Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add new features from other branch to the heartbleed-detector (and clean them up).

Browse source 
We should now quite reliably detect scans/attacks, even when encrypted and not succesful.
This commit is contained in:
Bernhard Amann 2014-05-14 15:42:27 -07:00
parent 9014629a7d
commit f0b244b8b0
9 changed files with 179 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

10
testing/btest/scripts/policy/protocols/ssl/heartbleed.bro
View file

@ -6,8 +6,16 @@
# @TEST-EXEC: mv notice.log notice-heartbleed-success.log
# @TEST-EXEC: btest-diff notice-heartbleed-success.log
# @TEST-EXEC: bro -C -r $TRACES/tls/heartbleed-encrypted-success.pcap %INPUT
# @TEST-EXEC: bro -C -r $TRACES/tls/heartbleed-encrypted.pcap %INPUT
# @TEST-EXEC: mv notice.log notice-encrypted.log
# @TEST-EXEC: btest-diff notice-encrypted.log
# @TEST-EXEC: bro -C -r $TRACES/tls/heartbleed-encrypted-success.pcap %INPUT
# @TEST-EXEC: mv notice.log notice-encrypted-success.log
# @TEST-EXEC: btest-diff notice-encrypted-success.log
# @TEST-EXEC: bro -C -r $TRACES/tls/heartbleed-encrypted-short.pcap %INPUT
# @TEST-EXEC: mv notice.log notice-encrypted-short.log
# @TEST-EXEC: btest-diff notice-encrypted-short.log
@load protocols/ssl/heartbleed