xaa\x86\xeb\x99\xb8H\xe4\x8b\x93\x7f\xfe\x84)%\xa4, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.034088, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805453.489803, key_id=1, digest=1D0\x0f\x08\x16\x9fjs\xd4\xef}5\xa1\xf6\x9a, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.03421, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805461.489877, key_id=1, digest=nU~J\x8d\xe9m\xf3\.\xf1g\xb5loj, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.034454, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805478.490201, key_id=1, digest=\xa4\xf8A\x08\xbf\xda}F%\xf2Fl\x19\xff\xdd\xab, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.034851, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805504.490512, key_id=1, digest=\xb0\xeec=\xb3\x17\xa2\xc5\xab\xe5\x04\x82\xe3\xfcE\xa1, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.035263, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805532.49081, key_id=1, digest=\x0b\xa2\x86M\x0d\xdc%\xbc\xcbi\xe9\x81\xd6\x0d$\x80, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.035339, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805537.490953, key_id=1, digest=\x01\xc1~\xeeJ'\x92g\x0cYI0\x0c\xd7\x91\xb1, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.035858, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805571.491412, key_id=1, digest=i\x90_\x89B\xf0\xe8Nq.\xe2t\xf1_jn, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.036804, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805634.492157, key_id=1, digest=\x07p\xf5&\xff\x1b6\x04\xb3\x83/\xb9\xff\xcb\xf2\xc6, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.036942, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805644.492282, key_id=1, digest=M\x05\xa9\x90'a\xbajGdb\xe03ZA\xf9, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.037735, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805696.492977, key_id=1, digest=\x17B\xcf\xb1y\x88\xdfA\xfe\xc2\x03u"J\xe9\xb0, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.038666, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805758.493804, key_id=1, digest=\x99\xe3\xa8\x0c\xca@\xc1\x0c\x1c\xc9\xec=\x07\xc0d\xc7, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.038925, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805776.494147, key_id=1, digest=T\x1bE\x16,{\x1b\x08\xc9\x05G\xce\xb9\xe2,\x9d, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.03952, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805815.494543, key_id=1, digest=\xb7\xa6\xc2'u\xdc\xcc\x86(\xe0^{\xdd\x8e\xde,, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.040253, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805864.495286, key_id=1, digest=\xfcU\x94Z\xca\x04x\xe0\x93z\xa2K\x89\xc0 \xb7, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.040268, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805865.495321, key_id=1, digest=\xf9& \x1a\xb2}O\xe5\xba\xd9\xfe\x0f\xf4J\x93P, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.041031, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805916.495973, key_id=1, digest=\x8f\x8c\xb7\xcd\xd4{\x8f\x0b\x92\xee~\xa6\x17\x0e\xa1\x0f, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.041748, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805964.496596, key_id=1, digest=L\xe68\xb6\x1d\x1d\x8cq\x0b\xb7\xf0N\xee\x9b\xb2j, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.042175, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495805992.496969, key_id=1, digest=D\xa4>MCS\x90h\x0f=[4u\xd0\x1f\x9f, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.042816, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495806035.497545, key_id=1, digest=U\xcb]\xd3"NV\xb9[W\xa5!\xddl\x1f4, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.043106, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495806055.497725, key_id=1, digest=Y\xdc\xc7]#\xb3\x9bV\xf7\x1b\xb3[\x8e\x836!, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.04332, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495806069.497937, key_id=1, digest=\xd1-O\xc7-\xac\x10\x19\xa9h\xe4\x81;\xb4\x01e, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.043488, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495806080.498132, key_id=1, digest=\xe0\xa3^\x9ck*qa\x85\x1aVA|bJA, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.043793, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495806100.498395, key_id=1, digest=;\x03\xae\x8a\xf1}ABj\x87\xa0\xf4\xa8C\xd7\x9f, num_exts=0], control_msg=, mode7_msg=] +ntp_message 2003:51:6012:121::2 -> 2003:51:6012:110::dcf7:123:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.002213, root_disp=0.044235, kiss_code=, ref_id=, ref_addr=182.165.128.219, ref_v6_hash_prefix=, ref_time=1495804247.476651, org_time=0.0, rec_time=0.0, xmt_time=1495806130.498813, key_id=1, digest=\x1e\xa7\xc3\xd2\xe3\x0e\x08!\x8f\xe3Z$&B\x96\x13, num_exts=0], control_msg=, mode7_msg=] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/ntp.log new file mode 100644 index 0000000000..7b687745d5 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/ntp.log @@ -0,0 +1,49 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path ntp +#open 2019-06-06-14-43-28 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum ReqCode auth_bit sequence implementation err +#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count string count bool count count count +1495804929.483801 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.026230 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495804929.482904 1 \xac\x01{i\x91\\\xe5\xa7\xa9\xfbs\xac\x8b\xd1`; 0 - - - - - - - - - - - - - - +1495804987.484143 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.027100 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495804987.483591 1 3\x03\x03\xf0\xaa\x15`\xf5i\xd8=\xfa\x10S\x80\xd4 0 - - - - - - - - - - - - - - +1495805006.484270 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.027374 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805006.483955 1 \xbb\xdc\x86&\xa6\xfd\x0d\xd5q.4I\x04\xad\xeb\xe1 0 - - - - - - - - - - - - - - +1495805043.485165 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.027939 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805043.484331 1 \x97\x99\x90\x18t\xf8-k\xcdo0\x9945\xe1\xbf 0 - - - - - - - - - - - - - - +1495805081.485865 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.028503 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805081.484917 1 }\xb9\x12\xfe\x8fT\xd2\x0fA\x8c\x86\x90\x9b\xf9\xd1p 0 - - - - - - - - - - - - - - +1495805105.485765 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.028870 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805105.485150 1 \x8e\xb7\xe1\x0e\x86T\xdcsB\x05j\xe0|\xc9i\xa6 0 - - - - - - - - - - - - - - +1495805159.486908 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.029678 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805159.485867 1 .\x16\x11\x9e\xd1\xadJ\x16x}\x03f\x91\x11\x85_ 0 - - - - - - - - - - - - - - +1495805203.487540 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.030334 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805203.486536 1 \x1bu\x87"U\xa3\xbb*\xe7-\xecu`\x88\xb8z 0 - - - - - - - - - - - - - - +1495805207.487345 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.030396 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805207.486593 1 \x10\x8eb\x92\x85\xc1\xd0#\x09\x93\x97\xff\x0a$&/ 0 - - - - - - - - - - - - - - +1495805256.488426 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.031128 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805256.487243 1 \xcc\x1f~\xa1\xdf\xe0.\x9f_,\xa65\x1a[\x01s 0 - - - - - - - - - - - - - - +1495805279.488216 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.031479 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805279.487564 1 }\xfd\xbf\x81\xae\x16\x07\x1b\x987kd\x9255\xf9 0 - - - - - - - - - - - - - - +1495805330.489109 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.032242 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805330.488240 1 \x90\xfc\x8c\x02\xa6w\x1f\xf2\x0aU\xfb\x04\x10\xe9\xe3\xfb 0 - - - - - - - - - - - - - - +1495805357.489015 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.032639 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805357.488596 1 \x96@\x0b\x95\x99W\xd7\xa8\xf6\x06\xf9\xa0B,\x1d\xd8 0 - - - - - - - - - - - - - - +1495805382.489247 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.033020 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805382.488826 1 \xd3\xd7\xd1Vn\xb7\x0e\xceg\xb9C\x0b\xc2\xac\xcc\xab 0 - - - - - - - - - - - - - - +1495805442.490416 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.033920 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805442.489609 1 \x93E\xaa\xdaj\xfc3d\x0c\xd1\xad\xb3\x83ce\xc9 0 - - - - - - - - - - - - - - +1495805451.490156 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.034058 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805451.489738 1 {\xaa\x86\xeb\x99\xb8H\xe4\x8b\x93\x7f\xfe\x84)%\xa4 0 - - - - - - - - - - - - - - +1495805453.490234 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.034088 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805453.489803 1 1D0\x0f\x08\x16\x9fjs\xd4\xef}5\xa1\xf6\x9a 0 - - - - - - - - - - - - - - +1495805461.490303 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.034210 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805461.489877 1 nU~J\x8d\xe9m\xf3\\.\xf1g\xb5loj 0 - - - - - - - - - - - - - - +1495805478.490697 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.034454 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805478.490201 1 \xa4\xf8A\x08\xbf\xda}F%\xf2Fl\x19\xff\xdd\xab 0 - - - - - - - - - - - - - - +1495805504.491041 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.034851 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805504.490512 1 \xb0\xeec=\xb3\x17\xa2\xc5\xab\xe5\x04\x82\xe3\xfcE\xa1 0 - - - - - - - - - - - - - - +1495805532.491194 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.035263 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805532.490810 1 \x0b\xa2\x86M\x0d\xdc%\xbc\xcbi\xe9\x81\xd6\x0d$\x80 0 - - - - - - - - - - - - - - +1495805537.491291 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.035339 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805537.490953 1 \x01\xc1~\xeeJ'\x92g\x0cYI0\x0c\xd7\x91\xb1 0 - - - - - - - - - - - - - - +1495805571.492008 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.035858 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805571.491412 1 i\x90_\x89B\xf0\xe8Nq.\xe2t\xf1_jn 0 - - - - - - - - - - - - - - +1495805634.493022 C4J4Th3PJpwUYZZ6gc 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.036804 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805634.492157 1 \x07p\xf5&\xff\x1b6\x04\xb3\x83/\xb9\xff\xcb\xf2\xc6 0 - - - - - - - - - - - - - - +1495805644.492819 C4J4Th3PJpwUYZZ6gc 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.036942 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805644.492282 1 M\x05\xa9\x90'a\xbajGdb\xe03ZA\xf9 0 - - - - - - - - - - - - - - +1495805696.493954 C4J4Th3PJpwUYZZ6gc 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.037735 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805696.492977 1 \x17B\xcf\xb1y\x88\xdfA\xfe\xc2\x03u"J\xe9\xb0 0 - - - - - - - - - - - - - - +1495805758.494168 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.038666 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805758.493804 1 \x99\xe3\xa8\x0c\xca@\xc1\x0c\x1c\xc9\xec=\x07\xc0d\xc7 0 - - - - - - - - - - - - - - +1495805776.494105 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.038925 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805776.494147 1 T\x1bE\x16,{\x1b\x08\xc9\x05G\xce\xb9\xe2,\x9d 0 - - - - - - - - - - - - - - +1495805815.494785 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.039520 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805815.494543 1 \xb7\xa6\xc2'u\xdc\xcc\x86(\xe0^{\xdd\x8e\xde, 0 - - - - - - - - - - - - - - +1495805864.495551 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.040253 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805864.495286 1 \xfcU\x94Z\xca\x04x\xe0\x93z\xa2K\x89\xc0 \xb7 0 - - - - - - - - - - - - - - +1495805865.495215 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.040268 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805865.495321 1 \xf9& \x1a\xb2}O\xe5\xba\xd9\xfe\x0f\xf4J\x93P 0 - - - - - - - - - - - - - - +1495805916.496467 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.041031 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805916.495973 1 \x8f\x8c\xb7\xcd\xd4{\x8f\x0b\x92\xee~\xa6\x17\x0e\xa1\x0f 0 - - - - - - - - - - - - - - +1495805964.497107 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.041748 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805964.496596 1 L\xe68\xb6\x1d\x1d\x8cq\x0b\xb7\xf0N\xee\x9b\xb2j 0 - - - - - - - - - - - - - - +1495805992.497281 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.042175 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495805992.496969 1 D\xa4>MCS\x90h\x0f=[4u\xd0\x1f\x9f 0 - - - - - - - - - - - - - - +1495806035.498089 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.042816 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495806035.497545 1 U\xcb]\xd3"NV\xb9[W\xa5!\xddl\x1f4 0 - - - - - - - - - - - - - - +1495806055.497837 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.043106 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495806055.497725 1 Y\xdc\xc7]#\xb3\x9bV\xf7\x1b\xb3[\x8e\x836! 0 - - - - - - - - - - - - - - +1495806069.497947 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.043320 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495806069.497937 1 \xd1-O\xc7-\xac\x10\x19\xa9h\xe4\x81;\xb4\x01e 0 - - - - - - - - - - - - - - +1495806080.498110 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.043488 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495806080.498132 1 \xe0\xa3^\x9ck*qa\x85\x1aVA|bJA 0 - - - - - - - - - - - - - - +1495806100.498331 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.043793 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495806100.498395 1 ;\x03\xae\x8a\xf1}ABj\x87\xa0\xf4\xa8C\xd7\x9f 0 - - - - - - - - - - - - - - +1495806130.498492 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.044235 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495806130.498813 1 \x1e\xa7\xc3\xd2\xe3\x0e\x08!\x8f\xe3Z$&B\x96\x13 0 - - - - - - - - - - - - - - +#close 2019-06-06-14-43-28 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout index ffb4b4f91d..59b1a1966e 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/.stdout @@ -1,32 +1,32 @@ -ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02417, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246548.048352, rec_time=1559246548.076756, xmt_time=1559246614.027421, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.048843, root_disp=0.07135, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245852.721794, org_time=1559246614.027421, rec_time=1559246614.048376, xmt_time=1559246614.048407, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024216, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246550.040662, rec_time=1559246550.063198, xmt_time=1559246617.027452, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.003799, root_disp=0.032959, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245541.537424, org_time=1559246617.027452, rec_time=1559246617.040799, xmt_time=1559246617.040813, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024246, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.074199, rec_time=1559246553.094855, xmt_time=1559246619.027384, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.040375, root_disp=0.001266, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246560.207644, org_time=1559246619.027384, rec_time=1559246619.054018, xmt_time=1559246619.054053, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024261, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246551.034239, rec_time=1559246551.058223, xmt_time=1559246620.027408, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024261, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.067084, rec_time=1559246553.088704, xmt_time=1559246620.027461, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024261, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246554.041266, rec_time=1559246554.063055, xmt_time=1559246620.027475, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.003235, root_disp=0.000275, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246481.481997, org_time=1559246620.027461, rec_time=1559246620.040139, xmt_time=1559246620.040206, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013397, root_disp=0.053787, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559244627.070973, org_time=1559246620.027408, rec_time=1559246620.043959, xmt_time=1559246620.043985, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000001, root_delay=0.00351, root_disp=0.036545, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245278.44239, org_time=1559246620.027475, rec_time=1559246620.048058, xmt_time=1559246620.048074, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024277, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.072776, rec_time=1559246553.094814, xmt_time=1559246621.027421, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.01091, root_disp=0.033463, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245577.265702, org_time=1559246621.027421, rec_time=1559246621.073143, xmt_time=1559246621.073172, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246556.043833, rec_time=1559246556.073681, xmt_time=1559246622.027384, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.078959, rec_time=1559246553.100708, xmt_time=1559246622.027446, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.085177, rec_time=1559246553.102587, xmt_time=1559246622.027464, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246554.041367, rec_time=1559246554.069181, xmt_time=1559246622.027478, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013733, root_disp=0.041672, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245709.302032, org_time=1559246622.027446, rec_time=1559246622.071899, xmt_time=1559246622.071924, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000002, root_delay=0.00351, root_disp=0.038559, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245178.020777, org_time=1559246622.027478, rec_time=1559246622.068521, xmt_time=1559246622.06856, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.0, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=GPS\x00, ref_time=1559246622.0, org_time=1559246622.027384, rec_time=1559246622.073734, xmt_time=1559246622.07374, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.03743, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246622.027464, rec_time=1559246622.086267, xmt_time=1559246622.086348, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024307, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246556.032041, rec_time=1559246556.054612, xmt_time=1559246623.027478, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024307, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246555.051459, rec_time=1559246555.077253, xmt_time=1559246623.027521, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.025391, root_disp=0.011642, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246412.455332, org_time=1559246623.027478, rec_time=1559246623.041209, xmt_time=1559246623.04122, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.036835, root_disp=0.046951, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245789.870424, org_time=1559246623.027521, rec_time=1559246623.04836, xmt_time=1559246623.048416, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024353, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246557.07812, rec_time=1559246557.097844, xmt_time=1559246626.027432, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024353, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246558.043947, rec_time=1559246558.067904, xmt_time=1559246626.027514, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013535, root_disp=0.025497, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246283.180069, org_time=1559246626.027514, rec_time=1559246626.044105, xmt_time=1559246626.044139, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.037491, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246626.027432, rec_time=1559246626.058084, xmt_time=1559246626.058151, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024368, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246560.040576, rec_time=1559246560.064668, xmt_time=1559246627.027459, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=4, std_msg=[stratum=3, poll=64.0, precision=0.000001, root_delay=0.011765, root_disp=0.001526, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245638.390748, org_time=1559246627.027459, rec_time=1559246627.050401, xmt_time=1559246627.050438, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02417, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246548.048352, rec_time=1559246548.076756, xmt_time=1559246614.027421, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.048843, root_disp=0.07135, kiss_code=, ref_id=, ref_addr=105.237.207.28, ref_v6_hash_prefix=, ref_time=1559245852.721794, org_time=1559246614.027421, rec_time=1559246614.048376, xmt_time=1559246614.048407, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024216, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246550.040662, rec_time=1559246550.063198, xmt_time=1559246617.027452, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.003799, root_disp=0.032959, kiss_code=, ref_id=, ref_addr=193.204.114.233, ref_v6_hash_prefix=, ref_time=1559245541.537424, org_time=1559246617.027452, rec_time=1559246617.040799, xmt_time=1559246617.040813, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024246, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.074199, rec_time=1559246553.094855, xmt_time=1559246619.027384, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.040375, root_disp=0.001266, kiss_code=, ref_id=, ref_addr=195.113.144.238, ref_v6_hash_prefix=, ref_time=1559246560.207644, org_time=1559246619.027384, rec_time=1559246619.054018, xmt_time=1559246619.054053, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024261, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246551.034239, rec_time=1559246551.058223, xmt_time=1559246620.027408, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024261, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.067084, rec_time=1559246553.088704, xmt_time=1559246620.027461, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024261, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246554.041266, rec_time=1559246554.063055, xmt_time=1559246620.027475, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.003235, root_disp=0.000275, kiss_code=, ref_id=, ref_addr=193.204.114.233, ref_v6_hash_prefix=, ref_time=1559246481.481997, org_time=1559246620.027461, rec_time=1559246620.040139, xmt_time=1559246620.040206, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013397, root_disp=0.053787, kiss_code=, ref_id=, ref_addr=193.204.114.233, ref_v6_hash_prefix=, ref_time=1559244627.070973, org_time=1559246620.027408, rec_time=1559246620.043959, xmt_time=1559246620.043985, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000001, root_delay=0.00351, root_disp=0.036545, kiss_code=, ref_id=, ref_addr=193.204.114.232, ref_v6_hash_prefix=, ref_time=1559245278.44239, org_time=1559246620.027475, rec_time=1559246620.048058, xmt_time=1559246620.048074, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024277, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.072776, rec_time=1559246553.094814, xmt_time=1559246621.027421, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.01091, root_disp=0.033463, kiss_code=, ref_id=, ref_addr=193.204.114.233, ref_v6_hash_prefix=, ref_time=1559245577.265702, org_time=1559246621.027421, rec_time=1559246621.073143, xmt_time=1559246621.073172, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246556.043833, rec_time=1559246556.073681, xmt_time=1559246622.027384, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.078959, rec_time=1559246553.100708, xmt_time=1559246622.027446, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246553.085177, rec_time=1559246553.102587, xmt_time=1559246622.027464, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024292, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246554.041367, rec_time=1559246554.069181, xmt_time=1559246622.027478, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013733, root_disp=0.041672, kiss_code=, ref_id=, ref_addr=193.204.114.233, ref_v6_hash_prefix=, ref_time=1559245709.302032, org_time=1559246622.027446, rec_time=1559246622.071899, xmt_time=1559246622.071924, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000002, root_delay=0.00351, root_disp=0.038559, kiss_code=, ref_id=, ref_addr=193.204.114.232, ref_v6_hash_prefix=, ref_time=1559245178.020777, org_time=1559246622.027478, rec_time=1559246622.068521, xmt_time=1559246622.06856, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.0, kiss_code=, ref_id=GPS\x00, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246622.0, org_time=1559246622.027384, rec_time=1559246622.073734, xmt_time=1559246622.07374, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.03743, kiss_code=, ref_id=, ref_addr=212.7.1.132, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246622.027464, rec_time=1559246622.086267, xmt_time=1559246622.086348, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024307, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246556.032041, rec_time=1559246556.054612, xmt_time=1559246623.027478, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024307, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246555.051459, rec_time=1559246555.077253, xmt_time=1559246623.027521, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.025391, root_disp=0.011642, kiss_code=, ref_id=, ref_addr=193.204.114.233, ref_v6_hash_prefix=, ref_time=1559246412.455332, org_time=1559246623.027478, rec_time=1559246623.041209, xmt_time=1559246623.04122, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.036835, root_disp=0.046951, kiss_code=, ref_id=, ref_addr=73.98.4.223, ref_v6_hash_prefix=, ref_time=1559245789.870424, org_time=1559246623.027521, rec_time=1559246623.04836, xmt_time=1559246623.048416, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024353, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246557.07812, rec_time=1559246557.097844, xmt_time=1559246626.027432, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024353, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246558.043947, rec_time=1559246558.067904, xmt_time=1559246626.027514, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013535, root_disp=0.025497, kiss_code=, ref_id=, ref_addr=193.204.114.232, ref_v6_hash_prefix=, ref_time=1559246283.180069, org_time=1559246626.027514, rec_time=1559246626.044105, xmt_time=1559246626.044139, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.037491, kiss_code=, ref_id=, ref_addr=212.7.1.132, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246626.027432, rec_time=1559246626.058084, xmt_time=1559246626.058151, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.024368, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246560.040576, rec_time=1559246560.064668, xmt_time=1559246627.027459, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=4, std_msg=[stratum=3, poll=64.0, precision=0.000001, root_delay=0.011765, root_disp=0.001526, kiss_code=, ref_id=, ref_addr=185.19.184.35, ref_v6_hash_prefix=, ref_time=1559245638.390748, org_time=1559246627.027459, rec_time=1559246627.050401, xmt_time=1559246627.050438, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log index 382f3f6ed7..f69cae6089 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log @@ -3,39 +3,39 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-05-09-15-37 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ReqCode auth_bit sequence implementation err -#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count bool count count count -1559246614.027454 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 3 2 64.000000 0.000000 0.046280 0.024170 - - - - 1559246556.073681 1559246548.048352 1559246548.076756 1559246614.027421 - - 0 - - - - - - - - - - - - -1559246614.074475 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 4 4 64.000000 0.000000 0.048843 0.071350 - - - - 1559245852.721794 1559246614.027421 1559246614.048376 1559246614.048407 - - 0 - - - - - - - - - - - - -1559246617.027486 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 3 2 64.000000 0.000000 0.046280 0.024216 - - - - 1559246556.073681 1559246550.040662 1559246550.063198 1559246617.027452 - - 0 - - - - - - - - - - - - -1559246617.063504 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 4 2 64.000000 0.000000 0.003799 0.032959 - - - - 1559245541.537424 1559246617.027452 1559246617.040799 1559246617.040813 - - 0 - - - - - - - - - - - - -1559246619.027413 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 3 2 64.000000 0.000000 0.046280 0.024246 - - - - 1559246556.073681 1559246553.074199 1559246553.094855 1559246619.027384 - - 0 - - - - - - - - - - - - -1559246619.074513 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 4 2 64.000000 0.000000 0.040375 0.001266 - - - - 1559246560.207644 1559246619.027384 1559246619.054018 1559246619.054053 - - 0 - - - - - - - - - - - - -1559246620.027437 CtPZjS20MLrsMUOJi2 192.168.43.118 123 188.213.165.209 123 4 3 2 64.000000 0.000000 0.046280 0.024261 - - - - 1559246556.073681 1559246551.034239 1559246551.058223 1559246620.027408 - - 0 - - - - - - - - - - - - -1559246620.027466 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 185.19.184.35 123 4 3 2 64.000000 0.000000 0.046280 0.024261 - - - - 1559246556.073681 1559246553.067084 1559246553.088704 1559246620.027461 - - 0 - - - - - - - - - - - - -1559246620.027480 CmES5u32sYpV7JYN 192.168.43.118 123 212.45.144.3 123 4 3 2 64.000000 0.000000 0.046280 0.024261 - - - - 1559246556.073681 1559246554.041266 1559246554.063055 1559246620.027475 - - 0 - - - - - - - - - - - - -1559246620.059693 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 185.19.184.35 123 4 4 2 64.000000 0.000008 0.003235 0.000275 - - - - 1559246481.481997 1559246620.027461 1559246620.040139 1559246620.040206 - - 0 - - - - - - - - - - - - -1559246620.065302 CtPZjS20MLrsMUOJi2 192.168.43.118 123 188.213.165.209 123 4 4 2 64.000000 0.000000 0.013397 0.053787 - - - - 1559244627.070973 1559246620.027408 1559246620.043959 1559246620.043985 - - 0 - - - - - - - - - - - - -1559246620.065335 CmES5u32sYpV7JYN 192.168.43.118 123 212.45.144.3 123 4 4 2 64.000000 0.000001 0.003510 0.036545 - - - - 1559245278.442390 1559246620.027475 1559246620.048058 1559246620.048074 - - 0 - - - - - - - - - - - - -1559246621.027458 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 3 2 64.000000 0.000000 0.046280 0.024277 - - - - 1559246556.073681 1559246553.072776 1559246553.094814 1559246621.027421 - - 0 - - - - - - - - - - - - -1559246621.095645 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 4 2 64.000000 0.000000 0.010910 0.033463 - - - - 1559245577.265702 1559246621.027421 1559246621.073143 1559246621.073172 - - 0 - - - - - - - - - - - - -1559246622.027418 C37jN32gN3y3AZzyf6 192.168.43.118 123 85.199.214.99 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - - - 1559246556.073681 1559246556.043833 1559246556.073681 1559246622.027384 - - 0 - - - - - - - - - - - - -1559246622.027454 C3eiCBGOLw3VtHfOj 192.168.43.118 123 94.177.187.22 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - - - 1559246556.073681 1559246553.078959 1559246553.100708 1559246622.027446 - - 0 - - - - - - - - - - - - -1559246622.027471 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 147.135.207.214 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - - - 1559246556.073681 1559246553.085177 1559246553.102587 1559246622.027464 - - 0 - - - - - - - - - - - - -1559246622.027484 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - - - 1559246556.073681 1559246554.041367 1559246554.069181 1559246622.027478 - - 0 - - - - - - - - - - - - -1559246622.092519 C3eiCBGOLw3VtHfOj 192.168.43.118 123 94.177.187.22 123 4 4 2 64.000000 0.000000 0.013733 0.041672 - - - - 1559245709.302032 1559246622.027446 1559246622.071899 1559246622.071924 - - 0 - - - - - - - - - - - - -1559246622.092556 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 4 2 64.000000 0.000002 0.003510 0.038559 - - - - 1559245178.020777 1559246622.027478 1559246622.068521 1559246622.068560 - - 0 - - - - - - - - - - - - -1559246622.100109 C37jN32gN3y3AZzyf6 192.168.43.118 123 85.199.214.99 123 4 4 1 16.000000 0.000000 0.000000 0.000000 - - - - 1559246622.000000 1559246622.027384 1559246622.073734 1559246622.073740 - - 0 - - - - - - - - - - - - -1559246622.100152 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 147.135.207.214 123 4 4 2 64.000000 0.000008 0.042236 0.037430 - - - - 1559245356.576177 1559246622.027464 1559246622.086267 1559246622.086348 - - 0 - - - - - - - - - - - - -1559246623.027502 CFLRIC3zaTU1loLGxh 192.168.43.118 123 93.41.196.243 123 4 3 2 64.000000 0.000000 0.046280 0.024307 - - - - 1559246556.073681 1559246556.032041 1559246556.054612 1559246623.027478 - - 0 - - - - - - - - - - - - -1559246623.027531 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.171.177 123 4 3 2 64.000000 0.000000 0.046280 0.024307 - - - - 1559246556.073681 1559246555.051459 1559246555.077253 1559246623.027521 - - 0 - - - - - - - - - - - - -1559246623.062844 CFLRIC3zaTU1loLGxh 192.168.43.118 123 93.41.196.243 123 4 4 2 64.000000 0.000000 0.025391 0.011642 - - - - 1559246412.455332 1559246623.027478 1559246623.041209 1559246623.041220 - - 0 - - - - - - - - - - - - -1559246623.070217 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.171.177 123 4 4 4 64.000000 0.000000 0.036835 0.046951 - - - - 1559245789.870424 1559246623.027521 1559246623.048360 1559246623.048416 - - 0 - - - - - - - - - - - - -1559246626.027461 Ck51lg1bScffFj34Ri 192.168.43.118 123 147.135.207.213 123 4 3 2 64.000000 0.000000 0.046280 0.024353 - - - - 1559246556.073681 1559246557.078120 1559246557.097844 1559246626.027432 - - 0 - - - - - - - - - - - - -1559246626.027518 C9mvWx3ezztgzcexV7 192.168.43.118 123 80.211.155.206 123 4 3 2 64.000000 0.000000 0.046280 0.024353 - - - - 1559246556.073681 1559246558.043947 1559246558.067904 1559246626.027514 - - 0 - - - - - - - - - - - - -1559246626.065984 C9mvWx3ezztgzcexV7 192.168.43.118 123 80.211.155.206 123 4 4 2 64.000000 0.000000 0.013535 0.025497 - - - - 1559246283.180069 1559246626.027514 1559246626.044105 1559246626.044139 - - 0 - - - - - - - - - - - - -1559246626.075079 Ck51lg1bScffFj34Ri 192.168.43.118 123 147.135.207.213 123 4 4 2 64.000000 0.000008 0.042236 0.037491 - - - - 1559245356.576177 1559246626.027432 1559246626.058084 1559246626.058151 - - 0 - - - - - - - - - - - - -1559246627.027502 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.88.132 123 3 3 2 64.000000 0.000000 0.046280 0.024368 - - - - 1559246556.073681 1559246560.040576 1559246560.064668 1559246627.027459 - - 0 - - - - - - - - - - - - -1559246627.073485 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.88.132 123 3 4 3 64.000000 0.000001 0.011765 0.001526 - - - - 1559245638.390748 1559246627.027459 1559246627.050401 1559246627.050438 - - 0 - - - - - - - - - - - - -#close 2019-06-05-09-15-37 +#open 2019-06-06-14-36-12 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum ReqCode auth_bit sequence implementation err +#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count string count bool count count count +1559246614.027454 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 3 2 64.000000 0.000000 0.046280 0.024170 - - 85.199.214.99 - 1559246556.073681 1559246548.048352 1559246548.076756 1559246614.027421 - - 0 - - - - - - - - - - - - - - +1559246614.074475 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 4 4 64.000000 0.000000 0.048843 0.071350 - - 105.237.207.28 - 1559245852.721794 1559246614.027421 1559246614.048376 1559246614.048407 - - 0 - - - - - - - - - - - - - - +1559246617.027486 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 3 2 64.000000 0.000000 0.046280 0.024216 - - 85.199.214.99 - 1559246556.073681 1559246550.040662 1559246550.063198 1559246617.027452 - - 0 - - - - - - - - - - - - - - +1559246617.063504 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 4 2 64.000000 0.000000 0.003799 0.032959 - - 193.204.114.233 - 1559245541.537424 1559246617.027452 1559246617.040799 1559246617.040813 - - 0 - - - - - - - - - - - - - - +1559246619.027413 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 3 2 64.000000 0.000000 0.046280 0.024246 - - 85.199.214.99 - 1559246556.073681 1559246553.074199 1559246553.094855 1559246619.027384 - - 0 - - - - - - - - - - - - - - +1559246619.074513 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 4 2 64.000000 0.000000 0.040375 0.001266 - - 195.113.144.238 - 1559246560.207644 1559246619.027384 1559246619.054018 1559246619.054053 - - 0 - - - - - - - - - - - - - - +1559246620.027437 CtPZjS20MLrsMUOJi2 192.168.43.118 123 188.213.165.209 123 4 3 2 64.000000 0.000000 0.046280 0.024261 - - 85.199.214.99 - 1559246556.073681 1559246551.034239 1559246551.058223 1559246620.027408 - - 0 - - - - - - - - - - - - - - +1559246620.027466 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 185.19.184.35 123 4 3 2 64.000000 0.000000 0.046280 0.024261 - - 85.199.214.99 - 1559246556.073681 1559246553.067084 1559246553.088704 1559246620.027461 - - 0 - - - - - - - - - - - - - - +1559246620.027480 CmES5u32sYpV7JYN 192.168.43.118 123 212.45.144.3 123 4 3 2 64.000000 0.000000 0.046280 0.024261 - - 85.199.214.99 - 1559246556.073681 1559246554.041266 1559246554.063055 1559246620.027475 - - 0 - - - - - - - - - - - - - - +1559246620.059693 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 185.19.184.35 123 4 4 2 64.000000 0.000008 0.003235 0.000275 - - 193.204.114.233 - 1559246481.481997 1559246620.027461 1559246620.040139 1559246620.040206 - - 0 - - - - - - - - - - - - - - +1559246620.065302 CtPZjS20MLrsMUOJi2 192.168.43.118 123 188.213.165.209 123 4 4 2 64.000000 0.000000 0.013397 0.053787 - - 193.204.114.233 - 1559244627.070973 1559246620.027408 1559246620.043959 1559246620.043985 - - 0 - - - - - - - - - - - - - - +1559246620.065335 CmES5u32sYpV7JYN 192.168.43.118 123 212.45.144.3 123 4 4 2 64.000000 0.000001 0.003510 0.036545 - - 193.204.114.232 - 1559245278.442390 1559246620.027475 1559246620.048058 1559246620.048074 - - 0 - - - - - - - - - - - - - - +1559246621.027458 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 3 2 64.000000 0.000000 0.046280 0.024277 - - 85.199.214.99 - 1559246556.073681 1559246553.072776 1559246553.094814 1559246621.027421 - - 0 - - - - - - - - - - - - - - +1559246621.095645 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 4 2 64.000000 0.000000 0.010910 0.033463 - - 193.204.114.233 - 1559245577.265702 1559246621.027421 1559246621.073143 1559246621.073172 - - 0 - - - - - - - - - - - - - - +1559246622.027418 C37jN32gN3y3AZzyf6 192.168.43.118 123 85.199.214.99 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - 85.199.214.99 - 1559246556.073681 1559246556.043833 1559246556.073681 1559246622.027384 - - 0 - - - - - - - - - - - - - - +1559246622.027454 C3eiCBGOLw3VtHfOj 192.168.43.118 123 94.177.187.22 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - 85.199.214.99 - 1559246556.073681 1559246553.078959 1559246553.100708 1559246622.027446 - - 0 - - - - - - - - - - - - - - +1559246622.027471 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 147.135.207.214 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - 85.199.214.99 - 1559246556.073681 1559246553.085177 1559246553.102587 1559246622.027464 - - 0 - - - - - - - - - - - - - - +1559246622.027484 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 3 2 64.000000 0.000000 0.046280 0.024292 - - 85.199.214.99 - 1559246556.073681 1559246554.041367 1559246554.069181 1559246622.027478 - - 0 - - - - - - - - - - - - - - +1559246622.092519 C3eiCBGOLw3VtHfOj 192.168.43.118 123 94.177.187.22 123 4 4 2 64.000000 0.000000 0.013733 0.041672 - - 193.204.114.233 - 1559245709.302032 1559246622.027446 1559246622.071899 1559246622.071924 - - 0 - - - - - - - - - - - - - - +1559246622.092556 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 4 2 64.000000 0.000002 0.003510 0.038559 - - 193.204.114.232 - 1559245178.020777 1559246622.027478 1559246622.068521 1559246622.068560 - - 0 - - - - - - - - - - - - - - +1559246622.100109 C37jN32gN3y3AZzyf6 192.168.43.118 123 85.199.214.99 123 4 4 1 16.000000 0.000000 0.000000 0.000000 - GPS\x00 - - 1559246622.000000 1559246622.027384 1559246622.073734 1559246622.073740 - - 0 - - - - - - - - - - - - - - +1559246622.100152 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 147.135.207.214 123 4 4 2 64.000000 0.000008 0.042236 0.037430 - - 212.7.1.132 - 1559245356.576177 1559246622.027464 1559246622.086267 1559246622.086348 - - 0 - - - - - - - - - - - - - - +1559246623.027502 CFLRIC3zaTU1loLGxh 192.168.43.118 123 93.41.196.243 123 4 3 2 64.000000 0.000000 0.046280 0.024307 - - 85.199.214.99 - 1559246556.073681 1559246556.032041 1559246556.054612 1559246623.027478 - - 0 - - - - - - - - - - - - - - +1559246623.027531 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.171.177 123 4 3 2 64.000000 0.000000 0.046280 0.024307 - - 85.199.214.99 - 1559246556.073681 1559246555.051459 1559246555.077253 1559246623.027521 - - 0 - - - - - - - - - - - - - - +1559246623.062844 CFLRIC3zaTU1loLGxh 192.168.43.118 123 93.41.196.243 123 4 4 2 64.000000 0.000000 0.025391 0.011642 - - 193.204.114.233 - 1559246412.455332 1559246623.027478 1559246623.041209 1559246623.041220 - - 0 - - - - - - - - - - - - - - +1559246623.070217 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.171.177 123 4 4 4 64.000000 0.000000 0.036835 0.046951 - - 73.98.4.223 - 1559245789.870424 1559246623.027521 1559246623.048360 1559246623.048416 - - 0 - - - - - - - - - - - - - - +1559246626.027461 Ck51lg1bScffFj34Ri 192.168.43.118 123 147.135.207.213 123 4 3 2 64.000000 0.000000 0.046280 0.024353 - - 85.199.214.99 - 1559246556.073681 1559246557.078120 1559246557.097844 1559246626.027432 - - 0 - - - - - - - - - - - - - - +1559246626.027518 C9mvWx3ezztgzcexV7 192.168.43.118 123 80.211.155.206 123 4 3 2 64.000000 0.000000 0.046280 0.024353 - - 85.199.214.99 - 1559246556.073681 1559246558.043947 1559246558.067904 1559246626.027514 - - 0 - - - - - - - - - - - - - - +1559246626.065984 C9mvWx3ezztgzcexV7 192.168.43.118 123 80.211.155.206 123 4 4 2 64.000000 0.000000 0.013535 0.025497 - - 193.204.114.232 - 1559246283.180069 1559246626.027514 1559246626.044105 1559246626.044139 - - 0 - - - - - - - - - - - - - - +1559246626.075079 Ck51lg1bScffFj34Ri 192.168.43.118 123 147.135.207.213 123 4 4 2 64.000000 0.000008 0.042236 0.037491 - - 212.7.1.132 - 1559245356.576177 1559246626.027432 1559246626.058084 1559246626.058151 - - 0 - - - - - - - - - - - - - - +1559246627.027502 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.88.132 123 3 3 2 64.000000 0.000000 0.046280 0.024368 - - 85.199.214.99 - 1559246556.073681 1559246560.040576 1559246560.064668 1559246627.027459 - - 0 - - - - - - - - - - - - - - +1559246627.073485 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.88.132 123 3 4 3 64.000000 0.000001 0.011765 0.001526 - - 185.19.184.35 - 1559245638.390748 1559246627.027459 1559246627.050401 1559246627.050438 - - 0 - - - - - - - - - - - - - - +#close 2019-06-06-14-36-13 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout index ac82db736a..64f538e4b5 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout @@ -1,35 +1,35 @@ -ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028229, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246818.058351, rec_time=1559246818.079217, xmt_time=1559246885.027449, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.048843, root_disp=0.075409, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245852.721794, org_time=1559246885.027449, rec_time=1559246885.069212, xmt_time=1559246885.069247, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028259, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246820.060608, rec_time=1559246820.081498, xmt_time=1559246887.027425, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.003799, root_disp=0.037018, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245541.537424, org_time=1559246887.027425, rec_time=1559246887.050758, xmt_time=1559246887.050774, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028275, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246819.064014, rec_time=1559246819.079147, xmt_time=1559246888.027454, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028275, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246822.050275, rec_time=1559246822.064562, xmt_time=1559246888.030021, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.003235, root_disp=0.000565, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246481.481997, org_time=1559246888.030021, rec_time=1559246888.22033, xmt_time=1559246888.220401, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.040375, root_disp=0.001236, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246882.967102, org_time=1559246888.027454, rec_time=1559246888.234035, xmt_time=1559246888.234061, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02829, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246822.05809, rec_time=1559246822.069097, xmt_time=1559246889.027449, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000001, root_delay=0.00351, root_disp=0.040573, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245278.44239, org_time=1559246889.027449, rec_time=1559246889.061203, xmt_time=1559246889.06122, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028305, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246824.073855, rec_time=1559246824.095227, xmt_time=1559246890.027469, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028305, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246821.052836, rec_time=1559246821.069165, xmt_time=1559246890.027512, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028305, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246823.12395, rec_time=1559246823.295751, xmt_time=1559246890.027523, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013596, root_disp=0.025208, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246828.086879, org_time=1559246890.027523, rec_time=1559246890.060644, xmt_time=1559246890.060687, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.01091, root_disp=0.037491, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245577.265702, org_time=1559246890.027512, rec_time=1559246890.069012, xmt_time=1559246890.069048, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.0, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=GPS\x00, ref_time=1559246890.0, org_time=1559246890.027469, rec_time=1559246890.070262, xmt_time=1559246890.070268, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02832, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246822.05173, rec_time=1559246822.067161, xmt_time=1559246891.027395, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02832, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246825.052045, rec_time=1559246825.066358, xmt_time=1559246891.029953, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.025391, root_disp=0.015671, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246412.455332, org_time=1559246891.027395, rec_time=1559246891.051818, xmt_time=1559246891.051827, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013657, root_disp=0.025818, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246788.670839, org_time=1559246891.029953, rec_time=1559246891.061992, xmt_time=1559246891.062023, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028336, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246824.061335, rec_time=1559246824.08282, xmt_time=1559246892.027401, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000002, root_delay=0.00351, root_disp=0.042603, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245178.020777, org_time=1559246892.027401, rec_time=1559246892.05139, xmt_time=1559246892.051436, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028366, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246825.064608, rec_time=1559246825.074985, xmt_time=1559246894.027491, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.041504, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246894.027491, rec_time=1559246894.059304, xmt_time=1559246894.05938, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028427, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246829.060691, rec_time=1559246829.079018, xmt_time=1559246898.027403, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028427, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246830.0714, rec_time=1559246830.08971, xmt_time=1559246898.029953, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=4, std_msg=[stratum=3, poll=64.0, precision=0.000001, root_delay=0.011917, root_disp=0.000565, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246667.219303, org_time=1559246898.027403, rec_time=1559246898.077958, xmt_time=1559246898.078029, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.036819, root_disp=0.050842, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246822.40751, org_time=1559246898.029953, rec_time=1559246898.078347, xmt_time=1559246898.07843, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028458, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246833.067975, rec_time=1559246833.07965, xmt_time=1559246900.027439, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028458, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246831.053954, rec_time=1559246831.069547, xmt_time=1559246900.030036, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013535, root_disp=0.029602, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246283.180069, org_time=1559246900.030036, rec_time=1559246900.08881, xmt_time=1559246900.088844, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.041595, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246900.027439, rec_time=1559246900.103765, xmt_time=1559246900.103887, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=4, mode=3, std_msg=[stratum=0, poll=16.0, precision=0.015625, root_delay=1.0, root_disp=1.0, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1101309131.444112, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.000122, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=CTD\x00, ref_time=1559246910.937978, org_time=1101309131.444112, rec_time=1559246940.281161, xmt_time=1559246940.281191, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028229, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246818.058351, rec_time=1559246818.079217, xmt_time=1559246885.027449, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.52.109:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.048843, root_disp=0.075409, kiss_code=, ref_id=, ref_addr=105.237.207.28, ref_v6_hash_prefix=, ref_time=1559245852.721794, org_time=1559246885.027449, rec_time=1559246885.069212, xmt_time=1559246885.069247, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028259, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246820.060608, rec_time=1559246820.081498, xmt_time=1559246887.027425, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.88:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.003799, root_disp=0.037018, kiss_code=, ref_id=, ref_addr=193.204.114.233, ref_v6_hash_prefix=, ref_time=1559245541.537424, org_time=1559246887.027425, rec_time=1559246887.050758, xmt_time=1559246887.050774, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028275, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246819.064014, rec_time=1559246819.079147, xmt_time=1559246888.027454, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028275, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246822.050275, rec_time=1559246822.064562, xmt_time=1559246888.030021, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 185.19.184.35:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.003235, root_disp=0.000565, kiss_code=, ref_id=, ref_addr=193.204.114.233, ref_v6_hash_prefix=, ref_time=1559246481.481997, org_time=1559246888.030021, rec_time=1559246888.22033, xmt_time=1559246888.220401, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.131.188:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.040375, root_disp=0.001236, kiss_code=, ref_id=, ref_addr=195.113.144.238, ref_v6_hash_prefix=, ref_time=1559246882.967102, org_time=1559246888.027454, rec_time=1559246888.234035, xmt_time=1559246888.234061, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02829, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246822.05809, rec_time=1559246822.069097, xmt_time=1559246889.027449, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.3:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000001, root_delay=0.00351, root_disp=0.040573, kiss_code=, ref_id=, ref_addr=193.204.114.232, ref_v6_hash_prefix=, ref_time=1559245278.44239, org_time=1559246889.027449, rec_time=1559246889.061203, xmt_time=1559246889.06122, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028305, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246824.073855, rec_time=1559246824.095227, xmt_time=1559246890.027469, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028305, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246821.052836, rec_time=1559246821.069165, xmt_time=1559246890.027512, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028305, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246823.12395, rec_time=1559246823.295751, xmt_time=1559246890.027523, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 188.213.165.209:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013596, root_disp=0.025208, kiss_code=, ref_id=, ref_addr=193.204.114.232, ref_v6_hash_prefix=, ref_time=1559246828.086879, org_time=1559246890.027523, rec_time=1559246890.060644, xmt_time=1559246890.060687, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 31.14.133.122:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.01091, root_disp=0.037491, kiss_code=, ref_id=, ref_addr=193.204.114.233, ref_v6_hash_prefix=, ref_time=1559245577.265702, org_time=1559246890.027512, rec_time=1559246890.069012, xmt_time=1559246890.069048, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 85.199.214.99:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.0, kiss_code=, ref_id=GPS\x00, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246890.0, org_time=1559246890.027469, rec_time=1559246890.070262, xmt_time=1559246890.070268, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02832, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246822.05173, rec_time=1559246822.067161, xmt_time=1559246891.027395, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.02832, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246825.052045, rec_time=1559246825.066358, xmt_time=1559246891.029953, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 93.41.196.243:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.025391, root_disp=0.015671, kiss_code=, ref_id=, ref_addr=193.204.114.233, ref_v6_hash_prefix=, ref_time=1559246412.455332, org_time=1559246891.027395, rec_time=1559246891.051818, xmt_time=1559246891.051827, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 94.177.187.22:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013657, root_disp=0.025818, kiss_code=, ref_id=, ref_addr=193.204.114.233, ref_v6_hash_prefix=, ref_time=1559246788.670839, org_time=1559246891.029953, rec_time=1559246891.061992, xmt_time=1559246891.062023, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028336, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246824.061335, rec_time=1559246824.08282, xmt_time=1559246892.027401, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 212.45.144.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000002, root_delay=0.00351, root_disp=0.042603, kiss_code=, ref_id=, ref_addr=193.204.114.232, ref_v6_hash_prefix=, ref_time=1559245178.020777, org_time=1559246892.027401, rec_time=1559246892.05139, xmt_time=1559246892.051436, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028366, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246825.064608, rec_time=1559246825.074985, xmt_time=1559246894.027491, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.214:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.041504, kiss_code=, ref_id=, ref_addr=212.7.1.132, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246894.027491, rec_time=1559246894.059304, xmt_time=1559246894.05938, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028427, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246829.060691, rec_time=1559246829.079018, xmt_time=1559246898.027403, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028427, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246830.0714, rec_time=1559246830.08971, xmt_time=1559246898.029953, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.88.132:123 [version=3, mode=4, std_msg=[stratum=3, poll=64.0, precision=0.000001, root_delay=0.011917, root_disp=0.000565, kiss_code=, ref_id=, ref_addr=185.19.184.35, ref_v6_hash_prefix=, ref_time=1559246667.219303, org_time=1559246898.027403, rec_time=1559246898.077958, xmt_time=1559246898.078029, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.171.177:123 [version=4, mode=4, std_msg=[stratum=4, poll=64.0, precision=0, root_delay=0.036819, root_disp=0.050842, kiss_code=, ref_id=, ref_addr=73.98.4.223, ref_v6_hash_prefix=, ref_time=1559246822.40751, org_time=1559246898.029953, rec_time=1559246898.078347, xmt_time=1559246898.07843, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028458, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246833.067975, rec_time=1559246833.07965, xmt_time=1559246900.027439, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=3, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.04628, root_disp=0.028458, kiss_code=, ref_id=, ref_addr=85.199.214.99, ref_v6_hash_prefix=, ref_time=1559246556.073681, org_time=1559246831.053954, rec_time=1559246831.069547, xmt_time=1559246900.030036, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0, root_delay=0.013535, root_disp=0.029602, kiss_code=, ref_id=, ref_addr=193.204.114.232, ref_v6_hash_prefix=, ref_time=1559246283.180069, org_time=1559246900.030036, rec_time=1559246900.08881, xmt_time=1559246900.088844, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.041595, kiss_code=, ref_id=, ref_addr=212.7.1.132, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246900.027439, rec_time=1559246900.103765, xmt_time=1559246900.103887, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=4, mode=3, std_msg=[stratum=0, poll=16.0, precision=0.015625, root_delay=1.0, root_disp=1.0, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1101309131.444112, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.000122, kiss_code=, ref_id=CTD\x00, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246910.937978, org_time=1101309131.444112, rec_time=1559246940.281161, xmt_time=1559246940.281191, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=42, auth_bit=F, sequence=0, implementation=3, err=0, data=]] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log index 4c56431bf0..b8e53bc43b 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log @@ -3,42 +3,42 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-05-09-15-43 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ReqCode auth_bit sequence implementation err -#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count bool count count count -1559246885.027478 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 3 2 64.000000 0.000000 0.046280 0.028229 - - - - 1559246556.073681 1559246818.058351 1559246818.079217 1559246885.027449 - - 0 - - - - - - - - - - - - -1559246885.088815 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 4 4 64.000000 0.000000 0.048843 0.075409 - - - - 1559245852.721794 1559246885.027449 1559246885.069212 1559246885.069247 - - 0 - - - - - - - - - - - - -1559246887.027467 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 3 2 64.000000 0.000000 0.046280 0.028259 - - - - 1559246556.073681 1559246820.060608 1559246820.081498 1559246887.027425 - - 0 - - - - - - - - - - - - -1559246887.060766 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 4 2 64.000000 0.000000 0.003799 0.037018 - - - - 1559245541.537424 1559246887.027425 1559246887.050758 1559246887.050774 - - 0 - - - - - - - - - - - - -1559246888.027489 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 3 2 64.000000 0.000000 0.046280 0.028275 - - - - 1559246556.073681 1559246819.064014 1559246819.079147 1559246888.027454 - - 0 - - - - - - - - - - - - -1559246888.030028 CtPZjS20MLrsMUOJi2 192.168.43.118 123 185.19.184.35 123 4 3 2 64.000000 0.000000 0.046280 0.028275 - - - - 1559246556.073681 1559246822.050275 1559246822.064562 1559246888.030021 - - 0 - - - - - - - - - - - - -1559246888.422200 CtPZjS20MLrsMUOJi2 192.168.43.118 123 185.19.184.35 123 4 4 2 64.000000 0.000008 0.003235 0.000565 - - - - 1559246481.481997 1559246888.030021 1559246888.220330 1559246888.220401 - - 0 - - - - - - - - - - - - -1559246888.422229 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 4 2 64.000000 0.000000 0.040375 0.001236 - - - - 1559246882.967102 1559246888.027454 1559246888.234035 1559246888.234061 - - 0 - - - - - - - - - - - - -1559246889.027482 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 212.45.144.3 123 4 3 2 64.000000 0.000000 0.046280 0.028290 - - - - 1559246556.073681 1559246822.058090 1559246822.069097 1559246889.027449 - - 0 - - - - - - - - - - - - -1559246889.075261 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 212.45.144.3 123 4 4 2 64.000000 0.000001 0.003510 0.040573 - - - - 1559245278.442390 1559246889.027449 1559246889.061203 1559246889.061220 - - 0 - - - - - - - - - - - - -1559246890.027493 CmES5u32sYpV7JYN 192.168.43.118 123 85.199.214.99 123 4 3 2 64.000000 0.000000 0.046280 0.028305 - - - - 1559246556.073681 1559246824.073855 1559246824.095227 1559246890.027469 - - 0 - - - - - - - - - - - - -1559246890.027517 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 3 2 64.000000 0.000000 0.046280 0.028305 - - - - 1559246556.073681 1559246821.052836 1559246821.069165 1559246890.027512 - - 0 - - - - - - - - - - - - -1559246890.027528 C37jN32gN3y3AZzyf6 192.168.43.118 123 188.213.165.209 123 4 3 2 64.000000 0.000000 0.046280 0.028305 - - - - 1559246556.073681 1559246823.123950 1559246823.295751 1559246890.027523 - - 0 - - - - - - - - - - - - -1559246890.076319 C37jN32gN3y3AZzyf6 192.168.43.118 123 188.213.165.209 123 4 4 2 64.000000 0.000000 0.013596 0.025208 - - - - 1559246828.086879 1559246890.027523 1559246890.060644 1559246890.060687 - - 0 - - - - - - - - - - - - -1559246890.082370 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 4 2 64.000000 0.000000 0.010910 0.037491 - - - - 1559245577.265702 1559246890.027512 1559246890.069012 1559246890.069048 - - 0 - - - - - - - - - - - - -1559246890.094824 CmES5u32sYpV7JYN 192.168.43.118 123 85.199.214.99 123 4 4 1 16.000000 0.000000 0.000000 0.000000 - - - - 1559246890.000000 1559246890.027469 1559246890.070262 1559246890.070268 - - 0 - - - - - - - - - - - - -1559246891.027431 C3eiCBGOLw3VtHfOj 192.168.43.118 123 93.41.196.243 123 4 3 2 64.000000 0.000000 0.046280 0.028320 - - - - 1559246556.073681 1559246822.051730 1559246822.067161 1559246891.027395 - - 0 - - - - - - - - - - - - -1559246891.029967 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 94.177.187.22 123 4 3 2 64.000000 0.000000 0.046280 0.028320 - - - - 1559246556.073681 1559246825.052045 1559246825.066358 1559246891.029953 - - 0 - - - - - - - - - - - - -1559246891.068733 C3eiCBGOLw3VtHfOj 192.168.43.118 123 93.41.196.243 123 4 4 2 64.000000 0.000000 0.025391 0.015671 - - - - 1559246412.455332 1559246891.027395 1559246891.051818 1559246891.051827 - - 0 - - - - - - - - - - - - -1559246891.075965 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 94.177.187.22 123 4 4 2 64.000000 0.000000 0.013657 0.025818 - - - - 1559246788.670839 1559246891.029953 1559246891.061992 1559246891.062023 - - 0 - - - - - - - - - - - - -1559246892.027415 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 3 2 64.000000 0.000000 0.046280 0.028336 - - - - 1559246556.073681 1559246824.061335 1559246824.082820 1559246892.027401 - - 0 - - - - - - - - - - - - -1559246892.077560 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 4 2 64.000000 0.000002 0.003510 0.042603 - - - - 1559245178.020777 1559246892.027401 1559246892.051390 1559246892.051436 - - 0 - - - - - - - - - - - - -1559246894.027523 CFLRIC3zaTU1loLGxh 192.168.43.118 123 147.135.207.214 123 4 3 2 64.000000 0.000000 0.046280 0.028366 - - - - 1559246556.073681 1559246825.064608 1559246825.074985 1559246894.027491 - - 0 - - - - - - - - - - - - -1559246894.070325 CFLRIC3zaTU1loLGxh 192.168.43.118 123 147.135.207.214 123 4 4 2 64.000000 0.000008 0.042236 0.041504 - - - - 1559245356.576177 1559246894.027491 1559246894.059304 1559246894.059380 - - 0 - - - - - - - - - - - - -1559246898.027422 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.88.132 123 3 3 2 64.000000 0.000000 0.046280 0.028427 - - - - 1559246556.073681 1559246829.060691 1559246829.079018 1559246898.027403 - - 0 - - - - - - - - - - - - -1559246898.029960 Ck51lg1bScffFj34Ri 192.168.43.118 123 80.211.171.177 123 4 3 2 64.000000 0.000000 0.046280 0.028427 - - - - 1559246556.073681 1559246830.071400 1559246830.089710 1559246898.029953 - - 0 - - - - - - - - - - - - -1559246898.094782 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.88.132 123 3 4 3 64.000000 0.000001 0.011917 0.000565 - - - - 1559246667.219303 1559246898.027403 1559246898.077958 1559246898.078029 - - 0 - - - - - - - - - - - - -1559246898.094827 Ck51lg1bScffFj34Ri 192.168.43.118 123 80.211.171.177 123 4 4 4 64.000000 0.000000 0.036819 0.050842 - - - - 1559246822.407510 1559246898.029953 1559246898.078347 1559246898.078430 - - 0 - - - - - - - - - - - - -1559246900.027467 C9mvWx3ezztgzcexV7 192.168.43.118 123 147.135.207.213 123 4 3 2 64.000000 0.000000 0.046280 0.028458 - - - - 1559246556.073681 1559246833.067975 1559246833.079650 1559246900.027439 - - 0 - - - - - - - - - - - - -1559246900.030051 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.155.206 123 4 3 2 64.000000 0.000000 0.046280 0.028458 - - - - 1559246556.073681 1559246831.053954 1559246831.069547 1559246900.030036 - - 0 - - - - - - - - - - - - -1559246900.102991 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.155.206 123 4 4 2 64.000000 0.000000 0.013535 0.029602 - - - - 1559246283.180069 1559246900.030036 1559246900.088810 1559246900.088844 - - 0 - - - - - - - - - - - - -1559246900.111834 C9mvWx3ezztgzcexV7 192.168.43.118 123 147.135.207.213 123 4 4 2 64.000000 0.000008 0.042236 0.041595 - - - - 1559245356.576177 1559246900.027439 1559246900.103765 1559246900.103887 - - 0 - - - - - - - - - - - - -1559246940.262220 C7fIlMZDuRiqjpYbb 192.168.43.118 58229 193.204.114.232 123 4 3 0 16.000000 0.015625 1.000000 1.000000 - - - - 0.000000 0.000000 0.000000 1101309131.444112 - - 0 - - - - - - - - - - - - -1559246940.304152 C7fIlMZDuRiqjpYbb 192.168.43.118 58229 193.204.114.232 123 4 4 1 16.000000 0.000000 0.000000 0.000122 - - - - 1559246910.937978 1101309131.444112 1559246940.281161 1559246940.281191 - - 0 - - - - - - - - - - - - -1559246940.486493 CykQaM33ztNt0csB9a 192.168.43.118 43046 193.204.114.232 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - 42 F - 3 0 -#close 2019-06-05-09-15-44 +#open 2019-06-06-14-36-21 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum ReqCode auth_bit sequence implementation err +#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count string count bool count count count +1559246885.027478 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 3 2 64.000000 0.000000 0.046280 0.028229 - - 85.199.214.99 - 1559246556.073681 1559246818.058351 1559246818.079217 1559246885.027449 - - 0 - - - - - - - - - - - - - - +1559246885.088815 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 4 4 64.000000 0.000000 0.048843 0.075409 - - 105.237.207.28 - 1559245852.721794 1559246885.027449 1559246885.069212 1559246885.069247 - - 0 - - - - - - - - - - - - - - +1559246887.027467 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 3 2 64.000000 0.000000 0.046280 0.028259 - - 85.199.214.99 - 1559246556.073681 1559246820.060608 1559246820.081498 1559246887.027425 - - 0 - - - - - - - - - - - - - - +1559246887.060766 ClEkJM2Vm5giqnMf4h 192.168.43.118 123 212.45.144.88 123 4 4 2 64.000000 0.000000 0.003799 0.037018 - - 193.204.114.233 - 1559245541.537424 1559246887.027425 1559246887.050758 1559246887.050774 - - 0 - - - - - - - - - - - - - - +1559246888.027489 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 3 2 64.000000 0.000000 0.046280 0.028275 - - 85.199.214.99 - 1559246556.073681 1559246819.064014 1559246819.079147 1559246888.027454 - - 0 - - - - - - - - - - - - - - +1559246888.030028 CtPZjS20MLrsMUOJi2 192.168.43.118 123 185.19.184.35 123 4 3 2 64.000000 0.000000 0.046280 0.028275 - - 85.199.214.99 - 1559246556.073681 1559246822.050275 1559246822.064562 1559246888.030021 - - 0 - - - - - - - - - - - - - - +1559246888.422200 CtPZjS20MLrsMUOJi2 192.168.43.118 123 185.19.184.35 123 4 4 2 64.000000 0.000008 0.003235 0.000565 - - 193.204.114.233 - 1559246481.481997 1559246888.030021 1559246888.220330 1559246888.220401 - - 0 - - - - - - - - - - - - - - +1559246888.422229 C4J4Th3PJpwUYZZ6gc 192.168.43.118 123 31.14.131.188 123 4 4 2 64.000000 0.000000 0.040375 0.001236 - - 195.113.144.238 - 1559246882.967102 1559246888.027454 1559246888.234035 1559246888.234061 - - 0 - - - - - - - - - - - - - - +1559246889.027482 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 212.45.144.3 123 4 3 2 64.000000 0.000000 0.046280 0.028290 - - 85.199.214.99 - 1559246556.073681 1559246822.058090 1559246822.069097 1559246889.027449 - - 0 - - - - - - - - - - - - - - +1559246889.075261 CUM0KZ3MLUfNB0cl11 192.168.43.118 123 212.45.144.3 123 4 4 2 64.000000 0.000001 0.003510 0.040573 - - 193.204.114.232 - 1559245278.442390 1559246889.027449 1559246889.061203 1559246889.061220 - - 0 - - - - - - - - - - - - - - +1559246890.027493 CmES5u32sYpV7JYN 192.168.43.118 123 85.199.214.99 123 4 3 2 64.000000 0.000000 0.046280 0.028305 - - 85.199.214.99 - 1559246556.073681 1559246824.073855 1559246824.095227 1559246890.027469 - - 0 - - - - - - - - - - - - - - +1559246890.027517 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 3 2 64.000000 0.000000 0.046280 0.028305 - - 85.199.214.99 - 1559246556.073681 1559246821.052836 1559246821.069165 1559246890.027512 - - 0 - - - - - - - - - - - - - - +1559246890.027528 C37jN32gN3y3AZzyf6 192.168.43.118 123 188.213.165.209 123 4 3 2 64.000000 0.000000 0.046280 0.028305 - - 85.199.214.99 - 1559246556.073681 1559246823.123950 1559246823.295751 1559246890.027523 - - 0 - - - - - - - - - - - - - - +1559246890.076319 C37jN32gN3y3AZzyf6 192.168.43.118 123 188.213.165.209 123 4 4 2 64.000000 0.000000 0.013596 0.025208 - - 193.204.114.232 - 1559246828.086879 1559246890.027523 1559246890.060644 1559246890.060687 - - 0 - - - - - - - - - - - - - - +1559246890.082370 CP5puj4I8PtEU4qzYg 192.168.43.118 123 31.14.133.122 123 4 4 2 64.000000 0.000000 0.010910 0.037491 - - 193.204.114.233 - 1559245577.265702 1559246890.027512 1559246890.069012 1559246890.069048 - - 0 - - - - - - - - - - - - - - +1559246890.094824 CmES5u32sYpV7JYN 192.168.43.118 123 85.199.214.99 123 4 4 1 16.000000 0.000000 0.000000 0.000000 - GPS\x00 - - 1559246890.000000 1559246890.027469 1559246890.070262 1559246890.070268 - - 0 - - - - - - - - - - - - - - +1559246891.027431 C3eiCBGOLw3VtHfOj 192.168.43.118 123 93.41.196.243 123 4 3 2 64.000000 0.000000 0.046280 0.028320 - - 85.199.214.99 - 1559246556.073681 1559246822.051730 1559246822.067161 1559246891.027395 - - 0 - - - - - - - - - - - - - - +1559246891.029967 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 94.177.187.22 123 4 3 2 64.000000 0.000000 0.046280 0.028320 - - 85.199.214.99 - 1559246556.073681 1559246825.052045 1559246825.066358 1559246891.029953 - - 0 - - - - - - - - - - - - - - +1559246891.068733 C3eiCBGOLw3VtHfOj 192.168.43.118 123 93.41.196.243 123 4 4 2 64.000000 0.000000 0.025391 0.015671 - - 193.204.114.233 - 1559246412.455332 1559246891.027395 1559246891.051818 1559246891.051827 - - 0 - - - - - - - - - - - - - - +1559246891.075965 CwjjYJ2WqgTbAqiHl6 192.168.43.118 123 94.177.187.22 123 4 4 2 64.000000 0.000000 0.013657 0.025818 - - 193.204.114.233 - 1559246788.670839 1559246891.029953 1559246891.061992 1559246891.062023 - - 0 - - - - - - - - - - - - - - +1559246892.027415 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 3 2 64.000000 0.000000 0.046280 0.028336 - - 85.199.214.99 - 1559246556.073681 1559246824.061335 1559246824.082820 1559246892.027401 - - 0 - - - - - - - - - - - - - - +1559246892.077560 C0LAHyvtKSQHyJxIl 192.168.43.118 123 212.45.144.206 123 4 4 2 64.000000 0.000002 0.003510 0.042603 - - 193.204.114.232 - 1559245178.020777 1559246892.027401 1559246892.051390 1559246892.051436 - - 0 - - - - - - - - - - - - - - +1559246894.027523 CFLRIC3zaTU1loLGxh 192.168.43.118 123 147.135.207.214 123 4 3 2 64.000000 0.000000 0.046280 0.028366 - - 85.199.214.99 - 1559246556.073681 1559246825.064608 1559246825.074985 1559246894.027491 - - 0 - - - - - - - - - - - - - - +1559246894.070325 CFLRIC3zaTU1loLGxh 192.168.43.118 123 147.135.207.214 123 4 4 2 64.000000 0.000008 0.042236 0.041504 - - 212.7.1.132 - 1559245356.576177 1559246894.027491 1559246894.059304 1559246894.059380 - - 0 - - - - - - - - - - - - - - +1559246898.027422 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.88.132 123 3 3 2 64.000000 0.000000 0.046280 0.028427 - - 85.199.214.99 - 1559246556.073681 1559246829.060691 1559246829.079018 1559246898.027403 - - 0 - - - - - - - - - - - - - - +1559246898.029960 Ck51lg1bScffFj34Ri 192.168.43.118 123 80.211.171.177 123 4 3 2 64.000000 0.000000 0.046280 0.028427 - - 85.199.214.99 - 1559246556.073681 1559246830.071400 1559246830.089710 1559246898.029953 - - 0 - - - - - - - - - - - - - - +1559246898.094782 C9rXSW3KSpTYvPrlI1 192.168.43.118 123 80.211.88.132 123 3 4 3 64.000000 0.000001 0.011917 0.000565 - - 185.19.184.35 - 1559246667.219303 1559246898.027403 1559246898.077958 1559246898.078029 - - 0 - - - - - - - - - - - - - - +1559246898.094827 Ck51lg1bScffFj34Ri 192.168.43.118 123 80.211.171.177 123 4 4 4 64.000000 0.000000 0.036819 0.050842 - - 73.98.4.223 - 1559246822.407510 1559246898.029953 1559246898.078347 1559246898.078430 - - 0 - - - - - - - - - - - - - - +1559246900.027467 C9mvWx3ezztgzcexV7 192.168.43.118 123 147.135.207.213 123 4 3 2 64.000000 0.000000 0.046280 0.028458 - - 85.199.214.99 - 1559246556.073681 1559246833.067975 1559246833.079650 1559246900.027439 - - 0 - - - - - - - - - - - - - - +1559246900.030051 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.155.206 123 4 3 2 64.000000 0.000000 0.046280 0.028458 - - 85.199.214.99 - 1559246556.073681 1559246831.053954 1559246831.069547 1559246900.030036 - - 0 - - - - - - - - - - - - - - +1559246900.102991 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.155.206 123 4 4 2 64.000000 0.000000 0.013535 0.029602 - - 193.204.114.232 - 1559246283.180069 1559246900.030036 1559246900.088810 1559246900.088844 - - 0 - - - - - - - - - - - - - - +1559246900.111834 C9mvWx3ezztgzcexV7 192.168.43.118 123 147.135.207.213 123 4 4 2 64.000000 0.000008 0.042236 0.041595 - - 212.7.1.132 - 1559245356.576177 1559246900.027439 1559246900.103765 1559246900.103887 - - 0 - - - - - - - - - - - - - - +1559246940.262220 C7fIlMZDuRiqjpYbb 192.168.43.118 58229 193.204.114.232 123 4 3 0 16.000000 0.015625 1.000000 1.000000 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1101309131.444112 - - 0 - - - - - - - - - - - - - - +1559246940.304152 C7fIlMZDuRiqjpYbb 192.168.43.118 58229 193.204.114.232 123 4 4 1 16.000000 0.000000 0.000000 0.000122 - CTD\x00 - - 1559246910.937978 1101309131.444112 1559246940.281161 1559246940.281191 - - 0 - - - - - - - - - - - - - - +1559246940.486493 CykQaM33ztNt0csB9a 192.168.43.118 43046 193.204.114.232 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - - - 42 F - 3 0 +#close 2019-06-06-14-36-21 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/.stdout index f472ab8a40..fe50376a61 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/.stdout +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/.stdout @@ -1,30 +1,30 @@ -ntp_message 192.168.50.50 -> 67.129.68.9:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 69.44.57.60:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 207.234.209.181:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 209.132.176.4:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 216.27.185.42:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 24.34.79.42:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 24.123.202.230:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 63.164.62.249:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 64.112.189.11:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 65.125.233.206:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 66.33.206.5:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 66.33.216.11:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 66.92.68.246:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 66.111.46.200:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 66.115.136.4:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=, ref_id=, ref_addr=\x00\x00\x00\x00, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 69.44.57.60:123 [version=3, mode=2, std_msg=[stratum=3, poll=1024.0, precision=0.000004, root_delay=0.109238, root_disp=0.081726, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254668.551001, org_time=1096255084.922896, rec_time=1096255083.809713, xmt_time=1096255083.80976, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 24.123.202.230:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.030319, root_disp=0.185547, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096252181.259041, org_time=1096255084.922896, rec_time=1096255083.821124, xmt_time=1096255083.821134, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 67.129.68.9:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000008, root_delay=0.060455, root_disp=7.46431, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1095788645.064548, org_time=1096255084.922896, rec_time=1096255083.848508, xmt_time=1096255083.848601, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 65.125.233.206:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000031, root_delay=0.023254, root_disp=0.012848, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254901.858123, org_time=1096255084.922896, rec_time=1096255083.828025, xmt_time=1096255083.828189, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 63.164.62.249:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.015015, root_disp=0.037491, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254668.213801, org_time=1096255084.922896, rec_time=1096255083.829249, xmt_time=1096255083.829301, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 207.234.209.181:123 [version=3, mode=2, std_msg=[stratum=3, poll=1024.0, precision=0.000008, root_delay=0.072678, root_disp=0.035049, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254326.1896, org_time=1096255084.922896, rec_time=1096255083.824154, xmt_time=1096255083.824174, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 66.92.68.246:123 [version=3, mode=2, std_msg=[stratum=1, poll=1024.0, precision=0.000015, root_delay=0.0, root_disp=0.00032, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=GPS\x00, ref_time=1096255078.223498, org_time=1096255084.932911, rec_time=1096255083.836845, xmt_time=1096255083.83687, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 24.34.79.42:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000031, root_delay=0.123322, root_disp=0.039917, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254970.010788, org_time=1096255084.922896, rec_time=1096255083.825662, xmt_time=1096255083.825692, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 66.115.136.4:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000008, root_delay=0.016632, root_disp=0.028641, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254406.517429, org_time=1096255084.932911, rec_time=1096255083.853291, xmt_time=1096255083.853336, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 66.33.206.5:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000004, root_delay=0.01236, root_disp=0.022202, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096255027.694744, org_time=1096255084.932911, rec_time=1096255083.850895, xmt_time=1096255083.850907, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 66.33.216.11:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.009857, root_disp=0.043747, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254508.255586, org_time=1096255084.932911, rec_time=1096255083.850965, xmt_time=1096255083.851024, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 66.111.46.200:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.056396, root_disp=0.062164, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096253376.841474, org_time=1096255084.932911, rec_time=1096255083.847619, xmt_time=1096255083.847644, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 64.112.189.11:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000015, root_delay=0.081268, root_disp=0.029877, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254706.14029, org_time=1096255084.922896, rec_time=1096255083.850451, xmt_time=1096255083.850465, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 216.27.185.42:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000004, root_delay=0.029846, root_disp=0.045456, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=1096254209.896379, org_time=1096255084.922896, rec_time=1096255083.849099, xmt_time=1096255083.849269, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.50.50 -> 209.132.176.4:123 [version=3, mode=2, std_msg=[stratum=1, poll=1024.0, precision=0.000015, root_delay=0.0, root_disp=0.000504, kiss_code=, ref_id=, ref_addr=, ref_v6_hash_prefix=CDMA, ref_time=1096255068.944018, org_time=1096255084.922896, rec_time=1096255083.827772, xmt_time=1096255083.828313, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 67.129.68.9:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 69.44.57.60:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 207.234.209.181:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 209.132.176.4:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 216.27.185.42:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 24.34.79.42:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 24.123.202.230:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 63.164.62.249:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 64.112.189.11:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 65.125.233.206:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.922896, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.33.206.5:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.33.216.11:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.92.68.246:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.111.46.200:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.115.136.4:123 [version=3, mode=1, std_msg=[stratum=0, poll=1024.0, precision=0.015625, root_delay=0.0, root_disp=1.01001, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1096255084.932911, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 69.44.57.60:123 [version=3, mode=2, std_msg=[stratum=3, poll=1024.0, precision=0.000004, root_delay=0.109238, root_disp=0.081726, kiss_code=, ref_id=, ref_addr=81.174.128.183, ref_v6_hash_prefix=, ref_time=1096254668.551001, org_time=1096255084.922896, rec_time=1096255083.809713, xmt_time=1096255083.80976, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 24.123.202.230:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.030319, root_disp=0.185547, kiss_code=, ref_id=, ref_addr=198.30.92.2, ref_v6_hash_prefix=, ref_time=1096252181.259041, org_time=1096255084.922896, rec_time=1096255083.821124, xmt_time=1096255083.821134, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 67.129.68.9:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000008, root_delay=0.060455, root_disp=7.46431, kiss_code=, ref_id=, ref_addr=17.254.0.49, ref_v6_hash_prefix=, ref_time=1095788645.064548, org_time=1096255084.922896, rec_time=1096255083.848508, xmt_time=1096255083.848601, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 65.125.233.206:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000031, root_delay=0.023254, root_disp=0.012848, kiss_code=, ref_id=, ref_addr=130.207.244.240, ref_v6_hash_prefix=, ref_time=1096254901.858123, org_time=1096255084.922896, rec_time=1096255083.828025, xmt_time=1096255083.828189, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 63.164.62.249:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.015015, root_disp=0.037491, kiss_code=, ref_id=, ref_addr=18.145.0.30, ref_v6_hash_prefix=, ref_time=1096254668.213801, org_time=1096255084.922896, rec_time=1096255083.829249, xmt_time=1096255083.829301, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 207.234.209.181:123 [version=3, mode=2, std_msg=[stratum=3, poll=1024.0, precision=0.000008, root_delay=0.072678, root_disp=0.035049, kiss_code=, ref_id=, ref_addr=198.82.1.203, ref_v6_hash_prefix=, ref_time=1096254326.1896, org_time=1096255084.922896, rec_time=1096255083.824154, xmt_time=1096255083.824174, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.92.68.246:123 [version=3, mode=2, std_msg=[stratum=1, poll=1024.0, precision=0.000015, root_delay=0.0, root_disp=0.00032, kiss_code=, ref_id=GPS\x00, ref_addr=, ref_v6_hash_prefix=, ref_time=1096255078.223498, org_time=1096255084.932911, rec_time=1096255083.836845, xmt_time=1096255083.83687, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 24.34.79.42:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000031, root_delay=0.123322, root_disp=0.039917, kiss_code=, ref_id=, ref_addr=131.107.1.10, ref_v6_hash_prefix=, ref_time=1096254970.010788, org_time=1096255084.922896, rec_time=1096255083.825662, xmt_time=1096255083.825692, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.115.136.4:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000008, root_delay=0.016632, root_disp=0.028641, kiss_code=, ref_id=, ref_addr=130.207.244.240, ref_v6_hash_prefix=, ref_time=1096254406.517429, org_time=1096255084.932911, rec_time=1096255083.853291, xmt_time=1096255083.853336, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.33.206.5:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000004, root_delay=0.01236, root_disp=0.022202, kiss_code=, ref_id=, ref_addr=192.12.19.20, ref_v6_hash_prefix=, ref_time=1096255027.694744, org_time=1096255084.932911, rec_time=1096255083.850895, xmt_time=1096255083.850907, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.33.216.11:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.009857, root_disp=0.043747, kiss_code=, ref_id=, ref_addr=204.123.2.72, ref_v6_hash_prefix=, ref_time=1096254508.255586, org_time=1096255084.932911, rec_time=1096255083.850965, xmt_time=1096255083.851024, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 66.111.46.200:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000001, root_delay=0.056396, root_disp=0.062164, kiss_code=, ref_id=, ref_addr=198.30.92.2, ref_v6_hash_prefix=, ref_time=1096253376.841474, org_time=1096255084.932911, rec_time=1096255083.847619, xmt_time=1096255083.847644, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 64.112.189.11:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000015, root_delay=0.081268, root_disp=0.029877, kiss_code=, ref_id=, ref_addr=128.10.252.6, ref_v6_hash_prefix=, ref_time=1096254706.14029, org_time=1096255084.922896, rec_time=1096255083.850451, xmt_time=1096255083.850465, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 216.27.185.42:123 [version=3, mode=2, std_msg=[stratum=2, poll=1024.0, precision=0.000004, root_delay=0.029846, root_disp=0.045456, kiss_code=, ref_id=, ref_addr=164.67.62.194, ref_v6_hash_prefix=, ref_time=1096254209.896379, org_time=1096255084.922896, rec_time=1096255083.849099, xmt_time=1096255083.849269, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] +ntp_message 192.168.50.50 -> 209.132.176.4:123 [version=3, mode=2, std_msg=[stratum=1, poll=1024.0, precision=0.000015, root_delay=0.0, root_disp=0.000504, kiss_code=, ref_id=CDMA, ref_addr=, ref_v6_hash_prefix=, ref_time=1096255068.944018, org_time=1096255084.922896, rec_time=1096255083.827772, xmt_time=1096255083.828313, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log index 5075ab04ed..38d0a32f16 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log @@ -3,37 +3,37 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-05-09-15-50 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ReqCode auth_bit sequence implementation err -#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count bool count count count -1096255084.954975 ClEkJM2Vm5giqnMf4h 192.168.50.50 123 67.129.68.9 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - -1096255084.955306 C4J4Th3PJpwUYZZ6gc 192.168.50.50 123 69.44.57.60 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - -1096255084.955760 CtPZjS20MLrsMUOJi2 192.168.50.50 123 207.234.209.181 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - -1096255084.956155 CUM0KZ3MLUfNB0cl11 192.168.50.50 123 209.132.176.4 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - -1096255084.956577 CmES5u32sYpV7JYN 192.168.50.50 123 216.27.185.42 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - -1096255084.956975 CP5puj4I8PtEU4qzYg 192.168.50.50 123 24.34.79.42 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - -1096255084.957457 C37jN32gN3y3AZzyf6 192.168.50.50 123 24.123.202.230 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - -1096255084.957903 C3eiCBGOLw3VtHfOj 192.168.50.50 123 63.164.62.249 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - -1096255084.958625 CwjjYJ2WqgTbAqiHl6 192.168.50.50 123 64.112.189.11 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - -1096255084.959273 C0LAHyvtKSQHyJxIl 192.168.50.50 123 65.125.233.206 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - -1096255084.960065 CFLRIC3zaTU1loLGxh 192.168.50.50 123 66.33.206.5 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - -1096255084.960866 C9rXSW3KSpTYvPrlI1 192.168.50.50 123 66.33.216.11 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - -1096255084.961475 Ck51lg1bScffFj34Ri 192.168.50.50 123 66.92.68.246 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - -1096255084.962222 C9mvWx3ezztgzcexV7 192.168.50.50 123 66.111.46.200 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - -1096255084.962915 CNnMIj2QSd84NKf7U3 192.168.50.50 123 66.115.136.4 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 - - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - -1096255085.012029 C4J4Th3PJpwUYZZ6gc 192.168.50.50 123 69.44.57.60 123 3 2 3 1024.000000 0.000004 0.109238 0.081726 - - - - 1096254668.551001 1096255084.922896 1096255083.809713 1096255083.809760 - - 0 - - - - - - - - - - - - -1096255085.049280 C37jN32gN3y3AZzyf6 192.168.50.50 123 24.123.202.230 123 3 2 2 1024.000000 0.000001 0.030319 0.185547 - - - - 1096252181.259041 1096255084.922896 1096255083.821124 1096255083.821134 - - 0 - - - - - - - - - - - - -1096255085.092991 ClEkJM2Vm5giqnMf4h 192.168.50.50 123 67.129.68.9 123 3 2 2 1024.000000 0.000008 0.060455 7.464310 - - - - 1095788645.064548 1096255084.922896 1096255083.848508 1096255083.848601 - - 0 - - - - - - - - - - - - -1096255085.120557 C0LAHyvtKSQHyJxIl 192.168.50.50 123 65.125.233.206 123 3 2 2 1024.000000 0.000031 0.023254 0.012848 - - - - 1096254901.858123 1096255084.922896 1096255083.828025 1096255083.828189 - - 0 - - - - - - - - - - - - -1096255085.185955 C3eiCBGOLw3VtHfOj 192.168.50.50 123 63.164.62.249 123 3 2 2 1024.000000 0.000001 0.015015 0.037491 - - - - 1096254668.213801 1096255084.922896 1096255083.829249 1096255083.829301 - - 0 - - - - - - - - - - - - -1096255085.223026 CtPZjS20MLrsMUOJi2 192.168.50.50 123 207.234.209.181 123 3 2 3 1024.000000 0.000008 0.072678 0.035049 - - - - 1096254326.189600 1096255084.922896 1096255083.824154 1096255083.824174 - - 0 - - - - - - - - - - - - -1096255085.280949 Ck51lg1bScffFj34Ri 192.168.50.50 123 66.92.68.246 123 3 2 1 1024.000000 0.000015 0.000000 0.000320 - - - - 1096255078.223498 1096255084.932911 1096255083.836845 1096255083.836870 - - 0 - - - - - - - - - - - - -1096255085.304774 CP5puj4I8PtEU4qzYg 192.168.50.50 123 24.34.79.42 123 3 2 2 1024.000000 0.000031 0.123322 0.039917 - - - - 1096254970.010788 1096255084.922896 1096255083.825662 1096255083.825692 - - 0 - - - - - - - - - - - - -1096255085.353360 CNnMIj2QSd84NKf7U3 192.168.50.50 123 66.115.136.4 123 3 2 2 1024.000000 0.000008 0.016632 0.028641 - - - - 1096254406.517429 1096255084.932911 1096255083.853291 1096255083.853336 - - 0 - - - - - - - - - - - - -1096255085.406368 CFLRIC3zaTU1loLGxh 192.168.50.50 123 66.33.206.5 123 3 2 2 1024.000000 0.000004 0.012360 0.022202 - - - - 1096255027.694744 1096255084.932911 1096255083.850895 1096255083.850907 - - 0 - - - - - - - - - - - - -1096255085.439833 C9rXSW3KSpTYvPrlI1 192.168.50.50 123 66.33.216.11 123 3 2 2 1024.000000 0.000001 0.009857 0.043747 - - - - 1096254508.255586 1096255084.932911 1096255083.850965 1096255083.851024 - - 0 - - - - - - - - - - - - -1096255085.480955 C9mvWx3ezztgzcexV7 192.168.50.50 123 66.111.46.200 123 3 2 2 1024.000000 0.000001 0.056396 0.062164 - - - - 1096253376.841474 1096255084.932911 1096255083.847619 1096255083.847644 - - 0 - - - - - - - - - - - - -1096255085.522297 CwjjYJ2WqgTbAqiHl6 192.168.50.50 123 64.112.189.11 123 3 2 2 1024.000000 0.000015 0.081268 0.029877 - - - - 1096254706.140290 1096255084.922896 1096255083.850451 1096255083.850465 - - 0 - - - - - - - - - - - - -1096255085.562197 CmES5u32sYpV7JYN 192.168.50.50 123 216.27.185.42 123 3 2 2 1024.000000 0.000004 0.029846 0.045456 - - - - 1096254209.896379 1096255084.922896 1096255083.849099 1096255083.849269 - - 0 - - - - - - - - - - - - -1096255085.599961 CUM0KZ3MLUfNB0cl11 192.168.50.50 123 209.132.176.4 123 3 2 1 1024.000000 0.000015 0.000000 0.000504 - - - - 1096255068.944018 1096255084.922896 1096255083.827772 1096255083.828313 - - 0 - - - - - - - - - - - - -#close 2019-06-05-09-15-50 +#open 2019-06-06-14-36-29 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum ReqCode auth_bit sequence implementation err +#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count string count bool count count count +1096255084.954975 ClEkJM2Vm5giqnMf4h 192.168.50.50 123 67.129.68.9 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - +1096255084.955306 C4J4Th3PJpwUYZZ6gc 192.168.50.50 123 69.44.57.60 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - +1096255084.955760 CtPZjS20MLrsMUOJi2 192.168.50.50 123 207.234.209.181 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - +1096255084.956155 CUM0KZ3MLUfNB0cl11 192.168.50.50 123 209.132.176.4 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - +1096255084.956577 CmES5u32sYpV7JYN 192.168.50.50 123 216.27.185.42 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - +1096255084.956975 CP5puj4I8PtEU4qzYg 192.168.50.50 123 24.34.79.42 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - +1096255084.957457 C37jN32gN3y3AZzyf6 192.168.50.50 123 24.123.202.230 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - +1096255084.957903 C3eiCBGOLw3VtHfOj 192.168.50.50 123 63.164.62.249 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - +1096255084.958625 CwjjYJ2WqgTbAqiHl6 192.168.50.50 123 64.112.189.11 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - +1096255084.959273 C0LAHyvtKSQHyJxIl 192.168.50.50 123 65.125.233.206 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - +1096255084.960065 CFLRIC3zaTU1loLGxh 192.168.50.50 123 66.33.206.5 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - - - +1096255084.960866 C9rXSW3KSpTYvPrlI1 192.168.50.50 123 66.33.216.11 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - - - +1096255084.961475 Ck51lg1bScffFj34Ri 192.168.50.50 123 66.92.68.246 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - - - +1096255084.962222 C9mvWx3ezztgzcexV7 192.168.50.50 123 66.111.46.200 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - - - +1096255084.962915 CNnMIj2QSd84NKf7U3 192.168.50.50 123 66.115.136.4 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.932911 - - 0 - - - - - - - - - - - - - - +1096255085.012029 C4J4Th3PJpwUYZZ6gc 192.168.50.50 123 69.44.57.60 123 3 2 3 1024.000000 0.000004 0.109238 0.081726 - - 81.174.128.183 - 1096254668.551001 1096255084.922896 1096255083.809713 1096255083.809760 - - 0 - - - - - - - - - - - - - - +1096255085.049280 C37jN32gN3y3AZzyf6 192.168.50.50 123 24.123.202.230 123 3 2 2 1024.000000 0.000001 0.030319 0.185547 - - 198.30.92.2 - 1096252181.259041 1096255084.922896 1096255083.821124 1096255083.821134 - - 0 - - - - - - - - - - - - - - +1096255085.092991 ClEkJM2Vm5giqnMf4h 192.168.50.50 123 67.129.68.9 123 3 2 2 1024.000000 0.000008 0.060455 7.464310 - - 17.254.0.49 - 1095788645.064548 1096255084.922896 1096255083.848508 1096255083.848601 - - 0 - - - - - - - - - - - - - - +1096255085.120557 C0LAHyvtKSQHyJxIl 192.168.50.50 123 65.125.233.206 123 3 2 2 1024.000000 0.000031 0.023254 0.012848 - - 130.207.244.240 - 1096254901.858123 1096255084.922896 1096255083.828025 1096255083.828189 - - 0 - - - - - - - - - - - - - - +1096255085.185955 C3eiCBGOLw3VtHfOj 192.168.50.50 123 63.164.62.249 123 3 2 2 1024.000000 0.000001 0.015015 0.037491 - - 18.145.0.30 - 1096254668.213801 1096255084.922896 1096255083.829249 1096255083.829301 - - 0 - - - - - - - - - - - - - - +1096255085.223026 CtPZjS20MLrsMUOJi2 192.168.50.50 123 207.234.209.181 123 3 2 3 1024.000000 0.000008 0.072678 0.035049 - - 198.82.1.203 - 1096254326.189600 1096255084.922896 1096255083.824154 1096255083.824174 - - 0 - - - - - - - - - - - - - - +1096255085.280949 Ck51lg1bScffFj34Ri 192.168.50.50 123 66.92.68.246 123 3 2 1 1024.000000 0.000015 0.000000 0.000320 - GPS\x00 - - 1096255078.223498 1096255084.932911 1096255083.836845 1096255083.836870 - - 0 - - - - - - - - - - - - - - +1096255085.304774 CP5puj4I8PtEU4qzYg 192.168.50.50 123 24.34.79.42 123 3 2 2 1024.000000 0.000031 0.123322 0.039917 - - 131.107.1.10 - 1096254970.010788 1096255084.922896 1096255083.825662 1096255083.825692 - - 0 - - - - - - - - - - - - - - +1096255085.353360 CNnMIj2QSd84NKf7U3 192.168.50.50 123 66.115.136.4 123 3 2 2 1024.000000 0.000008 0.016632 0.028641 - - 130.207.244.240 - 1096254406.517429 1096255084.932911 1096255083.853291 1096255083.853336 - - 0 - - - - - - - - - - - - - - +1096255085.406368 CFLRIC3zaTU1loLGxh 192.168.50.50 123 66.33.206.5 123 3 2 2 1024.000000 0.000004 0.012360 0.022202 - - 192.12.19.20 - 1096255027.694744 1096255084.932911 1096255083.850895 1096255083.850907 - - 0 - - - - - - - - - - - - - - +1096255085.439833 C9rXSW3KSpTYvPrlI1 192.168.50.50 123 66.33.216.11 123 3 2 2 1024.000000 0.000001 0.009857 0.043747 - - 204.123.2.72 - 1096254508.255586 1096255084.932911 1096255083.850965 1096255083.851024 - - 0 - - - - - - - - - - - - - - +1096255085.480955 C9mvWx3ezztgzcexV7 192.168.50.50 123 66.111.46.200 123 3 2 2 1024.000000 0.000001 0.056396 0.062164 - - 198.30.92.2 - 1096253376.841474 1096255084.932911 1096255083.847619 1096255083.847644 - - 0 - - - - - - - - - - - - - - +1096255085.522297 CwjjYJ2WqgTbAqiHl6 192.168.50.50 123 64.112.189.11 123 3 2 2 1024.000000 0.000015 0.081268 0.029877 - - 128.10.252.6 - 1096254706.140290 1096255084.922896 1096255083.850451 1096255083.850465 - - 0 - - - - - - - - - - - - - - +1096255085.562197 CmES5u32sYpV7JYN 192.168.50.50 123 216.27.185.42 123 3 2 2 1024.000000 0.000004 0.029846 0.045456 - - 164.67.62.194 - 1096254209.896379 1096255084.922896 1096255083.849099 1096255083.849269 - - 0 - - - - - - - - - - - - - - +1096255085.599961 CUM0KZ3MLUfNB0cl11 192.168.50.50 123 209.132.176.4 123 3 2 1 1024.000000 0.000015 0.000000 0.000504 - CDMA - - 1096255068.944018 1096255084.922896 1096255083.827772 1096255083.828313 - - 0 - - - - - - - - - - - - - - +#close 2019-06-06-14-36-29 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout index be9c6ad425..7fc7a9aede 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout @@ -1,9 +1,9 @@ -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=1, resp_bit=F, err_bit=F, more_bit=F, sequence=1, status=0, association_id=0, offs=0, c=0, data=], mode7_msg=] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=2, status=0, association_id=19183, offs=0, c=0, data=], mode7_msg=] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=3, status=0, association_id=19184, offs=0, c=0, data=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=1, resp_bit=F, err_bit=F, more_bit=F, sequence=1, status=0, association_id=0, data=0, key_id=0, crypto_checksum=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=2, status=0, association_id=19183, data=0, key_id=0, crypto_checksum=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=3, status=0, association_id=19184, data=0, key_id=0, crypto_checksum=], mode7_msg=] ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=1, auth_bit=F, sequence=0, implementation=3, err=0, data=]] ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=42, auth_bit=F, sequence=0, implementation=3, err=0, data=]] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=1, resp_bit=F, err_bit=F, more_bit=F, sequence=1, status=0, association_id=0, offs=0, c=0, data=], mode7_msg=] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=2, status=0, association_id=19183, offs=0, c=0, data=], mode7_msg=] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=3, status=0, association_id=19184, offs=0, c=0, data=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=1, resp_bit=F, err_bit=F, more_bit=F, sequence=1, status=0, association_id=0, data=0, key_id=0, crypto_checksum=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=2, status=0, association_id=19183, data=0, key_id=0, crypto_checksum=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=3, status=0, association_id=19184, data=0, key_id=0, crypto_checksum=], mode7_msg=] ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=1, auth_bit=F, sequence=0, implementation=3, err=0, data=]] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log index fdfd021186..a441d8397b 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log @@ -3,16 +3,16 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-05-09-15-16 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ReqCode auth_bit sequence implementation err -#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count bool count count count -1558603188.282844 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 1 F F F 1 0 0 - - - - - -1558603188.283617 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 2 0 19183 - - - - - -1558603188.286063 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 3 0 19184 - - - - - -1558603201.135003 ClEkJM2Vm5giqnMf4h 127.0.0.1 57531 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - 1 F - 3 0 -1558603206.793297 C4J4Th3PJpwUYZZ6gc 127.0.0.1 46918 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - 42 F - 3 0 -1558603213.886044 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 1 F F F 1 0 0 - - - - - -1558603213.886779 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 2 0 19183 - - - - - -1558603213.889030 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 3 0 19184 - - - - - -1558603219.996399 CUM0KZ3MLUfNB0cl11 127.0.0.1 55675 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - 1 F - 3 0 -#close 2019-06-05-09-15-16 +#open 2019-06-06-14-36-41 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum ReqCode auth_bit sequence implementation err +#types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count string count bool count count count +1558603188.282844 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 1 F F F 1 0 0 0 (empty) - - - - - +1558603188.283617 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 2 0 19183 0 (empty) - - - - - +1558603188.286063 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 3 0 19184 0 (empty) - - - - - +1558603201.135003 ClEkJM2Vm5giqnMf4h 127.0.0.1 57531 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - - - 1 F - 3 0 +1558603206.793297 C4J4Th3PJpwUYZZ6gc 127.0.0.1 46918 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - - - 42 F - 3 0 +1558603213.886044 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 1 F F F 1 0 0 0 (empty) - - - - - +1558603213.886779 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 2 0 19183 0 (empty) - - - - - +1558603213.889030 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 3 0 19184 0 (empty) - - - - - +1558603219.996399 CUM0KZ3MLUfNB0cl11 127.0.0.1 55675 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - - - 1 F - 3 0 +#close 2019-06-06-14-36-41 diff --git a/testing/btest/Traces/ntp/NTP-digest.pcap b/testing/btest/Traces/ntp/NTP-digest.pcap new file mode 100644 index 0000000000000000000000000000000000000000..0e8a262cabee5a7b1c78ecd40915ab0a1c3acf0e GIT binary patch literal 5864 zcmb{0eKeF=90%|jGa52NikK}SOl45Wc4W8FyA|ybRuqbrsi=dk%sew*qLjQwVRxmN zybO71Lv_iFZZAOd(Lyt{oQl__?++WkLNkJ^Ga=z z8jVRCFD8u+8oD*t?|v|gmH^i9ZLk{f9GiBAZK0l~pWGb*kGt!Q%x2Jj44O(eg)Jzx z|9f57C_mB7X+rS0=f|6?O?nQtGHJ9)^=C`s{#Lf1>WWqG6u@(6Dcj5Ag@px5ut%5C zh2fb2eW%KXqGX2@LC(%VWV?los7Zy0USmY(g{?)JP-M?wye^*}^dbD7%NJd*xK0ls zsv;y(CXb6)Y8cUN;ge`rC_1l9wv>)&-`!>7u!dPV@F)t1cwuBRQkEeiD~#x!aKtPL zijL-G%!vNX+jc9`F3-X7(WN{f>JKL)vRj6T+$R=Q7>UgH4L}jqICV6AeY*}nH94bT zP_eTHh>{42q?L#$1S47?TG$3aG!#l`i#Ir?2c^FZc zDERU)6xkT){jR8VGuT5he$LcO3e@Lu{i1i05#`TEM1NvL*`mWmE>OgY*>C23^8CDK zycaP+2O44xfv6^ujOh7sM05iqIx5Qa?S>-Vw9Q#bO>O3y*+<7F&#|;!4MhJ$kr8dK zLPVc2q8p;~BNw5l)kIv>qp~Rsw3a#=`_rQWfoKLH5vO`wq@jZm^@tR-NGPI4F2z?F zusFw@wuNLlIu2$5QO+-9GLoesBL2i8*;LVpX9pBz45z9|cbmMO>^;QP?e86`1R^Iw zB1J1A^2dmH)U*=#*`((#)ym29?JE5^Y4EtK^~`(MfXHMwnT+I2L==q?t)$HBq)^n+ zrSOTUpK?2_ahX=LthGYThU-@?BqQ=KMntDEq6ErkcnFHJSCl^x4BLmW6_s^~TSDbp zKqQMLBWi9#L=70xAu3R~9*TtJ$pd)}tDhXomW=M3Yf-EXL|+JrQo<0?IgIEqwdHId z6fIb8r=wv|D2VF(mvSunm_Hqez9%%b0R|#!#)xvLtywZCitrY@9q!-pF2LqZ*dN;? z1(rZ07m=CT{!~QNjuA;IO8!+;{F$$D=>fIU;_b@qMq}L-OM%E#Ohyzi2NAu%h%QrE zPVf(yUj1r|OP%3~s}+6Bgx=v5MFBu`j*zHoXk4Vp!ibbqNnIxtX`M)3tF5%S&=TGs z|CjchxL_dSNXTRql7fiX7||o@wCNKlqBn_Oxmjg}vHjNAvAZ&B5`pM>JQ)$|E+Vp- zSX9ZNZq2^{Md2BNDXy=dd+f4#9Q`Ix5YY@o50l7<9{4t3o!b>^JZSX|`OygcLFv z-Pw(Z$}plhv3HVM1a9$J?I(WP`UB5h4X zUjjwL-bXgvWbRRA$Da5h($d6;o=F5x??aKF^7=;ex&oh1oI3xs#6_ktK*S-Gktzxi8Dc~qBzvx(gdzpc z^EywaYgD%NNxbtJdT1OFT_hyhdj}DjO)NT1lO*LELXqm^reC+s+ZCK-?86srcHrKS0Q&-x1r)Zd__imVD>6)wmA4!ipasU7T literal 0 HcmV?d00001 diff --git a/testing/btest/scripts/base/protocols/ntp/ntp-digest.test b/testing/btest/scripts/base/protocols/ntp/ntp-digest.test new file mode 100644 index 0000000000..78d836e117 --- /dev/null +++ b/testing/btest/scripts/base/protocols/ntp/ntp-digest.test @@ -0,0 +1,11 @@ +# @TEST-EXEC: zeek -C -r $TRACES/ntp/NTP-digest.pcap %INPUT +# @TEST-EXEC: btest-diff ntp.log +# @TEST-EXEC: btest-diff .stdout + +@load base/protocols/ntp + +event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) +{ + print fmt("ntp_message %s -> %s:%d %s", c$id$orig_h, c$id$resp_h, c$id$resp_p, msg); +} + From d0465bc45db6d1ee6601946280c380147fd01d93 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Sun, 9 Jun 2019 20:21:56 +0200 Subject: [PATCH 18/25] add extended mac field with 20 byte digest (+4 byte key id) --- src/analyzer/protocol/ntp/ntp-analyzer.pac | 7 +++++-- src/analyzer/protocol/ntp/ntp-protocol.pac | 15 +++++++++++---- 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index af42ddf9d1..654e6b11f6 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -65,10 +65,13 @@ refine flow NTP_Flow += { rv->Assign(11, proc_ntp_timestamp(${nsm.receive_ts})); rv->Assign(12, proc_ntp_timestamp(${nsm.transmit_ts})); - if (${nsm.has_mac}) { + if (${nsm.mac_len}==20) { rv->Assign(13, val_mgr->GetCount(${nsm.mac.key_id})); rv->Assign(14, bytestring_to_val(${nsm.mac.digest})); - } + } else if (${nsm.mac_len}==24) { + rv->Assign(13, val_mgr->GetCount(${nsm.mac_ext.key_id})); + rv->Assign(14, bytestring_to_val(${nsm.mac_ext.digest})); + } // TODO: add extension fields //rv->Assign(15, val_mgr->GetCount((uint32) ${nsm.extensions}->size())); diff --git a/src/analyzer/protocol/ntp/ntp-protocol.pac b/src/analyzer/protocol/ntp/ntp-protocol.pac index fd3a43f9c9..499cd1398c 100644 --- a/src/analyzer/protocol/ntp/ntp-protocol.pac +++ b/src/analyzer/protocol/ntp/ntp-protocol.pac @@ -40,13 +40,14 @@ type NTP_std_msg = record { receive_ts : NTP_Time; transmit_ts : NTP_Time; #extensions : Extension_Field[] &until($input.length() == 20); #TODO: this need to be properly parsed - mac_fields : case (has_mac) of { - true -> mac : NTP_MAC; + mac_fields : case (mac_len) of { + 20 -> mac : NTP_MAC; + 24 -> mac_ext : NTP_MAC_ext; false -> nil : empty; - } &requires(has_mac); + } &requires(mac_len); } &let { length = sourcedata.length(); - has_mac: bool = (length - offsetof(mac_fields)) == 20; + mac_len: uint32 = (length - offsetof(mac_fields)); } &byteorder=bigendian &exportsourcedata; # This format is for mode==6, control msg @@ -78,6 +79,12 @@ type NTP_MAC = record { digest: bytestring &length=16; } &length=20; +# As in RFC 5906, same as NTP_MAC but with a 160 bit digest +type NTP_MAC_ext = record { + key_id: uint32; + digest: bytestring &length=20; +} &length=24; + # As in RFC 1119 type NTP_CONTROL_MAC = record { key_id: uint32; From af91246c0311fdabee95ec6943a2fa60791a3925 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Sun, 9 Jun 2019 21:25:16 +0200 Subject: [PATCH 19/25] add extension fields parsing --- src/analyzer/protocol/ntp/ntp-protocol.pac | 29 +++++++++++++++++----- 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/src/analyzer/protocol/ntp/ntp-protocol.pac b/src/analyzer/protocol/ntp/ntp-protocol.pac index 499cd1398c..36e4c633d9 100644 --- a/src/analyzer/protocol/ntp/ntp-protocol.pac +++ b/src/analyzer/protocol/ntp/ntp-protocol.pac @@ -39,14 +39,18 @@ type NTP_std_msg = record { origin_ts : NTP_Time; receive_ts : NTP_Time; transmit_ts : NTP_Time; - #extensions : Extension_Field[] &until($input.length() == 20); #TODO: this need to be properly parsed + extensions : case (has_exts) of { + true -> exts : Extension_Field[] &until($input.length() > 24); + false -> nil : empty; + } &requires(has_exts); mac_fields : case (mac_len) of { 20 -> mac : NTP_MAC; 24 -> mac_ext : NTP_MAC_ext; - false -> nil : empty; + default -> nil2 : empty; } &requires(mac_len); } &let { length = sourcedata.length(); + has_exts: bool = (length - offsetof(extensions)) > 24; mac_len: uint32 = (length - offsetof(mac_fields)); } &byteorder=bigendian &exportsourcedata; @@ -69,7 +73,7 @@ type NTP_control_msg = record { E: bool = (second_byte & 0x40) > 0; # Second bit of 8-bits value M: bool = (second_byte & 0x20) > 0; # Third bit of 8-bits value OpCode: uint8 = (second_byte & 0x1F); # Last 5 bits of 8-bits value - length = sourcedata.length(); + length = sourcedata.length(); has_control_mac: bool = (length - offsetof(mac_fields)) == 12; } &byteorder=bigendian &exportsourcedata; @@ -91,10 +95,23 @@ type NTP_CONTROL_MAC = record { crypto_checksum: bytestring &length=8; } &length=12; +# As defined in RFC 5906 type Extension_Field = record { - field_type: uint16; - ext_len : uint16; - data : bytestring &length=ext_len-4; + first_byte_ext: uint8; + field_type : uint8; + len : uint16; + association_id: uint16; + timestamp : uint32; + filestamp : uint32; + value_len : uint32; + value : bytestring &length=value_len; + sig_len : uint32; + signature : bytestring &length=sig_len; + pad : padding to (len - offsetof(first_byte_ext)); +} &let { + R: bool = (first_byte_ext & 0x80) > 0; # First bit of 8-bits value + E: bool = (first_byte_ext & 0x40) > 0; # Second bit of 8-bits value + Code: uint8 = (first_byte_ext & 0x3F); # Last 6 bits of 8-bits value }; type NTP_Short_Time = record { From 40886fe61139c4f11c9b0a045b12e41e2c5fc7ac Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Sun, 9 Jun 2019 21:47:09 +0200 Subject: [PATCH 20/25] code clean up --- src/analyzer/protocol/ntp/ntp-analyzer.pac | 112 ++++++++++----------- src/analyzer/protocol/ntp/ntp-mode7.pac | 16 +-- src/analyzer/protocol/ntp/ntp-protocol.pac | 49 +++++---- 3 files changed, 88 insertions(+), 89 deletions(-) diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index 654e6b11f6..2d6714781c 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -35,81 +35,81 @@ refine flow NTP_Flow += { # This builds the standard msg record function BuildNTPStdMsg(nsm: NTP_std_msg): BroVal %{ - RecordVal* rv = new RecordVal(BifType::Record::NTP::std); + RecordVal* rv = new RecordVal(BifType::Record::NTP::std); - rv->Assign(0, val_mgr->GetCount(${nsm.stratum})); - rv->Assign(1, new Val(pow(2, ${nsm.poll}), TYPE_INTERVAL)); - rv->Assign(2, new Val(pow(2, ${nsm.precision}), TYPE_INTERVAL)); - rv->Assign(3, proc_ntp_short(${nsm.root_delay})); - rv->Assign(4, proc_ntp_short(${nsm.root_dispersion})); + rv->Assign(0, val_mgr->GetCount(${nsm.stratum})); + rv->Assign(1, new Val(pow(2, ${nsm.poll}), TYPE_INTERVAL)); + rv->Assign(2, new Val(pow(2, ${nsm.precision}), TYPE_INTERVAL)); + rv->Assign(3, proc_ntp_short(${nsm.root_delay})); + rv->Assign(4, proc_ntp_short(${nsm.root_dispersion})); - switch ( ${nsm.stratum} ) - { - case 0: - // unknown stratum => kiss code - rv->Assign(5, bytestring_to_val(${nsm.reference_id})); - break; - case 1: - // reference clock => ref clock string - rv->Assign(6, bytestring_to_val(${nsm.reference_id})); - break; - default: - // TODO: Check for v4/v6 - const uint8* d = ${nsm.reference_id}.data(); - rv->Assign(7, new AddrVal(IPAddr(IPv4, (const uint32*) d, IPAddr::Network))); - break; - } + switch ( ${nsm.stratum} ) + { + case 0: + // unknown stratum => kiss code + rv->Assign(5, bytestring_to_val(${nsm.reference_id})); + break; + case 1: + // reference clock => ref clock string + rv->Assign(6, bytestring_to_val(${nsm.reference_id})); + break; + default: + // TODO: Check for v4/v6 + const uint8* d = ${nsm.reference_id}.data(); + rv->Assign(7, new AddrVal(IPAddr(IPv4, (const uint32*) d, IPAddr::Network))); + break; + } - rv->Assign(9, proc_ntp_timestamp(${nsm.reference_ts})); - rv->Assign(10, proc_ntp_timestamp(${nsm.origin_ts})); - rv->Assign(11, proc_ntp_timestamp(${nsm.receive_ts})); - rv->Assign(12, proc_ntp_timestamp(${nsm.transmit_ts})); + rv->Assign(9, proc_ntp_timestamp(${nsm.reference_ts})); + rv->Assign(10, proc_ntp_timestamp(${nsm.origin_ts})); + rv->Assign(11, proc_ntp_timestamp(${nsm.receive_ts})); + rv->Assign(12, proc_ntp_timestamp(${nsm.transmit_ts})); - if (${nsm.mac_len}==20) { - rv->Assign(13, val_mgr->GetCount(${nsm.mac.key_id})); - rv->Assign(14, bytestring_to_val(${nsm.mac.digest})); - } else if (${nsm.mac_len}==24) { - rv->Assign(13, val_mgr->GetCount(${nsm.mac_ext.key_id})); - rv->Assign(14, bytestring_to_val(${nsm.mac_ext.digest})); - } - // TODO: add extension fields - //rv->Assign(15, val_mgr->GetCount((uint32) ${nsm.extensions}->size())); + if (${nsm.mac_len}==20) { + rv->Assign(13, val_mgr->GetCount(${nsm.mac.key_id})); + rv->Assign(14, bytestring_to_val(${nsm.mac.digest})); + } else if (${nsm.mac_len}==24) { + rv->Assign(13, val_mgr->GetCount(${nsm.mac_ext.key_id})); + rv->Assign(14, bytestring_to_val(${nsm.mac_ext.digest})); + } + // TODO: add extension fields + //rv->Assign(15, val_mgr->GetCount((uint32) ${nsm.extensions}->size())); - return rv; + return rv; %} # This builds the control msg record function BuildNTPControlMsg(ncm: NTP_control_msg): BroVal %{ - RecordVal* rv = new RecordVal(BifType::Record::NTP::control); + RecordVal* rv = new RecordVal(BifType::Record::NTP::control); - rv->Assign(0, val_mgr->GetCount(${ncm.OpCode})); - rv->Assign(1, val_mgr->GetBool(${ncm.R})); - rv->Assign(2, val_mgr->GetBool(${ncm.E})); - rv->Assign(3, val_mgr->GetBool(${ncm.M})); - rv->Assign(4, val_mgr->GetCount(${ncm.sequence})); - rv->Assign(5, val_mgr->GetCount(${ncm.status})); - rv->Assign(6, val_mgr->GetCount(${ncm.association_id})); - rv->Assign(7, val_mgr->GetCount(${ncm.offs})); - rv->Assign(8, val_mgr->GetCount(${ncm.c})); - rv->Assign(9, bytestring_to_val(${ncm.data})); + rv->Assign(0, val_mgr->GetCount(${ncm.OpCode})); + rv->Assign(1, val_mgr->GetBool(${ncm.R})); + rv->Assign(2, val_mgr->GetBool(${ncm.E})); + rv->Assign(3, val_mgr->GetBool(${ncm.M})); + rv->Assign(4, val_mgr->GetCount(${ncm.sequence})); + rv->Assign(5, val_mgr->GetCount(${ncm.status})); + rv->Assign(6, val_mgr->GetCount(${ncm.association_id})); + rv->Assign(7, val_mgr->GetCount(${ncm.offs})); + rv->Assign(8, val_mgr->GetCount(${ncm.c})); + rv->Assign(9, bytestring_to_val(${ncm.data})); - return rv; + return rv; %} # This builds the mode7 msg record function BuildNTPMode7Msg(m7: NTP_mode7_msg): BroVal %{ - RecordVal* rv = new RecordVal(BifType::Record::NTP::mode7); + RecordVal* rv = new RecordVal(BifType::Record::NTP::mode7); - rv->Assign(0, val_mgr->GetCount(${m7.request_code})); - rv->Assign(1, val_mgr->GetBool(${m7.auth_bit})); - rv->Assign(2, val_mgr->GetCount(${m7.sequence})); - rv->Assign(3, val_mgr->GetCount(${m7.implementation})); - rv->Assign(4, val_mgr->GetCount(${m7.error_code})); - rv->Assign(5, bytestring_to_val(${m7.data})); + rv->Assign(0, val_mgr->GetCount(${m7.request_code})); + rv->Assign(1, val_mgr->GetBool(${m7.auth_bit})); + rv->Assign(2, val_mgr->GetCount(${m7.sequence})); + rv->Assign(3, val_mgr->GetCount(${m7.implementation})); + rv->Assign(4, val_mgr->GetCount(${m7.error_code})); + rv->Assign(5, bytestring_to_val(${m7.data})); - return rv; + return rv; %} diff --git a/src/analyzer/protocol/ntp/ntp-mode7.pac b/src/analyzer/protocol/ntp/ntp-mode7.pac index 33b88ec6c4..4ff1051390 100644 --- a/src/analyzer/protocol/ntp/ntp-mode7.pac +++ b/src/analyzer/protocol/ntp/ntp-mode7.pac @@ -14,17 +14,17 @@ # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ # | Err | Number of data items | MBZ | Size of data item | # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -# | | +# | | # | Data (Minimum 0 octets, maximum 500 octets) | -# | | +# | | # [...] -# | | +# | | # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ # | Encryption Keyid (when A bit set) | # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -# | | +# | | # | Message Authentication Code (when A bit set) | -# | | +# | | # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ # # where the fields are (note that the client sends requests, the server @@ -115,9 +115,9 @@ type NTP_mode7_msg = record { false -> nil: empty; }; } &let { - auth_bit : bool = (second_byte & 0x80) > 0; - sequence : uint8 = (second_byte & 0x7F); - error_code: uint8 = (err_and_data_len & 0xF000) >> 12; + auth_bit : bool = (second_byte & 0x80) > 0; + sequence : uint8 = (second_byte & 0x7F); + error_code: uint8 = (err_and_data_len & 0xF000) >> 12; data_len : uint16 = (err_and_data_len & 0x0FFF); } &byteorder=bigendian &exportsourcedata; diff --git a/src/analyzer/protocol/ntp/ntp-protocol.pac b/src/analyzer/protocol/ntp/ntp-protocol.pac index 36e4c633d9..55b09a0ce7 100644 --- a/src/analyzer/protocol/ntp/ntp-protocol.pac +++ b/src/analyzer/protocol/ntp/ntp-protocol.pac @@ -1,10 +1,9 @@ - # This is the common part in the header format. # See RFC 5905 for details type NTP_PDU(is_orig: bool) = record { # The first byte of the NTP header contains the leap indicator, # the version and the mode - first_byte : uint8; + first_byte : uint8; # Modes 1-5 are standard NTP time sync standard_modes : case (mode>=1 && mode<=5) of { true -> std : NTP_std_msg; @@ -18,9 +17,9 @@ type NTP_PDU(is_orig: bool) = record { default -> unknown : bytestring &restofdata; }; } &let { - leap: uint8 = (first_byte & 0xc0)>>6; # First 2 bits of 8-bits value - version: uint8 = (first_byte & 0x38)>>3; # Bits 3-5 of 8-bits value - mode: uint8 = (first_byte & 0x07); # Bits 6-8 of 8-bits value + leap : uint8 = (first_byte & 0xc0)>>6; # First 2 bits of 8-bits value + version : uint8 = (first_byte & 0x38)>>3; # Bits 3-5 of 8-bits value + mode : uint8 = (first_byte & 0x07); # Bits 6-8 of 8-bits value } &byteorder=bigendian &exportsourcedata; # This is the most common type of message, corresponding to modes 1-5 @@ -40,13 +39,13 @@ type NTP_std_msg = record { receive_ts : NTP_Time; transmit_ts : NTP_Time; extensions : case (has_exts) of { - true -> exts : Extension_Field[] &until($input.length() > 24); + true -> exts : Extension_Field[] &until($input.length() > 24); false -> nil : empty; } &requires(has_exts); mac_fields : case (mac_len) of { - 20 -> mac : NTP_MAC; - 24 -> mac_ext : NTP_MAC_ext; - default -> nil2 : empty; + 20 -> mac : NTP_MAC; + 24 -> mac_ext : NTP_MAC_ext; + default -> nil2 : empty; } &requires(mac_len); } &let { length = sourcedata.length(); @@ -64,35 +63,35 @@ type NTP_control_msg = record { offs : uint16; c : uint16; data : bytestring &length=c; - mac_fields : case (has_control_mac) of { + mac_fields : case (has_control_mac) of { true -> mac : NTP_CONTROL_MAC; false -> nil : empty; } &requires(has_control_mac); } &let { - R: bool = (second_byte & 0x80) > 0; # First bit of 8-bits value - E: bool = (second_byte & 0x40) > 0; # Second bit of 8-bits value - M: bool = (second_byte & 0x20) > 0; # Third bit of 8-bits value - OpCode: uint8 = (second_byte & 0x1F); # Last 5 bits of 8-bits value - length = sourcedata.length(); + R : bool = (second_byte & 0x80) > 0; # First bit of 8-bits value + E : bool = (second_byte & 0x40) > 0; # Second bit of 8-bits value + M : bool = (second_byte & 0x20) > 0; # Third bit of 8-bits value + OpCode : uint8 = (second_byte & 0x1F); # Last 5 bits of 8-bits value + length = sourcedata.length(); has_control_mac: bool = (length - offsetof(mac_fields)) == 12; } &byteorder=bigendian &exportsourcedata; # As in RFC 5905 type NTP_MAC = record { - key_id: uint32; - digest: bytestring &length=16; + key_id : uint32; + digest : bytestring &length=16; } &length=20; # As in RFC 5906, same as NTP_MAC but with a 160 bit digest type NTP_MAC_ext = record { - key_id: uint32; - digest: bytestring &length=20; + key_id : uint32; + digest : bytestring &length=20; } &length=24; # As in RFC 1119 type NTP_CONTROL_MAC = record { - key_id: uint32; - crypto_checksum: bytestring &length=8; + key_id : uint32; + crypto_checksum : bytestring &length=8; } &length=12; # As defined in RFC 5906 @@ -115,11 +114,11 @@ type Extension_Field = record { }; type NTP_Short_Time = record { - seconds: int16; - fractions: int16; + seconds : int16; + fractions : int16; }; type NTP_Time = record { - seconds: uint32; - fractions: uint32; + seconds : uint32; + fractions : uint32; }; From 1c078bed255218fbd155fe7bcc1693360293e903 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Tue, 11 Jun 2019 15:06:38 +0200 Subject: [PATCH 21/25] fix wrong assignment of control key_id/crypto_checksum --- src/analyzer/protocol/ntp/ntp-analyzer.pac | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index 2d6714781c..0418a50a98 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -90,9 +90,12 @@ refine flow NTP_Flow += { rv->Assign(4, val_mgr->GetCount(${ncm.sequence})); rv->Assign(5, val_mgr->GetCount(${ncm.status})); rv->Assign(6, val_mgr->GetCount(${ncm.association_id})); - rv->Assign(7, val_mgr->GetCount(${ncm.offs})); - rv->Assign(8, val_mgr->GetCount(${ncm.c})); - rv->Assign(9, bytestring_to_val(${ncm.data})); + rv->Assign(7, bytestring_to_val(${ncm.data})); + + if (${ncm.has_control_mac}) { + rv->Assign(8, val_mgr->GetCount(${ncm.mac.key_id})); + rv->Assign(9, bytestring_to_val(${ncm.mac.crypto_checksum})); + } return rv; %} From 6c29feb1d7b1d8fad3641ce5c1f0a46365a47345 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Tue, 11 Jun 2019 15:29:37 +0200 Subject: [PATCH 22/25] fix some initializations --- src/analyzer/protocol/ntp/ntp-analyzer.pac | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index 0418a50a98..a560c3d3fd 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -71,10 +71,12 @@ refine flow NTP_Flow += { } else if (${nsm.mac_len}==24) { rv->Assign(13, val_mgr->GetCount(${nsm.mac_ext.key_id})); rv->Assign(14, bytestring_to_val(${nsm.mac_ext.digest})); - } - // TODO: add extension fields - //rv->Assign(15, val_mgr->GetCount((uint32) ${nsm.extensions}->size())); + } + if (${nsm.has_exts}) { + // TODO: add extension fields + rv->Assign(15, val_mgr->GetCount((uint32) ${nsm.exts}->size())); + } return rv; %} @@ -90,7 +92,9 @@ refine flow NTP_Flow += { rv->Assign(4, val_mgr->GetCount(${ncm.sequence})); rv->Assign(5, val_mgr->GetCount(${ncm.status})); rv->Assign(6, val_mgr->GetCount(${ncm.association_id})); - rv->Assign(7, bytestring_to_val(${ncm.data})); + + if (${ncm.c}>0) + rv->Assign(7, bytestring_to_val(${ncm.data})); if (${ncm.has_control_mac}) { rv->Assign(8, val_mgr->GetCount(${ncm.mac.key_id})); @@ -110,7 +114,8 @@ refine flow NTP_Flow += { rv->Assign(2, val_mgr->GetCount(${m7.sequence})); rv->Assign(3, val_mgr->GetCount(${m7.implementation})); rv->Assign(4, val_mgr->GetCount(${m7.error_code})); - rv->Assign(5, bytestring_to_val(${m7.data})); + if (${m7.data_len}>0) + rv->Assign(5, bytestring_to_val(${m7.data})); return rv; %} From b130cc793139f569c56e9b720b16aac6ee257534 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Wed, 12 Jun 2019 12:46:18 +0200 Subject: [PATCH 23/25] minor changes in the documentation --- scripts/base/init-bare.zeek | 43 ++++++++++++++++++++++++++----------- 1 file changed, 30 insertions(+), 13 deletions(-) diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index a9b39ec5d1..97f9fea557 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -4938,32 +4938,41 @@ export { ## This record contains the standard fields used by the NTP protocol ## for standard syncronization operations. type NTP::std: record { - ## The stratum (primary server, secondary server, etc.) + ## This value mainly identifies the type of server (primary server, + ## secondary server, etc.). Possible values, as in :rfc:`5905`, are: + ## 0 -> unspecified or invalid + ## 1 -> primary server (e.g., equipped with a GPS receiver) + ## 2-15 -> secondary server (via NTP) + ## 16 -> unsynchronized + ## 17-255 -> reserved + ## For stratum=0, a kiss_code can be given for debugging and monitoring stratum: count; ## The maximum interval between successive messages poll: interval; ## The precision of the system clock precision: interval; - ## Total round-trip delay to the reference clock + ## Root delay. The total round-trip delay to the reference clock root_delay: interval; - ## Total dispersion to the reference clock + ## Root Dispersion. The total dispersion to the reference clock root_disp: interval; - ## For stratum 0, 4 character string used for debugging + ## For stratum 0, four-character ASCII string used for debugging and monitoring. + ## Values are defined in :rfc:`1345`. kiss_code: string &optional; - ## For stratum 1, ID assigned to the reference clock by IANA + ## Reference ID. For stratum=1, this is the ID assigned to the reference clock by IANA. + ## For example: GOES, GPS, GAL, etc. (see :rfc:`5905`) ref_id: string &optional; ## Above stratum 1, when using IPv4, the IP address of the reference clock ref_addr: addr &optional; ## Above stratum 1, when using IPv6, the first four bytes of the MD5 hash of the - ## IPv6 address of the reference clock + ## IPv6 address of the reference clock. Note: currently not implemented. ref_v6_hash_prefix: string &optional; - ## Time when the system clock was last set or correct + ## Reference timestamp. Time when the system clock was last set or correct ref_time: time; - ## Time at the client when the request departed for the NTP server + ## Origin timestamp. Time at the client when the request departed for the NTP server org_time: time; - ## Time at the server when the request arrived from the NTP client + ## Receive timestamp. Time at the server when the request arrived from the NTP client rec_time: time; - ## Time at the server when the response departed for the NTP client + ## Transmit timestamp. Time at the server when the response departed for the NTP client xmt_time: time; ## Key used to designate a secret MD5 key key_id: count &optional; @@ -5051,11 +5060,19 @@ export { }; ## NTP message as defined in :rfc:`5905`. - ## Doesn't include fields for mode 7 (reserved for private use), e.g. monlist + ## Does include fields for mode 7, reserved for private use in :rfc:`5905`, but used + ## in some implementation for commands such as "monlist". type NTP::Message: record { - ## The NTP version number (1, 2, 3, 4) + ## The NTP version number (1, 2, 3, 4). version: count; - ## The NTP mode being used + ## The NTP mode being used. Possible values are: + ## 1 - symmetric active + ## 2 - symmetric passive + ## 3 - client + ## 4 - server + ## 5 - broadcast + ## 6 - NTP control message + ## 7 - reserved for private use mode: count; ## If mode=1-5, the standard fields for syncronization operations are here. ## See :rfc:`5905` From 32663cec04775abc6c4d07349f0161642d5c23e8 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Fri, 14 Jun 2019 12:30:29 +0200 Subject: [PATCH 24/25] Apply requested changes: - file dpd.sig and TODO comments for signature protocol detection removed - missing doc field filled in events.bif - rename OpCode and ReqCode fields into op_code and req_code respectively - removed unnecessary child method in NTP.h/.cc - main.zeek and ntp-protocol.pac reformatted --- scripts/base/init-bare.zeek | 4 +- scripts/base/protocols/ntp/__load__.zeek | 1 - scripts/base/protocols/ntp/dpd.sig | 12 - scripts/base/protocols/ntp/main.zeek | 312 ++++++++++----------- src/analyzer/protocol/ntp/NTP.cc | 5 - src/analyzer/protocol/ntp/NTP.h | 1 - src/analyzer/protocol/ntp/events.bif | 2 +- src/analyzer/protocol/ntp/ntp-protocol.pac | 140 ++++----- 8 files changed, 229 insertions(+), 248 deletions(-) delete mode 100644 scripts/base/protocols/ntp/dpd.sig diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index 97f9fea557..71f572e028 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -4995,7 +4995,7 @@ export { ## 6 set trap address/port command/response ## 7 trap response ## Other values are reserved. - OpCode : count; + op_code : count; ## The response bit. Set to zero for commands, one for responses. resp_bit : bool; ## The error bit. Set to zero for normal response, one for error response. @@ -5029,7 +5029,7 @@ export { ## An implementation-specific code which specifies the ## operation to be (which has been) performed and/or the ## format and semantics of the data included in the packet. - ReqCode : count; + req_code : count; ## The authenticated bit. If set, this packet is authenticated. auth_bit : bool; ## For a multipacket response, contains the sequence diff --git a/scripts/base/protocols/ntp/__load__.zeek b/scripts/base/protocols/ntp/__load__.zeek index 16ffbbf380..a10fe855df 100644 --- a/scripts/base/protocols/ntp/__load__.zeek +++ b/scripts/base/protocols/ntp/__load__.zeek @@ -1,2 +1 @@ @load ./main -#@load-sigs ./dpd.sig diff --git a/scripts/base/protocols/ntp/dpd.sig b/scripts/base/protocols/ntp/dpd.sig deleted file mode 100644 index 3c755ecc4f..0000000000 --- a/scripts/base/protocols/ntp/dpd.sig +++ /dev/null @@ -1,12 +0,0 @@ -signature dpd_ntp { - - ip-proto == udp - - - # ## TODO: Define the payload. When Bro sees this regex, on - # ## any port, it will enable your analyzer on that - # ## connection. - # ## payload /^NTP/ - - enable "ntp" -} diff --git a/scripts/base/protocols/ntp/main.zeek b/scripts/base/protocols/ntp/main.zeek index 40b2b9caf0..cebc3e7184 100644 --- a/scripts/base/protocols/ntp/main.zeek +++ b/scripts/base/protocols/ntp/main.zeek @@ -1,138 +1,137 @@ module NTP; -# TODO: The recommended method to do dynamic protocol detection -# (DPD) is with the signatures in dpd.sig. # For the time being, we use port detection. const ports = { 123/udp }; redef likely_server_ports += { ports }; export { - redef enum Log::ID += { LOG }; + redef enum Log::ID += { LOG }; - type Info: record { - ## Timestamp for when the event happened. - ts: time &log; - ## Unique ID for the connection. - uid: string &log; - ## The connection's 4-tuple of endpoint addresses/ports. - id: conn_id &log; + type Info: record { + ## Timestamp for when the event happened. + ts: time &log; + ## Unique ID for the connection. + uid: string &log; + ## The connection's 4-tuple of endpoint addresses/ports. + id: conn_id &log; ## The NTP version number (1, 2, 3, 4) - version: count &log; - ## The NTP mode being used - mode: count &log; - ## The stratum (primary server, secondary server, etc.) - stratum: count &log; - ## The maximum interval between successive messages - poll: interval &log; - ## The precision of the system clock - precision: interval &log; - ## Total round-trip delay to the reference clock - root_delay: interval &log; - ## Total dispersion to the reference clock - root_disp: interval &log; - ## For stratum 0, 4 character string used for debugging - kiss_code: string &optional &log; - ## For stratum 1, ID assigned to the reference clock by IANA - ref_id: string &optional &log; - ## Above stratum 1, when using IPv4, the IP address of the reference clock - ref_addr: addr &optional &log; - ## Above stratum 1, when using IPv6, the first four bytes of the MD5 hash of the - ## IPv6 address of the reference clock - ref_v6_hash_prefix: string &optional &log; - ## Time when the system clock was last set or correct - ref_time: time &log; - ## Time at the client when the request departed for the NTP server - org_time: time &log; - ## Time at the server when the request arrived from the NTP client - rec_time: time &log; - ## Time at the server when the response departed for the NTP client - xmt_time: time &log; - ## Key used to designate a secret MD5 key - key_id: count &optional &log; - ## MD5 hash computed over the key followed by the NTP packet header and extension fields - digest: string &optional &log; - ## Number of extension fields (which are not currently parsed) - num_exts: count &default=0 &log; + version: count &log; + ## The NTP mode being used + mode: count &log; + ## The stratum (primary server, secondary server, etc.) + stratum: count &log; + ## The maximum interval between successive messages + poll: interval &log; + ## The precision of the system clock + precision: interval &log; + ## Total round-trip delay to the reference clock + root_delay: interval &log; + ## Total dispersion to the reference clock + root_disp: interval &log; + ## For stratum 0, 4 character string used for debugging + kiss_code: string &optional &log; + ## For stratum 1, ID assigned to the reference clock by IANA + ref_id: string &optional &log; + ## Above stratum 1, when using IPv4, the IP address of the reference clock + ref_addr: addr &optional &log; + ## Above stratum 1, when using IPv6, the first four bytes of the MD5 hash of the + ## IPv6 address of the reference clock + ref_v6_hash_prefix: string &optional &log; + ## Time when the system clock was last set or correct + ref_time: time &log; + ## Time at the client when the request departed for the NTP server + org_time: time &log; + ## Time at the server when the request arrived from the NTP client + rec_time: time &log; + ## Time at the server when the response departed for the NTP client + xmt_time: time &log; + ## Key used to designate a secret MD5 key + key_id: count &optional &log; + ## MD5 hash computed over the key followed by the NTP packet header and extension fields + digest: string &optional &log; + ## Number of extension fields (which are not currently parsed) + num_exts: count &default=0 &log; - ## An integer specifying the command function. Values currently defined includes: - ## 1 read status command/response - ## 2 read variables command/response - ## 3 write variables command/response - ## 4 read clock variables command/response - ## 5 write clock variables command/response - ## 6 set trap address/port command/response - ## 7 trap response - ## Other values are reserved. - OpCode : count &log; - ## The response bit. Set to zero for commands, one for responses. - resp_bit : bool &log; - ## The error bit. Set to zero for normal response, one for error response. - err_bit : bool &log; - ## The more bit. Set to zero for last fragment, one for all others. - more_bit : bool &log; - ## The sequence number of the command or response - sequence : count &log; - ## The current status of the system, peer or clock - status : count &log; - ## A 16-bit integer identifying a valid association - association_id : count &log; - ## This is an integer identifying the cryptographic - ## key used to generate the message-authentication code - ctrl_key_id : count &optional &log; - ## This is a crypto-checksum computed by the encryption procedure - crypto_checksum : string &optional &log; + ## An integer specifying the command function. Values currently defined includes: + ## 1 read status command/response + ## 2 read variables command/response + ## 3 write variables command/response + ## 4 read clock variables command/response + ## 5 write clock variables command/response + ## 6 set trap address/port command/response + ## 7 trap response + ## Other values are reserved. + op_code : count &log; + ## The response bit. Set to zero for commands, one for responses. + resp_bit : bool &log; + ## The error bit. Set to zero for normal response, one for error response. + err_bit : bool &log; + ## The more bit. Set to zero for last fragment, one for all others. + more_bit : bool &log; + ## The sequence number of the command or response + sequence : count &log; + ## The current status of the system, peer or clock + status : count &log; + ## A 16-bit integer identifying a valid association + association_id : count &log; + ## This is an integer identifying the cryptographic + ## key used to generate the message-authentication code + ctrl_key_id : count &optional &log; + ## This is a crypto-checksum computed by the encryption procedure + crypto_checksum : string &optional &log; ## An implementation-specific code which specifies the ## operation to be (which has been) performed and/or the ## format and semantics of the data included in the packet. - ReqCode : count &log; - ## The authenticated bit. If set, this packet is authenticated. - auth_bit : bool &log; - ## For a multipacket response, contains the sequence - ## number of this packet. 0 is the first in the sequence, - ## 127 (or less) is the last. The More Bit must be set in - ## all packets but the last. - sequence : count &log; - ## The number of the implementation this request code - ## is defined by. An implementation number of zero is used - ## for requst codes/data formats which all implementations - ## agree on. Implementation number 255 is reserved (for - ## extensions, in case we run out). - implementation : count &log; - ## Must be 0 for a request. For a response, holds an error - ## code relating to the request. If nonzero, the operation - ## requested wasn't performed. - ## - ## 0 - no error - ## 1 - incompatible implementation number - ## 2 - unimplemented request code - ## 3 - format error (wrong data items, data size, packet size etc.) - ## 4 - no data available (e.g. request for details on unknown peer) - ## 5-6 I don't know - ## 7 - authentication failure (i.e. permission denied) - err : count &log; + req_code : count &log; + ## The authenticated bit. If set, this packet is authenticated. + auth_bit : bool &log; + ## For a multipacket response, contains the sequence + ## number of this packet. 0 is the first in the sequence, + ## 127 (or less) is the last. The More Bit must be set in + ## all packets but the last. + sequence : count &log; + ## The number of the implementation this request code + ## is defined by. An implementation number of zero is used + ## for requst codes/data formats which all implementations + ## agree on. Implementation number 255 is reserved (for + ## extensions, in case we run out). + implementation : count &log; + ## Must be 0 for a request. For a response, holds an error + ## code relating to the request. If nonzero, the operation + ## requested wasn't performed. + ## + ## 0 - no error + ## 1 - incompatible implementation number + ## 2 - unimplemented request code + ## 3 - format error (wrong data items, data size, packet size etc.) + ## 4 - no data available (e.g. request for details on unknown peer) + ## 5-6 I don't know + ## 7 - authentication failure (i.e. permission denied) + err : count &log; }; - ## Event that can be handled to access the NTP record as it is sent on - ## to the logging framework. - global log_ntp: event(rec: Info); + ## Event that can be handled to access the NTP record as it is sent on + ## to the logging framework. + global log_ntp: event(rec: Info); } redef record connection += { - ntp: Info &optional; + ntp: Info &optional; }; event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) &priority=5 -{ + { local info: Info; - info$ts = network_time(); - info$uid = c$uid; - info$id = c$id; - info$version = msg$version; - info$mode = msg$mode; + info$ts = network_time(); + info$uid = c$uid; + info$id = c$id; + info$version = msg$version; + info$mode = msg$mode; - if ( msg$mode < 6 ) { + if ( msg$mode < 6 ) + { info$stratum = msg$std_msg$stratum; info$poll = msg$std_msg$poll; info$precision = msg$std_msg$precision; @@ -141,69 +140,70 @@ event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) &priority=5 if ( msg$std_msg?$kiss_code) info$kiss_code = msg$std_msg$kiss_code; - if ( msg$std_msg?$ref_id) - info$ref_id = msg$std_msg$ref_id; - if ( msg$std_msg?$ref_addr) - info$ref_addr = msg$std_msg$ref_addr; - if ( msg$std_msg?$ref_v6_hash_prefix) - info$ref_v6_hash_prefix = msg$std_msg$ref_v6_hash_prefix; + if ( msg$std_msg?$ref_id) + info$ref_id = msg$std_msg$ref_id; + if ( msg$std_msg?$ref_addr) + info$ref_addr = msg$std_msg$ref_addr; + if ( msg$std_msg?$ref_v6_hash_prefix) + info$ref_v6_hash_prefix = msg$std_msg$ref_v6_hash_prefix; - info$ref_time = msg$std_msg$ref_time; - info$org_time = msg$std_msg$org_time; - info$rec_time = msg$std_msg$rec_time; - info$xmt_time = msg$std_msg$xmt_time; + info$ref_time = msg$std_msg$ref_time; + info$org_time = msg$std_msg$org_time; + info$rec_time = msg$std_msg$rec_time; + info$xmt_time = msg$std_msg$xmt_time; - if ( msg$std_msg?$key_id) - info$key_id = msg$std_msg$key_id; - if ( msg$std_msg?$digest) - info$digest = msg$std_msg$digest; + if ( msg$std_msg?$key_id) + info$key_id = msg$std_msg$key_id; + if ( msg$std_msg?$digest) + info$digest = msg$std_msg$digest; info$num_exts = msg$std_msg$num_exts; - } + } - if ( msg$mode==6 ) { - info$OpCode = msg$control_msg$OpCode; - info$resp_bit = msg$control_msg$resp_bit; - info$err_bit = msg$control_msg$err_bit; - info$more_bit = msg$control_msg$more_bit; - info$sequence = msg$control_msg$sequence; - info$status = msg$control_msg$status; - info$association_id = msg$control_msg$association_id; + if ( msg$mode==6 ) + { + info$op_code = msg$control_msg$op_code; + info$resp_bit = msg$control_msg$resp_bit; + info$err_bit = msg$control_msg$err_bit; + info$more_bit = msg$control_msg$more_bit; + info$sequence = msg$control_msg$sequence; + info$status = msg$control_msg$status; + info$association_id = msg$control_msg$association_id; - if ( msg$control_msg?$key_id) - info$ctrl_key_id = msg$control_msg$key_id; - if ( msg$control_msg?$crypto_checksum) - info$crypto_checksum = msg$control_msg$crypto_checksum; + if ( msg$control_msg?$key_id) + info$ctrl_key_id = msg$control_msg$key_id; + if ( msg$control_msg?$crypto_checksum) + info$crypto_checksum = msg$control_msg$crypto_checksum; + } - } + if ( msg$mode==7 ) + { + info$req_code = msg$mode7_msg$req_code; + info$auth_bit = msg$mode7_msg$auth_bit; + info$sequence = msg$mode7_msg$sequence; + info$implementation = msg$mode7_msg$implementation; + info$err = msg$mode7_msg$err; + } - if ( msg$mode==7 ) { - info$ReqCode = msg$mode7_msg$ReqCode; - info$auth_bit = msg$mode7_msg$auth_bit; - info$sequence = msg$mode7_msg$sequence; - info$implementation = msg$mode7_msg$implementation; - info$err = msg$mode7_msg$err; - } - - # Copy the present packet info into the connection record + # Copy the present packet info into the connection record # If more ntp packets are sent on the same connection, the newest one # will overwrite the previous c$ntp = info; # Add the service to the Conn::LOG add c$service["ntp"]; -} + } event ntp_message(c: connection, is_orig: bool, msg: NTP::Message) &priority=-5 -{ - # Log every ntp packet into ntp.log - Log::write(NTP::LOG, c$ntp); -} + { + # Log every ntp packet into ntp.log + Log::write(NTP::LOG, c$ntp); + } event zeek_init() &priority=5 -{ - Analyzer::register_for_ports(Analyzer::ANALYZER_NTP, ports); + { + Analyzer::register_for_ports(Analyzer::ANALYZER_NTP, ports); - Log::create_stream(NTP::LOG, [$columns = Info, $ev = log_ntp]); -} + Log::create_stream(NTP::LOG, [$columns = Info, $ev = log_ntp]); + } diff --git a/src/analyzer/protocol/ntp/NTP.cc b/src/analyzer/protocol/ntp/NTP.cc index 9a88138206..9c44e7b526 100644 --- a/src/analyzer/protocol/ntp/NTP.cc +++ b/src/analyzer/protocol/ntp/NTP.cc @@ -17,11 +17,6 @@ NTP_Analyzer::~NTP_Analyzer() delete interp; } -void NTP_Analyzer::Done() - { - Analyzer::Done(); - } - void NTP_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, uint64 seq, const IP_Hdr* ip, int caplen) { diff --git a/src/analyzer/protocol/ntp/NTP.h b/src/analyzer/protocol/ntp/NTP.h index c155fb3135..b43e51217b 100644 --- a/src/analyzer/protocol/ntp/NTP.h +++ b/src/analyzer/protocol/ntp/NTP.h @@ -16,7 +16,6 @@ public: ~NTP_Analyzer() override; // Overriden from Analyzer. - void Done() override; void DeliverPacket(int len, const u_char* data, bool orig, uint64 seq, const IP_Hdr* ip, int caplen) override; diff --git a/src/analyzer/protocol/ntp/events.bif b/src/analyzer/protocol/ntp/events.bif index b9f66a1160..3ed214db0f 100644 --- a/src/analyzer/protocol/ntp/events.bif +++ b/src/analyzer/protocol/ntp/events.bif @@ -6,7 +6,7 @@ ## ## c: The connection record describing the corresponding UDP flow. ## -## is_orig: +## is_orig: True if the message was sent by the originator. ## ## msg: The parsed NTP message. ## diff --git a/src/analyzer/protocol/ntp/ntp-protocol.pac b/src/analyzer/protocol/ntp/ntp-protocol.pac index 55b09a0ce7..9679256a7e 100644 --- a/src/analyzer/protocol/ntp/ntp-protocol.pac +++ b/src/analyzer/protocol/ntp/ntp-protocol.pac @@ -3,52 +3,52 @@ type NTP_PDU(is_orig: bool) = record { # The first byte of the NTP header contains the leap indicator, # the version and the mode - first_byte : uint8; - # Modes 1-5 are standard NTP time sync - standard_modes : case (mode>=1 && mode<=5) of { - true -> std : NTP_std_msg; - false -> emp : empty; - }; - modes_6_7 : case (mode) of { + first_byte : uint8; + # Modes 1-5 are standard NTP time sync + standard_modes : case (mode>=1 && mode<=5) of { + true -> std : NTP_std_msg; + false -> emp : empty; + }; + modes_6_7 : case (mode) of { # mode 6 is for control messages (format is different from modes 6-7) - 6 -> control : NTP_control_msg; + 6 -> control : NTP_control_msg; # mode 7 is reserved or private (and implementation dependent). For example used for some commands such as MONLIST - 7 -> mode7 : NTP_mode7_msg; - default -> unknown : bytestring &restofdata; - }; + 7 -> mode7 : NTP_mode7_msg; + default -> unknown : bytestring &restofdata; + }; } &let { - leap : uint8 = (first_byte & 0xc0)>>6; # First 2 bits of 8-bits value - version : uint8 = (first_byte & 0x38)>>3; # Bits 3-5 of 8-bits value - mode : uint8 = (first_byte & 0x07); # Bits 6-8 of 8-bits value + leap : uint8 = (first_byte & 0xc0)>>6; # First 2 bits of 8-bits value + version : uint8 = (first_byte & 0x38)>>3; # Bits 3-5 of 8-bits value + mode : uint8 = (first_byte & 0x07); # Bits 6-8 of 8-bits value } &byteorder=bigendian &exportsourcedata; # This is the most common type of message, corresponding to modes 1-5 # This kind of msg are used for normal operation of syncronization # See RFC 5905 for details type NTP_std_msg = record { - stratum : uint8; - poll : int8; - precision : int8; + stratum : uint8; + poll : int8; + precision : int8; - root_delay : NTP_Short_Time; - root_dispersion: NTP_Short_Time; - reference_id : bytestring &length=4; - reference_ts : NTP_Time; + root_delay : NTP_Short_Time; + root_dispersion : NTP_Short_Time; + reference_id : bytestring &length=4; + reference_ts : NTP_Time; - origin_ts : NTP_Time; - receive_ts : NTP_Time; - transmit_ts : NTP_Time; - extensions : case (has_exts) of { - true -> exts : Extension_Field[] &until($input.length() > 24); - false -> nil : empty; - } &requires(has_exts); - mac_fields : case (mac_len) of { - 20 -> mac : NTP_MAC; - 24 -> mac_ext : NTP_MAC_ext; - default -> nil2 : empty; - } &requires(mac_len); + origin_ts : NTP_Time; + receive_ts : NTP_Time; + transmit_ts : NTP_Time; + extensions : case (has_exts) of { + true -> exts : Extension_Field[] &until($input.length() > 24); + false -> nil : empty; + } &requires(has_exts); + mac_fields : case (mac_len) of { + 20 -> mac : NTP_MAC; + 24 -> mac_ext : NTP_MAC_ext; + default -> nil2 : empty; + } &requires(mac_len); } &let { - length = sourcedata.length(); + length = sourcedata.length(); has_exts: bool = (length - offsetof(extensions)) > 24; mac_len: uint32 = (length - offsetof(mac_fields)); } &byteorder=bigendian &exportsourcedata; @@ -56,24 +56,24 @@ type NTP_std_msg = record { # This format is for mode==6, control msg # See RFC 1119 for details type NTP_control_msg = record { - second_byte : uint8; - sequence : uint16; - status : uint16; #TODO: this can be further parsed internally - association_id : uint16; - offs : uint16; - c : uint16; + second_byte : uint8; + sequence : uint16; + status : uint16; #TODO: this can be further parsed internally + association_id : uint16; + offs : uint16; + c : uint16; data : bytestring &length=c; - mac_fields : case (has_control_mac) of { - true -> mac : NTP_CONTROL_MAC; - false -> nil : empty; - } &requires(has_control_mac); + mac_fields : case (has_control_mac) of { + true -> mac : NTP_CONTROL_MAC; + false -> nil : empty; + } &requires(has_control_mac); } &let { - R : bool = (second_byte & 0x80) > 0; # First bit of 8-bits value - E : bool = (second_byte & 0x40) > 0; # Second bit of 8-bits value - M : bool = (second_byte & 0x20) > 0; # Third bit of 8-bits value - OpCode : uint8 = (second_byte & 0x1F); # Last 5 bits of 8-bits value - length = sourcedata.length(); - has_control_mac: bool = (length - offsetof(mac_fields)) == 12; + R : bool = (second_byte & 0x80) > 0; # First bit of 8-bits value + E : bool = (second_byte & 0x40) > 0; # Second bit of 8-bits value + M : bool = (second_byte & 0x20) > 0; # Third bit of 8-bits value + OpCode : uint8 = (second_byte & 0x1F); # Last 5 bits of 8-bits value + length = sourcedata.length(); + has_control_mac: bool = (length - offsetof(mac_fields)) == 12; } &byteorder=bigendian &exportsourcedata; # As in RFC 5905 @@ -90,35 +90,35 @@ type NTP_MAC_ext = record { # As in RFC 1119 type NTP_CONTROL_MAC = record { - key_id : uint32; - crypto_checksum : bytestring &length=8; + key_id : uint32; + crypto_checksum : bytestring &length=8; } &length=12; # As defined in RFC 5906 type Extension_Field = record { - first_byte_ext: uint8; - field_type : uint8; - len : uint16; - association_id: uint16; - timestamp : uint32; - filestamp : uint32; - value_len : uint32; - value : bytestring &length=value_len; - sig_len : uint32; - signature : bytestring &length=sig_len; - pad : padding to (len - offsetof(first_byte_ext)); + first_byte_ext: uint8; + field_type : uint8; + len : uint16; + association_id : uint16; + timestamp : uint32; + filestamp : uint32; + value_len : uint32; + value : bytestring &length=value_len; + sig_len : uint32; + signature : bytestring &length=sig_len; + pad : padding to (len - offsetof(first_byte_ext)); } &let { - R: bool = (first_byte_ext & 0x80) > 0; # First bit of 8-bits value - E: bool = (first_byte_ext & 0x40) > 0; # Second bit of 8-bits value - Code: uint8 = (first_byte_ext & 0x3F); # Last 6 bits of 8-bits value + R: bool = (first_byte_ext & 0x80) > 0; # First bit of 8-bits value + E: bool = (first_byte_ext & 0x40) > 0; # Second bit of 8-bits value + Code: uint8 = (first_byte_ext & 0x3F); # Last 6 bits of 8-bits value }; type NTP_Short_Time = record { - seconds : int16; - fractions : int16; + seconds : int16; + fractions : int16; }; type NTP_Time = record { - seconds : uint32; - fractions : uint32; + seconds : uint32; + fractions : uint32; }; From 3e7532e76048005aaaff9f490078039fa54a1ad3 Mon Sep 17 00:00:00 2001 From: Mauro Palumbo Date: Fri, 14 Jun 2019 14:00:33 +0200 Subject: [PATCH 25/25] update tests baseline --- .../ntp.log | 6 +++--- .../scripts.base.protocols.ntp.ntp/ntp.log | 6 +++--- .../scripts.base.protocols.ntp.ntp2/.stdout | 2 +- .../scripts.base.protocols.ntp.ntp2/ntp.log | 6 +++--- .../scripts.base.protocols.ntp.ntp3/ntp.log | 6 +++--- .../.stdout | 18 +++++++++--------- .../ntp.log | 18 +++++++++--------- 7 files changed, 31 insertions(+), 31 deletions(-) diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/ntp.log index 7b687745d5..67a1f539d6 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp-digest/ntp.log @@ -3,8 +3,8 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-06-14-43-28 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum ReqCode auth_bit sequence implementation err +#open 2019-06-14-10-32-46 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts op_code resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum req_code auth_bit sequence implementation err #types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count string count bool count count count 1495804929.483801 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.026230 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495804929.482904 1 \xac\x01{i\x91\\\xe5\xa7\xa9\xfbs\xac\x8b\xd1`; 0 - - - - - - - - - - - - - - 1495804987.484143 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.027100 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495804987.483591 1 3\x03\x03\xf0\xaa\x15`\xf5i\xd8=\xfa\x10S\x80\xd4 0 - - - - - - - - - - - - - - @@ -46,4 +46,4 @@ 1495806080.498110 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.043488 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495806080.498132 1 \xe0\xa3^\x9ck*qa\x85\x1aVA|bJA 0 - - - - - - - - - - - - - - 1495806100.498331 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.043793 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495806100.498395 1 ;\x03\xae\x8a\xf1}ABj\x87\xa0\xf4\xa8C\xd7\x9f 0 - - - - - - - - - - - - - - 1495806130.498492 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.044235 - - 182.165.128.219 - 1495804247.476651 0.000000 0.000000 1495806130.498813 1 \x1e\xa7\xc3\xd2\xe3\x0e\x08!\x8f\xe3Z$&B\x96\x13 0 - - - - - - - - - - - - - - -#close 2019-06-06-14-43-28 +#close 2019-06-14-10-32-46 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log index f69cae6089..1d8ff5f21f 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp/ntp.log @@ -3,8 +3,8 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-06-14-36-12 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum ReqCode auth_bit sequence implementation err +#open 2019-06-14-10-32-45 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts op_code resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum req_code auth_bit sequence implementation err #types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count string count bool count count count 1559246614.027454 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 3 2 64.000000 0.000000 0.046280 0.024170 - - 85.199.214.99 - 1559246556.073681 1559246548.048352 1559246548.076756 1559246614.027421 - - 0 - - - - - - - - - - - - - - 1559246614.074475 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 4 4 64.000000 0.000000 0.048843 0.071350 - - 105.237.207.28 - 1559245852.721794 1559246614.027421 1559246614.048376 1559246614.048407 - - 0 - - - - - - - - - - - - - - @@ -38,4 +38,4 @@ 1559246626.075079 Ck51lg1bScffFj34Ri 192.168.43.118 123 147.135.207.213 123 4 4 2 64.000000 0.000008 0.042236 0.037491 - - 212.7.1.132 - 1559245356.576177 1559246626.027432 1559246626.058084 1559246626.058151 - - 0 - - - - - - - - - - - - - - 1559246627.027502 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.88.132 123 3 3 2 64.000000 0.000000 0.046280 0.024368 - - 85.199.214.99 - 1559246556.073681 1559246560.040576 1559246560.064668 1559246627.027459 - - 0 - - - - - - - - - - - - - - 1559246627.073485 CNnMIj2QSd84NKf7U3 192.168.43.118 123 80.211.88.132 123 3 4 3 64.000000 0.000001 0.011765 0.001526 - - 185.19.184.35 - 1559245638.390748 1559246627.027459 1559246627.050401 1559246627.050438 - - 0 - - - - - - - - - - - - - - -#close 2019-06-06-14-36-13 +#close 2019-06-14-10-32-45 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout index 64f538e4b5..3ec1956dc8 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/.stdout @@ -32,4 +32,4 @@ ntp_message 192.168.43.118 -> 80.211.155.206:123 [version=4, mode=4, std_msg=[st ntp_message 192.168.43.118 -> 147.135.207.213:123 [version=4, mode=4, std_msg=[stratum=2, poll=64.0, precision=0.000008, root_delay=0.042236, root_disp=0.041595, kiss_code=, ref_id=, ref_addr=212.7.1.132, ref_v6_hash_prefix=, ref_time=1559245356.576177, org_time=1559246900.027439, rec_time=1559246900.103765, xmt_time=1559246900.103887, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=4, mode=3, std_msg=[stratum=0, poll=16.0, precision=0.015625, root_delay=1.0, root_disp=1.0, kiss_code=\x00\x00\x00\x00, ref_id=, ref_addr=, ref_v6_hash_prefix=, ref_time=0.0, org_time=0.0, rec_time=0.0, xmt_time=1101309131.444112, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=4, mode=4, std_msg=[stratum=1, poll=16.0, precision=0, root_delay=0.0, root_disp=0.000122, kiss_code=, ref_id=CTD\x00, ref_addr=, ref_v6_hash_prefix=, ref_time=1559246910.937978, org_time=1101309131.444112, rec_time=1559246940.281161, xmt_time=1559246940.281191, key_id=, digest=, num_exts=0], control_msg=, mode7_msg=] -ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=42, auth_bit=F, sequence=0, implementation=3, err=0, data=]] +ntp_message 192.168.43.118 -> 193.204.114.232:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[req_code=42, auth_bit=F, sequence=0, implementation=3, err=0, data=]] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log index b8e53bc43b..8e104dfe4c 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp2/ntp.log @@ -3,8 +3,8 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-06-14-36-21 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum ReqCode auth_bit sequence implementation err +#open 2019-06-14-10-32-47 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts op_code resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum req_code auth_bit sequence implementation err #types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count string count bool count count count 1559246885.027478 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 3 2 64.000000 0.000000 0.046280 0.028229 - - 85.199.214.99 - 1559246556.073681 1559246818.058351 1559246818.079217 1559246885.027449 - - 0 - - - - - - - - - - - - - - 1559246885.088815 CHhAvVGS1DHFjwGM9 192.168.43.118 123 80.211.52.109 123 4 4 4 64.000000 0.000000 0.048843 0.075409 - - 105.237.207.28 - 1559245852.721794 1559246885.027449 1559246885.069212 1559246885.069247 - - 0 - - - - - - - - - - - - - - @@ -41,4 +41,4 @@ 1559246940.262220 C7fIlMZDuRiqjpYbb 192.168.43.118 58229 193.204.114.232 123 4 3 0 16.000000 0.015625 1.000000 1.000000 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1101309131.444112 - - 0 - - - - - - - - - - - - - - 1559246940.304152 C7fIlMZDuRiqjpYbb 192.168.43.118 58229 193.204.114.232 123 4 4 1 16.000000 0.000000 0.000000 0.000122 - CTD\x00 - - 1559246910.937978 1101309131.444112 1559246940.281161 1559246940.281191 - - 0 - - - - - - - - - - - - - - 1559246940.486493 CykQaM33ztNt0csB9a 192.168.43.118 43046 193.204.114.232 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - - - 42 F - 3 0 -#close 2019-06-06-14-36-21 +#close 2019-06-14-10-32-47 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log index 38d0a32f16..0a96df548f 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntp3/ntp.log @@ -3,8 +3,8 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-06-14-36-29 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum ReqCode auth_bit sequence implementation err +#open 2019-06-14-10-32-49 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts op_code resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum req_code auth_bit sequence implementation err #types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count string count bool count count count 1096255084.954975 ClEkJM2Vm5giqnMf4h 192.168.50.50 123 67.129.68.9 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - 1096255084.955306 C4J4Th3PJpwUYZZ6gc 192.168.50.50 123 69.44.57.60 123 3 1 0 1024.000000 0.015625 0.000000 1.010010 \x00\x00\x00\x00 - - - 0.000000 0.000000 0.000000 1096255084.922896 - - 0 - - - - - - - - - - - - - - @@ -36,4 +36,4 @@ 1096255085.522297 CwjjYJ2WqgTbAqiHl6 192.168.50.50 123 64.112.189.11 123 3 2 2 1024.000000 0.000015 0.081268 0.029877 - - 128.10.252.6 - 1096254706.140290 1096255084.922896 1096255083.850451 1096255083.850465 - - 0 - - - - - - - - - - - - - - 1096255085.562197 CmES5u32sYpV7JYN 192.168.50.50 123 216.27.185.42 123 3 2 2 1024.000000 0.000004 0.029846 0.045456 - - 164.67.62.194 - 1096254209.896379 1096255084.922896 1096255083.849099 1096255083.849269 - - 0 - - - - - - - - - - - - - - 1096255085.599961 CUM0KZ3MLUfNB0cl11 192.168.50.50 123 209.132.176.4 123 3 2 1 1024.000000 0.000015 0.000000 0.000504 - CDMA - - 1096255068.944018 1096255084.922896 1096255083.827772 1096255083.828313 - - 0 - - - - - - - - - - - - - - -#close 2019-06-06-14-36-29 +#close 2019-06-14-10-32-49 diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout index 7fc7a9aede..371eb7dbb4 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/.stdout @@ -1,9 +1,9 @@ -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=1, resp_bit=F, err_bit=F, more_bit=F, sequence=1, status=0, association_id=0, data=0, key_id=0, crypto_checksum=], mode7_msg=] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=2, status=0, association_id=19183, data=0, key_id=0, crypto_checksum=], mode7_msg=] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=3, status=0, association_id=19184, data=0, key_id=0, crypto_checksum=], mode7_msg=] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=1, auth_bit=F, sequence=0, implementation=3, err=0, data=]] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=42, auth_bit=F, sequence=0, implementation=3, err=0, data=]] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=1, resp_bit=F, err_bit=F, more_bit=F, sequence=1, status=0, association_id=0, data=0, key_id=0, crypto_checksum=], mode7_msg=] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=2, status=0, association_id=19183, data=0, key_id=0, crypto_checksum=], mode7_msg=] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[OpCode=2, resp_bit=F, err_bit=F, more_bit=F, sequence=3, status=0, association_id=19184, data=0, key_id=0, crypto_checksum=], mode7_msg=] -ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[ReqCode=1, auth_bit=F, sequence=0, implementation=3, err=0, data=]] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[op_code=1, resp_bit=F, err_bit=F, more_bit=F, sequence=1, status=0, association_id=0, data=, key_id=, crypto_checksum=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[op_code=2, resp_bit=F, err_bit=F, more_bit=F, sequence=2, status=0, association_id=19183, data=, key_id=, crypto_checksum=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[op_code=2, resp_bit=F, err_bit=F, more_bit=F, sequence=3, status=0, association_id=19184, data=, key_id=, crypto_checksum=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[req_code=1, auth_bit=F, sequence=0, implementation=3, err=0, data=]] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[req_code=42, auth_bit=F, sequence=0, implementation=3, err=0, data=]] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[op_code=1, resp_bit=F, err_bit=F, more_bit=F, sequence=1, status=0, association_id=0, data=, key_id=, crypto_checksum=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[op_code=2, resp_bit=F, err_bit=F, more_bit=F, sequence=2, status=0, association_id=19183, data=, key_id=, crypto_checksum=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=6, std_msg=, control_msg=[op_code=2, resp_bit=F, err_bit=F, more_bit=F, sequence=3, status=0, association_id=19184, data=, key_id=, crypto_checksum=], mode7_msg=] +ntp_message 127.0.0.1 -> 127.0.0.1:123 [version=2, mode=7, std_msg=, control_msg=, mode7_msg=[req_code=1, auth_bit=F, sequence=0, implementation=3, err=0, data=]] diff --git a/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log index a441d8397b..3234df11d5 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log +++ b/testing/btest/Baseline/scripts.base.protocols.ntp.ntpmode67/ntp.log @@ -3,16 +3,16 @@ #empty_field (empty) #unset_field - #path ntp -#open 2019-06-06-14-36-41 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts OpCode resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum ReqCode auth_bit sequence implementation err +#open 2019-06-14-10-32-50 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp kiss_code ref_id ref_addr ref_v6_hash_prefix ref_time org_time rec_time xmt_time key_id digest num_exts op_code resp_bit err_bit more_bit sequence status association_id ctrl_key_id crypto_checksum req_code auth_bit sequence implementation err #types time string addr port addr port count count count interval interval interval interval string string addr string time time time time count string count count bool bool bool count count count count string count bool count count count -1558603188.282844 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 1 F F F 1 0 0 0 (empty) - - - - - -1558603188.283617 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 2 0 19183 0 (empty) - - - - - -1558603188.286063 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 3 0 19184 0 (empty) - - - - - +1558603188.282844 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 1 F F F 1 0 0 - - - - - - - +1558603188.283617 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 2 0 19183 - - - - - - - +1558603188.286063 CHhAvVGS1DHFjwGM9 127.0.0.1 40769 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 3 0 19184 - - - - - - - 1558603201.135003 ClEkJM2Vm5giqnMf4h 127.0.0.1 57531 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - - - 1 F - 3 0 1558603206.793297 C4J4Th3PJpwUYZZ6gc 127.0.0.1 46918 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - - - 42 F - 3 0 -1558603213.886044 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 1 F F F 1 0 0 0 (empty) - - - - - -1558603213.886779 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 2 0 19183 0 (empty) - - - - - -1558603213.889030 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 3 0 19184 0 (empty) - - - - - +1558603213.886044 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 1 F F F 1 0 0 - - - - - - - +1558603213.886779 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 2 0 19183 - - - - - - - +1558603213.889030 CtPZjS20MLrsMUOJi2 127.0.0.1 56506 127.0.0.1 123 2 6 - - - - - - - - - - - - - - - 0 2 F F F 3 0 19184 - - - - - - - 1558603219.996399 CUM0KZ3MLUfNB0cl11 127.0.0.1 55675 127.0.0.1 123 2 7 - - - - - - - - - - - - - - - 0 - - - - 0 - - - - 1 F - 3 0 -#close 2019-06-06-14-36-41 +#close 2019-06-14-10-32-50