mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
Migrate NCP analyzer to use latest analyzer API
It was possibly never updated for newer Analyzer API changes, as simply attaching the NCP analyzer to a connection would result in null pointer derefernces and also support analyzers were not attached.
This commit is contained in:
Jon Siwek
parent
de029dd430
commit
e35da5f592
5 changed files with 500 additions and 12 deletions
|
|
@ -159,11 +159,7 @@ Contents_NCP_Analyzer::Contents_NCP_Analyzer(Connection* conn, bool orig, NCP_Se
|
|||
{
|
||||
session = arg_session;
|
||||
resync = true;
|
||||
|
||||
tcp::TCP_Analyzer* tcp = static_cast<tcp::TCP_ApplicationAnalyzer*>(Parent())->TCP();
|
||||
if ( tcp )
|
||||
resync = (orig ? tcp->OrigState() : tcp->RespState()) !=
|
||||
tcp::TCP_ENDPOINT_ESTABLISHED;
|
||||
resync_set = false;
|
||||
}
|
||||
|
||||
Contents_NCP_Analyzer::~Contents_NCP_Analyzer()
|
||||
|
|
@ -174,20 +170,23 @@ void Contents_NCP_Analyzer::DeliverStream(int len, const u_char* data, bool orig
|
|||
{
|
||||
tcp::TCP_SupportAnalyzer::DeliverStream(len, data, orig);
|
||||
|
||||
tcp::TCP_Analyzer* tcp = static_cast<tcp::TCP_ApplicationAnalyzer*>(Parent())->TCP();
|
||||
auto tcp = static_cast<NCP_Analyzer*>(Parent())->TCP();
|
||||
|
||||
if ( ! resync_set )
|
||||
{
|
||||
resync_set = true;
|
||||
resync = (IsOrig() ? tcp->OrigState() : tcp->RespState()) !=
|
||||
tcp::TCP_ENDPOINT_ESTABLISHED;
|
||||
}
|
||||
|
||||
if ( tcp && tcp->HadGap(orig) )
|
||||
return;
|
||||
|
||||
DEBUG_MSG("NCP deliver: len = %d resync = %d buffer.empty = %d\n",
|
||||
len, resync, buffer.empty());
|
||||
|
||||
if ( buffer.empty() && resync )
|
||||
{
|
||||
// Assume NCP frames align with packet boundary.
|
||||
if ( (IsOrig() && len < 22) || (! IsOrig() && len < 16) )
|
||||
{ // ignore small fragmeents
|
||||
DEBUG_MSG("NCP discard small pieces: %d\n", len);
|
||||
return;
|
||||
}
|
||||
|
||||
|
|
@ -224,13 +223,13 @@ NCP_Analyzer::NCP_Analyzer(Connection* conn)
|
|||
{
|
||||
session = new NCP_Session(this);
|
||||
o_ncp = new Contents_NCP_Analyzer(conn, true, session);
|
||||
AddSupportAnalyzer(o_ncp);
|
||||
r_ncp = new Contents_NCP_Analyzer(conn, false, session);
|
||||
AddSupportAnalyzer(r_ncp);
|
||||
}
|
||||
|
||||
NCP_Analyzer::~NCP_Analyzer()
|
||||
{
|
||||
delete session;
|
||||
delete o_ncp;
|
||||
delete r_ncp;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -97,6 +97,7 @@ protected:
|
|||
|
||||
// Re-sync for partial connections (or after a content gap).
|
||||
bool resync;
|
||||
bool resync_set;
|
||||
};
|
||||
|
||||
class NCP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
|
||||
|
|
|
|||
468
testing/btest/Baseline/scripts.base.protocols.ncp.event/out
Normal file
468
testing/btest/Baseline/scripts.base.protocols.ncp.event/out
Normal file
|
|
@ -0,0 +1,468 @@
|
|||
ncp reply, 13107, 70, 0, 0, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 86, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 79, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 86, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 79, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 86, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 79, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 86, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 79, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 86, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 79, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 86, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 59, 89
|
||||
ncp reply, 13107, 2, 8738, 89, 255
|
||||
ncp request, 8738, 59, 89
|
||||
ncp reply, 13107, 2, 8738, 89, 255
|
||||
ncp request, 8738, 79, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 86, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 66, 89
|
||||
ncp reply, 13107, 92, 8738, 89, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 66, 89
|
||||
ncp reply, 13107, 92, 8738, 89, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 46, 89
|
||||
ncp reply, 13107, 88, 8738, 89, 0
|
||||
ncp request, 8738, 40, 89
|
||||
ncp reply, 13107, 11, 8738, 89, 0
|
||||
ncp request, 8738, 40, 89
|
||||
ncp reply, 13107, 102, 8738, 89, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 6, 22338
|
||||
ncp reply, 13107, 10, 8738, 22338, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 8, 66
|
||||
ncp reply, 13107, 2, 8738, 66, 0
|
||||
ncp request, 8738, 72, 89
|
||||
ncp reply, 13107, 70, 8738, 89, 0
|
||||
ncp request, 8738, 7, 22306
|
||||
ncp reply, 13107, 2, 8738, 22306, 0
|
||||
ncp request, 8738, 14, 72
|
||||
ncp reply, 13107, 163, 8738, 72, 0
|
||||
ncp request, 8738, 14, 72
|
||||
BIN
testing/btest/Traces/ncp.pcap
Normal file
BIN
testing/btest/Traces/ncp.pcap
Normal file
Binary file not shown.
20
testing/btest/scripts/base/protocols/ncp/event.bro
Normal file
20
testing/btest/scripts/base/protocols/ncp/event.bro
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
# @TEST-EXEC: bro -C -r $TRACES/ncp.pcap %INPUT >out
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
redef likely_server_ports += { 524/tcp };
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
const ports = { 524/tcp };
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_NCP, ports);
|
||||
}
|
||||
|
||||
event ncp_request(c: connection, frame_type: count, length: count, func: count)
|
||||
{
|
||||
print "ncp request", frame_type, length, func;
|
||||
}
|
||||
|
||||
event ncp_reply(c: connection, frame_type: count, length: count, req_frame: count, req_func: count, completion_code: count)
|
||||
{
|
||||
print "ncp reply", frame_type, length, req_frame, req_func, completion_code;
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue