Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'topic/ak/rdpeudp'

Browse source 
- Squashed the original commit set
- Cleaned up formatting
- Fixed register_for_ports() for right RDPEUDP analyzer

* topic/ak/rdpeudp:
  Add RDP over UDP analyzer
This commit is contained in:
Jon Siwek 2020-04-02 18:29:23 -07:00
commit e66148a13a
25 changed files with 585 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

25
testing/btest/scripts/base/protocols/rdp/rdpeudp-handshake-fail.zeek Normal file
View file

@ -0,0 +1,25 @@
# @TEST-EXEC: zeek -r $TRACES/rdp/rdpeudp-handshake-fail.pcap %INPUT >out
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff out
@load base/protocols/rdp
event rdpeudp_syn(c: connection)
{
print "rdpeudp_syn", c$id;
}
event rdpeudp_synack(c: connection)
{
print "rdpeudp_synack", c$id;
}
event rdpeudp_established(c: connection, version: count)
{
print "rdpeudp_established", c$id, version;
}
event rdpeudp_data(c: connection, is_orig: bool, version: count, data: string)
{
print fmt("rdpeudp_data is_orig: %s, version %d, data: %s", is_orig, version, data);
}

25
testing/btest/scripts/base/protocols/rdp/rdpeudp-handshake-success.zeek Normal file
View file

@ -0,0 +1,25 @@
# @TEST-EXEC: zeek -r $TRACES/rdp/rdpeudp-handshake-success.pcap %INPUT >out
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff out
@load base/protocols/rdp
event rdpeudp_syn(c: connection)
{
print "rdpeudp_syn", c$id;
}
event rdpeudp_synack(c: connection)
{
print "rdpeudp_synack", c$id;
}
event rdpeudp_established(c: connection, version: count)
{
print "rdpeudp_established", c$id, version;
}
event rdpeudp_data(c: connection, is_orig: bool, version: count, data: string)
{
print fmt("rdpeudp_data is_orig: %s, version %d, data: %s", is_orig, version, data);
}