mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 17:18:20 +00:00
Write NetControl framework documentation.
In the process, some of the script documentation of the NetControl framework was also updated.
This commit is contained in:
Johanna Amann
parent
3b55a917ac
commit
f1267b0b94
78 changed files with 1918 additions and 142 deletions
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2016-06-07-19-22-42
|
||||
#open 2016-06-22-22-50-49
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
|
|
@ -155,14 +155,38 @@ scripts/base/init-default.bro
|
|||
scripts/base/frameworks/notice/main.bro
|
||||
scripts/base/frameworks/notice/weird.bro
|
||||
scripts/base/frameworks/notice/actions/drop.bro
|
||||
scripts/base/frameworks/netcontrol/__load__.bro
|
||||
scripts/base/frameworks/netcontrol/types.bro
|
||||
scripts/base/frameworks/netcontrol/main.bro
|
||||
scripts/base/frameworks/netcontrol/plugin.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/__load__.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/debug.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/openflow.bro
|
||||
scripts/base/frameworks/openflow/__load__.bro
|
||||
scripts/base/frameworks/openflow/consts.bro
|
||||
scripts/base/frameworks/openflow/types.bro
|
||||
scripts/base/frameworks/openflow/main.bro
|
||||
scripts/base/frameworks/openflow/plugins/__load__.bro
|
||||
scripts/base/frameworks/openflow/plugins/ryu.bro
|
||||
scripts/base/utils/json.bro
|
||||
scripts/base/frameworks/openflow/plugins/log.bro
|
||||
scripts/base/frameworks/openflow/plugins/broker.bro
|
||||
scripts/base/frameworks/cluster/__load__.bro
|
||||
scripts/base/frameworks/cluster/main.bro
|
||||
scripts/base/frameworks/control/__load__.bro
|
||||
scripts/base/frameworks/control/main.bro
|
||||
scripts/base/frameworks/openflow/non-cluster.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/packetfilter.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/broker.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/acld.bro
|
||||
scripts/base/frameworks/netcontrol/drop.bro
|
||||
scripts/base/frameworks/netcontrol/shunt.bro
|
||||
scripts/base/frameworks/netcontrol/catch-and-release.bro
|
||||
scripts/base/frameworks/netcontrol/non-cluster.bro
|
||||
scripts/base/frameworks/notice/actions/email_admin.bro
|
||||
scripts/base/frameworks/notice/actions/page.bro
|
||||
scripts/base/frameworks/notice/actions/add-geodata.bro
|
||||
scripts/base/frameworks/notice/extend-email/hostnames.bro
|
||||
scripts/base/frameworks/cluster/__load__.bro
|
||||
scripts/base/frameworks/cluster/main.bro
|
||||
scripts/base/frameworks/control/__load__.bro
|
||||
scripts/base/frameworks/control/main.bro
|
||||
scripts/base/frameworks/notice/non-cluster.bro
|
||||
scripts/base/frameworks/notice/actions/pp-alarms.bro
|
||||
scripts/base/frameworks/dpd/__load__.bro
|
||||
|
|
@ -196,30 +220,6 @@ scripts/base/init-default.bro
|
|||
scripts/base/frameworks/sumstats/non-cluster.bro
|
||||
scripts/base/frameworks/tunnels/__load__.bro
|
||||
scripts/base/frameworks/tunnels/main.bro
|
||||
scripts/base/frameworks/openflow/__load__.bro
|
||||
scripts/base/frameworks/openflow/consts.bro
|
||||
scripts/base/frameworks/openflow/types.bro
|
||||
scripts/base/frameworks/openflow/main.bro
|
||||
scripts/base/frameworks/openflow/plugins/__load__.bro
|
||||
scripts/base/frameworks/openflow/plugins/ryu.bro
|
||||
scripts/base/utils/json.bro
|
||||
scripts/base/frameworks/openflow/plugins/log.bro
|
||||
scripts/base/frameworks/openflow/plugins/broker.bro
|
||||
scripts/base/frameworks/openflow/non-cluster.bro
|
||||
scripts/base/frameworks/netcontrol/__load__.bro
|
||||
scripts/base/frameworks/netcontrol/types.bro
|
||||
scripts/base/frameworks/netcontrol/main.bro
|
||||
scripts/base/frameworks/netcontrol/plugin.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/__load__.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/debug.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/openflow.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/packetfilter.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/broker.bro
|
||||
scripts/base/frameworks/netcontrol/plugins/acld.bro
|
||||
scripts/base/frameworks/netcontrol/drop.bro
|
||||
scripts/base/frameworks/netcontrol/shunt.bro
|
||||
scripts/base/frameworks/netcontrol/catch-and-release.bro
|
||||
scripts/base/frameworks/netcontrol/non-cluster.bro
|
||||
scripts/base/protocols/conn/__load__.bro
|
||||
scripts/base/protocols/conn/main.bro
|
||||
scripts/base/protocols/conn/contents.bro
|
||||
|
|
@ -311,4 +311,4 @@ scripts/base/init-default.bro
|
|||
scripts/base/misc/find-checksum-offloading.bro
|
||||
scripts/base/misc/find-filtered-trace.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
#close 2016-06-07-19-22-42
|
||||
#close 2016-06-22-22-50-50
|
||||
|
|
|
|||
|
|
@ -23,6 +23,7 @@ modbus
|
|||
modbus_register_change
|
||||
mysql
|
||||
net_control
|
||||
netcontrol_catch_release
|
||||
netcontrol_drop
|
||||
netcontrol_shunt
|
||||
notice
|
||||
|
|
|
|||
|
|
@ -0,0 +1,14 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-1-drop-with-debug.bro
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
NetControl::drop_connection(c$id, 20 secs);
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-10-use-skeleton.bro
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local skeleton_plugin = NetControl::create_skeleton("");
|
||||
NetControl::activate(skeleton_plugin, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
NetControl::drop_connection(c$id, 20 secs);
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-2-ssh-guesser.bro
|
||||
|
||||
|
||||
@load protocols/ssh/detect-bruteforcing
|
||||
|
||||
redef SSH::password_guesses_limit=10;
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
hook Notice::policy(n: Notice::Info)
|
||||
{
|
||||
if ( n$note == SSH::Password_Guessing )
|
||||
NetControl::drop_address(n$src, 60min);
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-3-ssh-guesser.bro
|
||||
|
||||
|
||||
@load protocols/ssh/detect-bruteforcing
|
||||
|
||||
redef SSH::password_guesses_limit=10;
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
hook Notice::policy(n: Notice::Info)
|
||||
{
|
||||
if ( n$note == SSH::Password_Guessing )
|
||||
add n$actions[Notice::ACTION_DROP];
|
||||
}
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-4-drop.bro
|
||||
|
||||
function our_drop_connection(c: conn_id, t: interval)
|
||||
{
|
||||
# As a first step, create the NetControl::Entity that we want to block
|
||||
local e = NetControl::Entity($ty=NetControl::CONNECTION, $conn=c);
|
||||
# Then, use the entity to create the rule to drop the entity in the forward path
|
||||
local r = NetControl::Rule($ty=NetControl::DROP,
|
||||
$target=NetControl::FORWARD, $entity=e, $expire=t);
|
||||
|
||||
# Add the rule
|
||||
local id = NetControl::add_rule(r);
|
||||
|
||||
if ( id == "" )
|
||||
print "Error while dropping";
|
||||
}
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
our_drop_connection(c$id, 20 secs);
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-5-hook.bro
|
||||
|
||||
hook NetControl::rule_policy(r: NetControl::Rule)
|
||||
{
|
||||
if ( r$ty == NetControl::DROP &&
|
||||
r$entity$ty == NetControl::CONNECTION &&
|
||||
r$entity$conn$orig_h in 192.168.0.0/16 )
|
||||
{
|
||||
print "Ignored connection from", r$entity$conn$orig_h;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
NetControl::drop_connection(c$id, 20 secs);
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-6-find.bro
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local netcontrol_debug = NetControl::create_debug(T);
|
||||
NetControl::activate(netcontrol_debug, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
if ( |NetControl::find_rules_addr(c$id$orig_h)| > 0 )
|
||||
{
|
||||
print "Rule already exists";
|
||||
return;
|
||||
}
|
||||
|
||||
NetControl::drop_connection(c$id, 20 secs);
|
||||
print "Rule added";
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-7-catch-release.bro
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
NetControl::drop_address_catch_release(c$id$orig_h);
|
||||
}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-8-multiple.bro
|
||||
|
||||
function our_openflow_check(p: NetControl::PluginState, r: NetControl::Rule): bool
|
||||
{
|
||||
if ( r$ty == NetControl::DROP &&
|
||||
r$entity$ty == NetControl::ADDRESS &&
|
||||
subnet_width(r$entity$ip) == 32 &&
|
||||
subnet_to_addr(r$entity$ip) in 192.168.17.0/24 )
|
||||
return F;
|
||||
|
||||
return T;
|
||||
}
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
# Add debug plugin with low priority
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
|
||||
# Instantiate OpenFlow debug plugin with higher priority
|
||||
local of_controller = OpenFlow::log_new(42);
|
||||
local netcontrol_of = NetControl::create_openflow(of_controller, [$check_pred=our_openflow_check]);
|
||||
NetControl::activate(netcontrol_of, 10);
|
||||
}
|
||||
|
||||
event NetControl::init_done()
|
||||
{
|
||||
NetControl::drop_address(10.0.0.1, 1min);
|
||||
NetControl::drop_address(192.168.17.2, 1min);
|
||||
NetControl::drop_address(192.168.18.2, 1min);
|
||||
}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-9-skeleton.bro
|
||||
|
||||
module NetControl;
|
||||
|
||||
export {
|
||||
## Instantiates the plugin.
|
||||
global create_skeleton: function(argument: string) : PluginState;
|
||||
}
|
||||
|
||||
function skeleton_name(p: PluginState) : string
|
||||
{
|
||||
return "NetControl skeleton plugin";
|
||||
}
|
||||
|
||||
function skeleton_add_rule_fun(p: PluginState, r: Rule) : bool
|
||||
{
|
||||
print "add", r;
|
||||
event NetControl::rule_added(r, p);
|
||||
return T;
|
||||
}
|
||||
|
||||
function skeleton_remove_rule_fun(p: PluginState, r: Rule) : bool
|
||||
{
|
||||
print "remove", r;
|
||||
event NetControl::rule_removed(r, p);
|
||||
return T;
|
||||
}
|
||||
|
||||
global skeleton_plugin = Plugin(
|
||||
$name = skeleton_name,
|
||||
$can_expire = F,
|
||||
$add_rule = skeleton_add_rule_fun,
|
||||
$remove_rule = skeleton_remove_rule_fun
|
||||
);
|
||||
|
||||
function create_skeleton(argument: string) : PluginState
|
||||
{
|
||||
local p = PluginState($plugin=skeleton_plugin);
|
||||
|
||||
return p;
|
||||
}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# bro -C -r tls/ecdhe.pcap netcontrol-1-drop-with-debug.bro
|
||||
netcontrol debug (Debug-All): init
|
||||
netcontrol debug (Debug-All): add_rule: [ty=NetControl::DROP, target=NetControl::FORWARD, entity=[ty=NetControl::CONNECTION, conn=[orig_h=192.168.18.50, orig_p=56981/tcp, resp_h=74.125.239.97, resp_p=443/tcp], flow=<uninitialized>, ip=<uninitialized>, mac=<uninitialized>], expire=20.0 secs, priority=0, location=, out_port=<uninitialized>, mod=<uninitialized>, id=2, cid=2, _plugin_ids={\x0a\x0a}, _active_plugin_ids={\x0a\x0a}, _no_expire_plugins={\x0a\x0a}, _added=F]
|
||||
|
||||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# cat netcontrol.log
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path netcontrol
|
||||
#open 2016-06-22-22-58-31
|
||||
#fields ts rule_id category cmd state action target entity_type entity mod msg priority expire location plugin
|
||||
#types time string enum string enum string enum string string string string int interval string string
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - activating plugin with priority 0 - - - Debug-All
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - activation finished - - - Debug-All
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - plugin initialization done - - - -
|
||||
1398529018.678276 2 NetControl::RULE ADD NetControl::REQUESTED NetControl::DROP NetControl::FORWARD NetControl::CONNECTION 192.168.18.50/56981<->74.125.239.97/443 - - 0 20.000000 - Debug-All
|
||||
1398529018.678276 2 NetControl::RULE ADD NetControl::SUCCEEDED NetControl::DROP NetControl::FORWARD NetControl::CONNECTION 192.168.18.50/56981<->74.125.239.97/443 - - 0 20.000000 - Debug-All
|
||||
#close 2016-06-22-22-58-31
|
||||
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# cat netcontrol_drop.log
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path netcontrol_drop
|
||||
#open 2016-06-22-22-58-31
|
||||
#fields ts rule_id orig_h orig_p resp_h resp_p expire location
|
||||
#types time string addr port addr port interval string
|
||||
1398529018.678276 2 192.168.18.50 56981 74.125.239.97 443 20.000000 -
|
||||
#close 2016-06-22-22-58-31
|
||||
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# bro -C -r ssh/sshguess.pcap netcontrol-2-ssh-guesser.bro
|
||||
netcontrol debug (Debug-All): init
|
||||
netcontrol debug (Debug-All): add_rule: [ty=NetControl::DROP, target=NetControl::FORWARD, entity=[ty=NetControl::ADDRESS, conn=<uninitialized>, flow=<uninitialized>, ip=192.168.56.1/32, mac=<uninitialized>], expire=1.0 hr, priority=0, location=, out_port=<uninitialized>, mod=<uninitialized>, id=2, cid=2, _plugin_ids={\x0a\x0a}, _active_plugin_ids={\x0a\x0a}, _no_expire_plugins={\x0a\x0a}, _added=F]
|
||||
|
||||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# cat netcontrol.log
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path netcontrol
|
||||
#open 2016-06-22-22-58-36
|
||||
#fields ts rule_id category cmd state action target entity_type entity mod msg priority expire location plugin
|
||||
#types time string enum string enum string enum string string string string int interval string string
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - activating plugin with priority 0 - - - Debug-All
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - activation finished - - - Debug-All
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - plugin initialization done - - - -
|
||||
1427726711.398575 2 NetControl::RULE ADD NetControl::REQUESTED NetControl::DROP NetControl::FORWARD NetControl::ADDRESS 192.168.56.1/32 - - 0 3600.000000 - Debug-All
|
||||
1427726711.398575 2 NetControl::RULE ADD NetControl::SUCCEEDED NetControl::DROP NetControl::FORWARD NetControl::ADDRESS 192.168.56.1/32 - - 0 3600.000000 - Debug-All
|
||||
#close 2016-06-22-22-58-36
|
||||
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# bro -C -r ssh/sshguess.pcap netcontrol-3-ssh-guesser.bro
|
||||
netcontrol debug (Debug-All): init
|
||||
netcontrol debug (Debug-All): add_rule: [ty=NetControl::DROP, target=NetControl::FORWARD, entity=[ty=NetControl::ADDRESS, conn=<uninitialized>, flow=<uninitialized>, ip=192.168.56.1/32, mac=<uninitialized>], expire=10.0 mins, priority=0, location=ACTION_DROP: T, out_port=<uninitialized>, mod=<uninitialized>, id=2, cid=2, _plugin_ids={\x0a\x0a}, _active_plugin_ids={\x0a\x0a}, _no_expire_plugins={\x0a\x0a}, _added=F]
|
||||
|
||||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# cat netcontrol.log
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path netcontrol
|
||||
#open 2016-06-22-22-58-38
|
||||
#fields ts rule_id category cmd state action target entity_type entity mod msg priority expire location plugin
|
||||
#types time string enum string enum string enum string string string string int interval string string
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - activating plugin with priority 0 - - - Debug-All
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - activation finished - - - Debug-All
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - plugin initialization done - - - -
|
||||
1427726711.398575 2 NetControl::RULE ADD NetControl::REQUESTED NetControl::DROP NetControl::FORWARD NetControl::ADDRESS 192.168.56.1/32 - - 0 600.000000 ACTION_DROP: T Debug-All
|
||||
1427726711.398575 2 NetControl::RULE ADD NetControl::SUCCEEDED NetControl::DROP NetControl::FORWARD NetControl::ADDRESS 192.168.56.1/32 - - 0 600.000000 ACTION_DROP: T Debug-All
|
||||
#close 2016-06-22-22-58-38
|
||||
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# cat notice.log
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path notice
|
||||
#open 2016-06-22-22-58-38
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
|
||||
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] interval bool string string string double double
|
||||
1427726711.398575 - - - - - - - - - SSH::Password_Guessing 192.168.56.1 appears to be guessing SSH passwords (seen in 10 connections). Sampled servers: 192.168.56.103, 192.168.56.103, 192.168.56.103, 192.168.56.103, 192.168.56.103 192.168.56.1 - - - bro Notice::ACTION_DROP,Notice::ACTION_LOG 3600.000000 T - - - - -
|
||||
#close 2016-06-22-22-58-38
|
||||
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# bro -C -r tls/ecdhe.pcap netcontrol-4-drop.bro
|
||||
netcontrol debug (Debug-All): init
|
||||
netcontrol debug (Debug-All): add_rule: [ty=NetControl::DROP, target=NetControl::FORWARD, entity=[ty=NetControl::CONNECTION, conn=[orig_h=192.168.18.50, orig_p=56981/tcp, resp_h=74.125.239.97, resp_p=443/tcp], flow=<uninitialized>, ip=<uninitialized>, mac=<uninitialized>], expire=20.0 secs, priority=0, location=<uninitialized>, out_port=<uninitialized>, mod=<uninitialized>, id=2, cid=2, _plugin_ids={\x0a\x0a}, _active_plugin_ids={\x0a\x0a}, _no_expire_plugins={\x0a\x0a}, _added=F]
|
||||
|
||||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# cat netcontrol.log
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path netcontrol
|
||||
#open 2016-06-22-22-58-42
|
||||
#fields ts rule_id category cmd state action target entity_type entity mod msg priority expire location plugin
|
||||
#types time string enum string enum string enum string string string string int interval string string
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - activating plugin with priority 0 - - - Debug-All
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - activation finished - - - Debug-All
|
||||
0.000000 - NetControl::MESSAGE - - - - - - - plugin initialization done - - - -
|
||||
1398529018.678276 2 NetControl::RULE ADD NetControl::REQUESTED NetControl::DROP NetControl::FORWARD NetControl::CONNECTION 192.168.18.50/56981<->74.125.239.97/443 - - 0 20.000000 - Debug-All
|
||||
1398529018.678276 2 NetControl::RULE ADD NetControl::SUCCEEDED NetControl::DROP NetControl::FORWARD NetControl::CONNECTION 192.168.18.50/56981<->74.125.239.97/443 - - 0 20.000000 - Debug-All
|
||||
#close 2016-06-22-22-58-42
|
||||
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# bro -C -r tls/ecdhe.pcap netcontrol-5-hook.bro
|
||||
netcontrol debug (Debug-All): init
|
||||
Ignored connection from, 192.168.18.50
|
||||
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# bro -C -r tls/google-duplicate.trace netcontrol-6-find.bro
|
||||
netcontrol debug (Debug-All): init
|
||||
netcontrol debug (Debug-All): add_rule: [ty=NetControl::DROP, target=NetControl::FORWARD, entity=[ty=NetControl::CONNECTION, conn=[orig_h=192.168.4.149, orig_p=60623/tcp, resp_h=74.125.239.129, resp_p=443/tcp], flow=<uninitialized>, ip=<uninitialized>, mac=<uninitialized>], expire=20.0 secs, priority=0, location=, out_port=<uninitialized>, mod=<uninitialized>, id=2, cid=2, _plugin_ids={\x0a\x0a}, _active_plugin_ids={\x0a\x0a}, _no_expire_plugins={\x0a\x0a}, _added=F]
|
||||
Rule added
|
||||
Rule already exists
|
||||
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# bro -C -r tls/ecdhe.pcap netcontrol-7-catch-release.bro
|
||||
netcontrol debug (Debug-All): init
|
||||
netcontrol debug (Debug-All): add_rule: [ty=NetControl::DROP, target=NetControl::FORWARD, entity=[ty=NetControl::ADDRESS, conn=<uninitialized>, flow=<uninitialized>, ip=192.168.18.50/32, mac=<uninitialized>], expire=10.0 mins, priority=0, location=, out_port=<uninitialized>, mod=<uninitialized>, id=2, cid=2, _plugin_ids={\x0a\x0a}, _active_plugin_ids={\x0a\x0a}, _no_expire_plugins={\x0a\x0a}, _added=F]
|
||||
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# cat netcontrol_catch_release.log
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path netcontrol_catch_release
|
||||
#open 2016-06-22-22-58-49
|
||||
#fields ts rule_id ip action block_interval watch_interval blocked_until watched_until num_blocked location message
|
||||
#types time string addr enum interval interval time time count string string
|
||||
1398529018.678276 2 192.168.18.50 NetControl::DROP 600.000000 3600.000000 1398529618.678276 1398532618.678276 1 - -
|
||||
1398529018.678276 2 192.168.18.50 NetControl::DROPPED 600.000000 3600.000000 1398529618.678276 1398532618.678276 1 - -
|
||||
#close 2016-06-22-22-58-49
|
||||
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# bro netcontrol-8-multiple.bro
|
||||
netcontrol debug (Debug-All): init
|
||||
netcontrol debug (Debug-All): add_rule: [ty=NetControl::DROP, target=NetControl::FORWARD, entity=[ty=NetControl::ADDRESS, conn=<uninitialized>, flow=<uninitialized>, ip=192.168.17.2/32, mac=<uninitialized>], expire=1.0 min, priority=0, location=, out_port=<uninitialized>, mod=<uninitialized>, id=3, cid=3, _plugin_ids={\x0a\x0a}, _active_plugin_ids={\x0a\x0a}, _no_expire_plugins={\x0a\x0a}, _added=F]
|
||||
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# cat netcontrol.log
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path netcontrol
|
||||
#open 2016-06-22-22-58-52
|
||||
#fields ts rule_id category cmd state action target entity_type entity mod msg priority expire location plugin
|
||||
#types time string enum string enum string enum string string string string int interval string string
|
||||
1466636332.844326 - NetControl::MESSAGE - - - - - - - activating plugin with priority 0 - - - Debug-All
|
||||
1466636332.844326 - NetControl::MESSAGE - - - - - - - activation finished - - - Debug-All
|
||||
1466636332.844326 - NetControl::MESSAGE - - - - - - - activating plugin with priority 10 - - - Openflow-Log-42
|
||||
1466636332.844326 - NetControl::MESSAGE - - - - - - - activation finished - - - Openflow-Log-42
|
||||
1466636332.844326 - NetControl::MESSAGE - - - - - - - plugin initialization done - - - -
|
||||
1466636332.844326 2 NetControl::RULE ADD NetControl::REQUESTED NetControl::DROP NetControl::FORWARD NetControl::ADDRESS 10.0.0.1/32 - - 0 60.000000 - Openflow-Log-42
|
||||
1466636332.844326 3 NetControl::RULE ADD NetControl::REQUESTED NetControl::DROP NetControl::FORWARD NetControl::ADDRESS 192.168.17.2/32 - - 0 60.000000 - Debug-All
|
||||
1466636332.844326 4 NetControl::RULE ADD NetControl::REQUESTED NetControl::DROP NetControl::FORWARD NetControl::ADDRESS 192.168.18.2/32 - - 0 60.000000 - Openflow-Log-42
|
||||
1466636332.844326 3 NetControl::RULE ADD NetControl::SUCCEEDED NetControl::DROP NetControl::FORWARD NetControl::ADDRESS 192.168.17.2/32 - - 0 60.000000 - Debug-All
|
||||
1466636332.844326 2 NetControl::RULE ADD NetControl::SUCCEEDED NetControl::DROP NetControl::FORWARD NetControl::ADDRESS 10.0.0.1/32 - - 0 60.000000 - Openflow-Log-42
|
||||
1466636332.844326 4 NetControl::RULE ADD NetControl::SUCCEEDED NetControl::DROP NetControl::FORWARD NetControl::ADDRESS 192.168.18.2/32 - - 0 60.000000 - Openflow-Log-42
|
||||
#close 2016-06-22-22-58-52
|
||||
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# cat openflow.log
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path openflow
|
||||
#open 2016-06-22-22-58-52
|
||||
#fields ts dpid match.in_port match.dl_src match.dl_dst match.dl_vlan match.dl_vlan_pcp match.dl_type match.nw_tos match.nw_proto match.nw_src match.nw_dst match.tp_src match.tp_dst flow_mod.cookie flow_mod.table_id flow_mod.command flow_mod.idle_timeout flow_mod.hard_timeout flow_mod.priority flow_mod.out_port flow_mod.out_group flow_mod.flags flow_mod.actions.out_ports flow_mod.actions.vlan_vid flow_mod.actions.vlan_pcp flow_mod.actions.vlan_strip flow_mod.actions.dl_src flow_mod.actions.dl_dst flow_mod.actions.nw_tos flow_mod.actions.nw_src flow_mod.actions.nw_dst flow_mod.actions.tp_src flow_mod.actions.tp_dst
|
||||
#types time count count string string count count count count count subnet subnet count count count count enum count count count count count count vector[count] count count bool string string count addr addr count count
|
||||
1466636332.844326 42 - - - - - 2048 - - 10.0.0.1/32 - - - 4398046511108 - OpenFlow::OFPFC_ADD 0 60 0 - - 1 (empty) - - F - - - - - - -
|
||||
1466636332.844326 42 - - - - - 2048 - - - 10.0.0.1/32 - - 4398046511109 - OpenFlow::OFPFC_ADD 0 60 0 - - 1 (empty) - - F - - - - - - -
|
||||
1466636332.844326 42 - - - - - 2048 - - 192.168.18.2/32 - - - 4398046511112 - OpenFlow::OFPFC_ADD 0 60 0 - - 1 (empty) - - F - - - - - - -
|
||||
1466636332.844326 42 - - - - - 2048 - - - 192.168.18.2/32 - - 4398046511113 - OpenFlow::OFPFC_ADD 0 60 0 - - 1 (empty) - - F - - - - - - -
|
||||
#close 2016-06-22-22-58-52
|
||||
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# bro -C -r tls/ecdhe.pcap netcontrol-10-use-skeleton.bro
|
||||
add, [ty=NetControl::DROP, target=NetControl::FORWARD, entity=[ty=NetControl::CONNECTION, conn=[orig_h=192.168.18.50, orig_p=56981/tcp, resp_h=74.125.239.97, resp_p=443/tcp], flow=<uninitialized>, ip=<uninitialized>, mac=<uninitialized>], expire=20.0 secs, priority=0, location=, out_port=<uninitialized>, mod=<uninitialized>, id=2, cid=2, _plugin_ids={
|
||||
|
||||
}, _active_plugin_ids={
|
||||
|
||||
}, _no_expire_plugins={
|
||||
|
||||
}, _added=F]
|
||||
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
.. rst-class:: btest-cmd
|
||||
|
||||
.. code-block:: none
|
||||
:linenos:
|
||||
:emphasize-lines: 1,1
|
||||
|
||||
# bro -C -r tls/ecdhe.pcap netcontrol-10-use-skeleton.bro
|
||||
add, [ty=NetControl::DROP, target=NetControl::FORWARD, entity=[ty=NetControl::CONNECTION, conn=[orig_h=192.168.18.50, orig_p=56981/tcp, resp_h=74.125.239.97, resp_p=443/tcp], flow=<uninitialized>, ip=<uninitialized>, mac=<uninitialized>], expire=20.0 secs, priority=0, location=, out_port=<uninitialized>, mod=<uninitialized>, id=2, cid=2, _plugin_ids={
|
||||
|
||||
}, _active_plugin_ids={
|
||||
|
||||
}, _no_expire_plugins={
|
||||
|
||||
}, _added=F]
|
||||
|
||||
|
|
@ -172,6 +172,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::__add_filter, <frame>, (Intel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=intel, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__add_filter, <frame>, (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=kerberos, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__add_filter, <frame>, (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=modbus, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__add_filter, <frame>, (NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol_catch_release, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__add_filter, <frame>, (NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol_drop, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__add_filter, <frame>, (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__add_filter, <frame>, (NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol_shunt, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
|
|
@ -212,6 +213,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Intel::LOG, [columns=<no value description>, ev=Intel::log_intel, path=intel])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (KRB::LOG, [columns=<no value description>, ev=KRB::log_krb, path=kerberos])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Modbus::LOG, [columns=<no value description>, ev=Modbus::log_modbus, path=modbus])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (NetControl::CATCH_RELEASE, [columns=<no value description>, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (NetControl::DROP, [columns=<no value description>, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (NetControl::LOG, [columns=<no value description>, ev=NetControl::log_netcontrol, path=netcontrol])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (NetControl::SHUNT, [columns=<no value description>, ev=NetControl::log_netcontrol_shunt, path=netcontrol_shunt])) -> <no result>
|
||||
|
|
@ -238,7 +240,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1466281781.049315, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1466636352.007236, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Communication::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Conn::LOG)) -> <no result>
|
||||
|
|
@ -253,6 +255,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Intel::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (KRB::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Modbus::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (NetControl::CATCH_RELEASE)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (NetControl::DROP)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (NetControl::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (NetControl::SHUNT)) -> <no result>
|
||||
|
|
@ -293,6 +296,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::add_filter, <frame>, (Intel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_filter, <frame>, (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_filter, <frame>, (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_filter, <frame>, (NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_filter, <frame>, (NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_filter, <frame>, (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_filter, <frame>, (NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])) -> <no result>
|
||||
|
|
@ -333,6 +337,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (Intel::LOG, [columns=<no value description>, ev=Intel::log_intel, path=intel])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (KRB::LOG, [columns=<no value description>, ev=KRB::log_krb, path=kerberos])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (Modbus::LOG, [columns=<no value description>, ev=Modbus::log_modbus, path=modbus])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (NetControl::CATCH_RELEASE, [columns=<no value description>, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (NetControl::DROP, [columns=<no value description>, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (NetControl::LOG, [columns=<no value description>, ev=NetControl::log_netcontrol, path=netcontrol])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (NetControl::SHUNT, [columns=<no value description>, ev=NetControl::log_netcontrol_shunt, path=netcontrol_shunt])) -> <no result>
|
||||
|
|
@ -359,7 +364,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1466281781.049315, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1466636352.007236, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(NetControl::check_plugins, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(NetControl::init, <null>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Notice::want_pp, <frame>, ()) -> <no result>
|
||||
|
|
@ -392,7 +397,7 @@
|
|||
0.000000 MetaHookPost CallFunction(reading_live_traffic, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(reading_traces, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(set_to_regex, <frame>, ({}, (^\.?|\.)(~~)$)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(strftime, <frame>, (%Y, 1466281781.048782)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(strftime, <frame>, (%Y, 1466636352.006823)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(string_to_pattern, <frame>, ((^\.?|\.)()$, F)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(sub, <frame>, ((^\.?|\.)(~~)$, <...>/, )) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(to_count, <frame>, (2016)) -> <no result>
|
||||
|
|
@ -834,6 +839,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::__add_filter, <frame>, (Intel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=intel, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__add_filter, <frame>, (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=kerberos, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__add_filter, <frame>, (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=modbus, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__add_filter, <frame>, (NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol_catch_release, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__add_filter, <frame>, (NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol_drop, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__add_filter, <frame>, (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__add_filter, <frame>, (NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol_shunt, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
|
|
@ -874,6 +880,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Intel::LOG, [columns=<no value description>, ev=Intel::log_intel, path=intel]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (KRB::LOG, [columns=<no value description>, ev=KRB::log_krb, path=kerberos]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Modbus::LOG, [columns=<no value description>, ev=Modbus::log_modbus, path=modbus]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (NetControl::CATCH_RELEASE, [columns=<no value description>, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (NetControl::DROP, [columns=<no value description>, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (NetControl::LOG, [columns=<no value description>, ev=NetControl::log_netcontrol, path=netcontrol]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (NetControl::SHUNT, [columns=<no value description>, ev=NetControl::log_netcontrol_shunt, path=netcontrol_shunt]))
|
||||
|
|
@ -900,7 +907,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1466281781.049315, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1466636352.007236, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Communication::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Conn::LOG))
|
||||
|
|
@ -915,6 +922,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Intel::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (KRB::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Modbus::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (NetControl::CATCH_RELEASE))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (NetControl::DROP))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (NetControl::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (NetControl::SHUNT))
|
||||
|
|
@ -955,6 +963,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::add_filter, <frame>, (Intel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_filter, <frame>, (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_filter, <frame>, (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_filter, <frame>, (NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_filter, <frame>, (NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_filter, <frame>, (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_filter, <frame>, (NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}]))
|
||||
|
|
@ -995,6 +1004,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (Intel::LOG, [columns=<no value description>, ev=Intel::log_intel, path=intel]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (KRB::LOG, [columns=<no value description>, ev=KRB::log_krb, path=kerberos]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (Modbus::LOG, [columns=<no value description>, ev=Modbus::log_modbus, path=modbus]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (NetControl::CATCH_RELEASE, [columns=<no value description>, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (NetControl::DROP, [columns=<no value description>, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (NetControl::LOG, [columns=<no value description>, ev=NetControl::log_netcontrol, path=netcontrol]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (NetControl::SHUNT, [columns=<no value description>, ev=NetControl::log_netcontrol_shunt, path=netcontrol_shunt]))
|
||||
|
|
@ -1021,7 +1031,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
|
||||
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1466281781.049315, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1466636352.007236, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(NetControl::check_plugins, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(NetControl::init, <null>, ())
|
||||
0.000000 MetaHookPre CallFunction(Notice::want_pp, <frame>, ())
|
||||
|
|
@ -1054,7 +1064,7 @@
|
|||
0.000000 MetaHookPre CallFunction(reading_live_traffic, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(reading_traces, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(set_to_regex, <frame>, ({}, (^\.?|\.)(~~)$))
|
||||
0.000000 MetaHookPre CallFunction(strftime, <frame>, (%Y, 1466281781.048782))
|
||||
0.000000 MetaHookPre CallFunction(strftime, <frame>, (%Y, 1466636352.006823))
|
||||
0.000000 MetaHookPre CallFunction(string_to_pattern, <frame>, ((^\.?|\.)()$, F))
|
||||
0.000000 MetaHookPre CallFunction(sub, <frame>, ((^\.?|\.)(~~)$, <...>/, ))
|
||||
0.000000 MetaHookPre CallFunction(to_count, <frame>, (2016))
|
||||
|
|
@ -1495,6 +1505,7 @@
|
|||
0.000000 | HookCallFunction Log::__add_filter(Intel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=intel, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::__add_filter(KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=kerberos, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::__add_filter(Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=modbus, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::__add_filter(NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol_catch_release, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::__add_filter(NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol_drop, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::__add_filter(NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::__add_filter(NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=netcontrol_shunt, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
|
|
@ -1535,6 +1546,7 @@
|
|||
0.000000 | HookCallFunction Log::__create_stream(Intel::LOG, [columns=<no value description>, ev=Intel::log_intel, path=intel])
|
||||
0.000000 | HookCallFunction Log::__create_stream(KRB::LOG, [columns=<no value description>, ev=KRB::log_krb, path=kerberos])
|
||||
0.000000 | HookCallFunction Log::__create_stream(Modbus::LOG, [columns=<no value description>, ev=Modbus::log_modbus, path=modbus])
|
||||
0.000000 | HookCallFunction Log::__create_stream(NetControl::CATCH_RELEASE, [columns=<no value description>, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release])
|
||||
0.000000 | HookCallFunction Log::__create_stream(NetControl::DROP, [columns=<no value description>, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop])
|
||||
0.000000 | HookCallFunction Log::__create_stream(NetControl::LOG, [columns=<no value description>, ev=NetControl::log_netcontrol, path=netcontrol])
|
||||
0.000000 | HookCallFunction Log::__create_stream(NetControl::SHUNT, [columns=<no value description>, ev=NetControl::log_netcontrol_shunt, path=netcontrol_shunt])
|
||||
|
|
@ -1561,7 +1573,7 @@
|
|||
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
|
||||
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
|
||||
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
|
||||
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1466281781.049315, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1466636352.007236, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Communication::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Conn::LOG)
|
||||
|
|
@ -1576,6 +1588,7 @@
|
|||
0.000000 | HookCallFunction Log::add_default_filter(Intel::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(KRB::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Modbus::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(NetControl::CATCH_RELEASE)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(NetControl::DROP)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(NetControl::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(NetControl::SHUNT)
|
||||
|
|
@ -1616,6 +1629,7 @@
|
|||
0.000000 | HookCallFunction Log::add_filter(Intel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::add_filter(KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::add_filter(Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::add_filter(NetControl::CATCH_RELEASE, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::add_filter(NetControl::DROP, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::add_filter(NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
0.000000 | HookCallFunction Log::add_filter(NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, pred=<uninitialized>, path=<uninitialized>, path_func=<uninitialized>, include=<uninitialized>, exclude=<uninitialized>, log_local=T, log_remote=T, interv=0 secs, postprocessor=<uninitialized>, config={}])
|
||||
|
|
@ -1656,6 +1670,7 @@
|
|||
0.000000 | HookCallFunction Log::create_stream(Intel::LOG, [columns=<no value description>, ev=Intel::log_intel, path=intel])
|
||||
0.000000 | HookCallFunction Log::create_stream(KRB::LOG, [columns=<no value description>, ev=KRB::log_krb, path=kerberos])
|
||||
0.000000 | HookCallFunction Log::create_stream(Modbus::LOG, [columns=<no value description>, ev=Modbus::log_modbus, path=modbus])
|
||||
0.000000 | HookCallFunction Log::create_stream(NetControl::CATCH_RELEASE, [columns=<no value description>, ev=NetControl::log_netcontrol_catch_release, path=netcontrol_catch_release])
|
||||
0.000000 | HookCallFunction Log::create_stream(NetControl::DROP, [columns=<no value description>, ev=NetControl::log_netcontrol_drop, path=netcontrol_drop])
|
||||
0.000000 | HookCallFunction Log::create_stream(NetControl::LOG, [columns=<no value description>, ev=NetControl::log_netcontrol, path=netcontrol])
|
||||
0.000000 | HookCallFunction Log::create_stream(NetControl::SHUNT, [columns=<no value description>, ev=NetControl::log_netcontrol_shunt, path=netcontrol_shunt])
|
||||
|
|
@ -1682,7 +1697,7 @@
|
|||
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
|
||||
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
|
||||
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
|
||||
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1466281781.049315, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1466636352.007236, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction NetControl::check_plugins()
|
||||
0.000000 | HookCallFunction NetControl::init()
|
||||
0.000000 | HookCallFunction Notice::want_pp()
|
||||
|
|
@ -1715,7 +1730,7 @@
|
|||
0.000000 | HookCallFunction reading_live_traffic()
|
||||
0.000000 | HookCallFunction reading_traces()
|
||||
0.000000 | HookCallFunction set_to_regex({}, (^\.?|\.)(~~)$)
|
||||
0.000000 | HookCallFunction strftime(%Y, 1466281781.048782)
|
||||
0.000000 | HookCallFunction strftime(%Y, 1466636352.006823)
|
||||
0.000000 | HookCallFunction string_to_pattern((^\.?|\.)()$, F)
|
||||
0.000000 | HookCallFunction sub((^\.?|\.)(~~)$, <...>/, )
|
||||
0.000000 | HookCallFunction to_count(2016)
|
||||
|
|
@ -1730,7 +1745,8 @@
|
|||
0.000000 | HookQueueEvent filter_change_tracking()
|
||||
1362692526.869344 MetaHookPost BroObjDtor(<void ptr>) -> <void>
|
||||
1362692526.869344 MetaHookPost CallFunction(ChecksumOffloading::check, <null>, ()) -> <no result>
|
||||
1362692526.869344 MetaHookPost CallFunction(NetControl::check_conn, <frame>, (141.142.228.5)) -> <no result>
|
||||
1362692526.869344 MetaHookPost CallFunction(NetControl::catch_release_seen, <frame>, (141.142.228.5)) -> <no result>
|
||||
1362692526.869344 MetaHookPost CallFunction(addr_to_subnet, <frame>, (141.142.228.5)) -> <no result>
|
||||
1362692526.869344 MetaHookPost CallFunction(filter_change_tracking, <null>, ()) -> <no result>
|
||||
1362692526.869344 MetaHookPost CallFunction(get_net_stats, <frame>, ()) -> <no result>
|
||||
1362692526.869344 MetaHookPost CallFunction(new_connection, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, krb=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, rfb=<uninitialized>, sip=<uninitialized>, sip_state=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> <no result>
|
||||
|
|
@ -1741,7 +1757,8 @@
|
|||
1362692526.869344 MetaHookPost UpdateNetworkTime(1362692526.869344) -> <void>
|
||||
1362692526.869344 MetaHookPre BroObjDtor(<void ptr>)
|
||||
1362692526.869344 MetaHookPre CallFunction(ChecksumOffloading::check, <null>, ())
|
||||
1362692526.869344 MetaHookPre CallFunction(NetControl::check_conn, <frame>, (141.142.228.5))
|
||||
1362692526.869344 MetaHookPre CallFunction(NetControl::catch_release_seen, <frame>, (141.142.228.5))
|
||||
1362692526.869344 MetaHookPre CallFunction(addr_to_subnet, <frame>, (141.142.228.5))
|
||||
1362692526.869344 MetaHookPre CallFunction(filter_change_tracking, <null>, ())
|
||||
1362692526.869344 MetaHookPre CallFunction(get_net_stats, <frame>, ())
|
||||
1362692526.869344 MetaHookPre CallFunction(new_connection, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, krb=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, rfb=<uninitialized>, sip=<uninitialized>, sip_state=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
||||
|
|
@ -1753,7 +1770,8 @@
|
|||
1362692526.869344 | HookBroObjDtor
|
||||
1362692526.869344 | HookUpdateNetworkTime 1362692526.869344
|
||||
1362692526.869344 | HookCallFunction ChecksumOffloading::check()
|
||||
1362692526.869344 | HookCallFunction NetControl::check_conn(141.142.228.5)
|
||||
1362692526.869344 | HookCallFunction NetControl::catch_release_seen(141.142.228.5)
|
||||
1362692526.869344 | HookCallFunction addr_to_subnet(141.142.228.5)
|
||||
1362692526.869344 | HookCallFunction filter_change_tracking()
|
||||
1362692526.869344 | HookCallFunction get_net_stats()
|
||||
1362692526.869344 | HookCallFunction new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, krb=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, rfb=<uninitialized>, sip=<uninitialized>, sip_state=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
||||
|
|
@ -1762,15 +1780,21 @@
|
|||
1362692526.869344 | HookQueueEvent filter_change_tracking()
|
||||
1362692526.869344 | HookQueueEvent new_connection([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.0, service={}, history=, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, krb=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, rfb=<uninitialized>, sip=<uninitialized>, sip_state=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
||||
1362692526.869344 | RequestObjDtor ChecksumOffloading::check()
|
||||
1362692526.939084 MetaHookPost CallFunction(NetControl::catch_release_seen, <frame>, (141.142.228.5)) -> <no result>
|
||||
1362692526.939084 MetaHookPost CallFunction(addr_to_subnet, <frame>, (141.142.228.5)) -> <no result>
|
||||
1362692526.939084 MetaHookPost CallFunction(connection_established, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, krb=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, rfb=<uninitialized>, sip=<uninitialized>, sip_state=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> <no result>
|
||||
1362692526.939084 MetaHookPost DrainEvents() -> <void>
|
||||
1362692526.939084 MetaHookPost QueueEvent(connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, krb=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, rfb=<uninitialized>, sip=<uninitialized>, sip_state=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])) -> false
|
||||
1362692526.939084 MetaHookPost UpdateNetworkTime(1362692526.939084) -> <void>
|
||||
1362692526.939084 MetaHookPre CallFunction(NetControl::catch_release_seen, <frame>, (141.142.228.5))
|
||||
1362692526.939084 MetaHookPre CallFunction(addr_to_subnet, <frame>, (141.142.228.5))
|
||||
1362692526.939084 MetaHookPre CallFunction(connection_established, <null>, ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, krb=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, rfb=<uninitialized>, sip=<uninitialized>, sip_state=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
||||
1362692526.939084 MetaHookPre DrainEvents()
|
||||
1362692526.939084 MetaHookPre QueueEvent(connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, krb=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, rfb=<uninitialized>, sip=<uninitialized>, sip_state=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>]))
|
||||
1362692526.939084 MetaHookPre UpdateNetworkTime(1362692526.939084)
|
||||
1362692526.939084 | HookUpdateNetworkTime 1362692526.939084
|
||||
1362692526.939084 | HookCallFunction NetControl::catch_release_seen(141.142.228.5)
|
||||
1362692526.939084 | HookCallFunction addr_to_subnet(141.142.228.5)
|
||||
1362692526.939084 | HookCallFunction connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, krb=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, rfb=<uninitialized>, sip=<uninitialized>, sip_state=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
||||
1362692526.939084 | HookDrainEvents
|
||||
1362692526.939084 | HookQueueEvent connection_established([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=1362692526.869344, duration=0.06974, service={}, history=Sh, uid=CXWv6p3arKYeMETxOg, tunnel=<uninitialized>, vlan=<uninitialized>, inner_vlan=<uninitialized>, dpd=<uninitialized>, conn=<uninitialized>, extract_orig=F, extract_resp=F, thresholds=<uninitialized>, dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>, dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F, ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>, irc=<uninitialized>, krb=<uninitialized>, modbus=<uninitialized>, mysql=<uninitialized>, radius=<uninitialized>, rdp=<uninitialized>, rfb=<uninitialized>, sip=<uninitialized>, sip_state=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>, smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>, syslog=<uninitialized>])
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
0.000000 bro_init
|
||||
0.000000 filter_change_tracking
|
||||
0.000000 NetControl::init
|
||||
0.000000 filter_change_tracking
|
||||
1254722767.492060 ChecksumOffloading::check
|
||||
1254722767.492060 filter_change_tracking
|
||||
1254722767.492060 new_connection
|
||||
|
|
@ -107,6 +107,7 @@
|
|||
1437831776.764391 connection_state_remove
|
||||
1437831776.764391 filter_change_tracking
|
||||
1437831776.764391 new_connection
|
||||
1437831777.107399 partial_connection
|
||||
1437831787.856895 new_connection
|
||||
1437831787.861602 connection_established
|
||||
1437831787.867142 smtp_reply
|
||||
|
|
@ -152,7 +153,9 @@
|
|||
1437831787.905375 smtp_request
|
||||
1437831787.914113 smtp_reply
|
||||
1437831798.533593 new_connection
|
||||
1437831798.533765 partial_connection
|
||||
1437831799.262632 new_connection
|
||||
1437831799.410135 partial_connection
|
||||
1437831799.461152 new_connection
|
||||
1437831799.610433 connection_established
|
||||
1437831799.611764 ssl_extension_server_name
|
||||
|
|
@ -206,10 +209,15 @@
|
|||
1437831800.045701 ssl_established
|
||||
1437831800.217854 net_done
|
||||
1437831800.217854 filter_change_tracking
|
||||
1437831800.217854 connection_pending
|
||||
1437831800.217854 connection_state_remove
|
||||
1437831800.217854 connection_pending
|
||||
1437831800.217854 connection_state_remove
|
||||
1437831800.217854 connection_pending
|
||||
1437831800.217854 connection_state_remove
|
||||
1437831800.217854 connection_pending
|
||||
1437831800.217854 connection_state_remove
|
||||
1437831800.217854 connection_pending
|
||||
1437831800.217854 connection_state_remove
|
||||
1437831800.217854 bro_done
|
||||
1437831800.217854 ChecksumOffloading::check
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,14 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-1-drop-with-debug.bro
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
NetControl::drop_connection(c$id, 20 secs);
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-10-use-skeleton.bro
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local skeleton_plugin = NetControl::create_skeleton("");
|
||||
NetControl::activate(skeleton_plugin, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
NetControl::drop_connection(c$id, 20 secs);
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-2-ssh-guesser.bro
|
||||
|
||||
|
||||
@load protocols/ssh/detect-bruteforcing
|
||||
|
||||
redef SSH::password_guesses_limit=10;
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
hook Notice::policy(n: Notice::Info)
|
||||
{
|
||||
if ( n$note == SSH::Password_Guessing )
|
||||
NetControl::drop_address(n$src, 60min);
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-3-ssh-guesser.bro
|
||||
|
||||
|
||||
@load protocols/ssh/detect-bruteforcing
|
||||
|
||||
redef SSH::password_guesses_limit=10;
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
hook Notice::policy(n: Notice::Info)
|
||||
{
|
||||
if ( n$note == SSH::Password_Guessing )
|
||||
add n$actions[Notice::ACTION_DROP];
|
||||
}
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-4-drop.bro
|
||||
|
||||
function our_drop_connection(c: conn_id, t: interval)
|
||||
{
|
||||
# As a first step, create the NetControl::Entity that we want to block
|
||||
local e = NetControl::Entity($ty=NetControl::CONNECTION, $conn=c);
|
||||
# Then, use the entity to create the rule to drop the entity in the forward path
|
||||
local r = NetControl::Rule($ty=NetControl::DROP,
|
||||
$target=NetControl::FORWARD, $entity=e, $expire=t);
|
||||
|
||||
# Add the rule
|
||||
local id = NetControl::add_rule(r);
|
||||
|
||||
if ( id == "" )
|
||||
print "Error while dropping";
|
||||
}
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
our_drop_connection(c$id, 20 secs);
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-5-hook.bro
|
||||
|
||||
hook NetControl::rule_policy(r: NetControl::Rule)
|
||||
{
|
||||
if ( r$ty == NetControl::DROP &&
|
||||
r$entity$ty == NetControl::CONNECTION &&
|
||||
r$entity$conn$orig_h in 192.168.0.0/16 )
|
||||
{
|
||||
print "Ignored connection from", r$entity$conn$orig_h;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
NetControl::drop_connection(c$id, 20 secs);
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-6-find.bro
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local netcontrol_debug = NetControl::create_debug(T);
|
||||
NetControl::activate(netcontrol_debug, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
if ( |NetControl::find_rules_addr(c$id$orig_h)| > 0 )
|
||||
{
|
||||
print "Rule already exists";
|
||||
return;
|
||||
}
|
||||
|
||||
NetControl::drop_connection(c$id, 20 secs);
|
||||
print "Rule added";
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-7-catch-release.bro
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
NetControl::drop_address_catch_release(c$id$orig_h);
|
||||
}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-8-multiple.bro
|
||||
|
||||
function our_openflow_check(p: NetControl::PluginState, r: NetControl::Rule): bool
|
||||
{
|
||||
if ( r$ty == NetControl::DROP &&
|
||||
r$entity$ty == NetControl::ADDRESS &&
|
||||
subnet_width(r$entity$ip) == 32 &&
|
||||
subnet_to_addr(r$entity$ip) in 192.168.17.0/24 )
|
||||
return F;
|
||||
|
||||
return T;
|
||||
}
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
# Add debug plugin with low priority
|
||||
local debug_plugin = NetControl::create_debug(T);
|
||||
NetControl::activate(debug_plugin, 0);
|
||||
|
||||
# Instantiate OpenFlow debug plugin with higher priority
|
||||
local of_controller = OpenFlow::log_new(42);
|
||||
local netcontrol_of = NetControl::create_openflow(of_controller, [$check_pred=our_openflow_check]);
|
||||
NetControl::activate(netcontrol_of, 10);
|
||||
}
|
||||
|
||||
event NetControl::init_done()
|
||||
{
|
||||
NetControl::drop_address(10.0.0.1, 1min);
|
||||
NetControl::drop_address(192.168.17.2, 1min);
|
||||
NetControl::drop_address(192.168.18.2, 1min);
|
||||
}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
# @TEST-EXEC: cat %INPUT >output && btest-diff output
|
||||
|
||||
netcontrol-9-skeleton.bro
|
||||
|
||||
module NetControl;
|
||||
|
||||
export {
|
||||
## Instantiates the plugin.
|
||||
global create_skeleton: function(argument: string) : PluginState;
|
||||
}
|
||||
|
||||
function skeleton_name(p: PluginState) : string
|
||||
{
|
||||
return "NetControl skeleton plugin";
|
||||
}
|
||||
|
||||
function skeleton_add_rule_fun(p: PluginState, r: Rule) : bool
|
||||
{
|
||||
print "add", r;
|
||||
event NetControl::rule_added(r, p);
|
||||
return T;
|
||||
}
|
||||
|
||||
function skeleton_remove_rule_fun(p: PluginState, r: Rule) : bool
|
||||
{
|
||||
print "remove", r;
|
||||
event NetControl::rule_removed(r, p);
|
||||
return T;
|
||||
}
|
||||
|
||||
global skeleton_plugin = Plugin(
|
||||
$name = skeleton_name,
|
||||
$can_expire = F,
|
||||
$add_rule = skeleton_add_rule_fun,
|
||||
$remove_rule = skeleton_remove_rule_fun
|
||||
);
|
||||
|
||||
function create_skeleton(argument: string) : PluginState
|
||||
{
|
||||
local p = PluginState($plugin=skeleton_plugin);
|
||||
|
||||
return p;
|
||||
}
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
@TEST-EXEC: btest-rst-cmd bro -C -r ${TRACES}/tls/ecdhe.pcap ${DOC_ROOT}/frameworks/netcontrol-1-drop-with-debug.bro
|
||||
@TEST-EXEC: btest-rst-cmd cat netcontrol.log
|
||||
|
|
@ -0,0 +1 @@
|
|||
@TEST-EXEC: btest-rst-cmd cat netcontrol_drop.log
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
@TEST-EXEC: btest-rst-cmd bro -C -r ${TRACES}/ssh/sshguess.pcap ${DOC_ROOT}/frameworks/netcontrol-2-ssh-guesser.bro
|
||||
@TEST-EXEC: btest-rst-cmd cat netcontrol.log
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
@TEST-EXEC: btest-rst-cmd bro -C -r ${TRACES}/ssh/sshguess.pcap ${DOC_ROOT}/frameworks/netcontrol-3-ssh-guesser.bro
|
||||
@TEST-EXEC: btest-rst-cmd cat netcontrol.log
|
||||
|
|
@ -0,0 +1 @@
|
|||
@TEST-EXEC: btest-rst-cmd cat notice.log
|
||||
2
testing/btest/doc/sphinx/netcontrol-4-drop.bro.btest
Normal file
2
testing/btest/doc/sphinx/netcontrol-4-drop.bro.btest
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
@TEST-EXEC: btest-rst-cmd bro -C -r ${TRACES}/tls/ecdhe.pcap ${DOC_ROOT}/frameworks/netcontrol-4-drop.bro
|
||||
@TEST-EXEC: btest-rst-cmd cat netcontrol.log
|
||||
1
testing/btest/doc/sphinx/netcontrol-5-hook.bro.btest
Normal file
1
testing/btest/doc/sphinx/netcontrol-5-hook.bro.btest
Normal file
|
|
@ -0,0 +1 @@
|
|||
@TEST-EXEC: btest-rst-cmd bro -C -r ${TRACES}/tls/ecdhe.pcap ${DOC_ROOT}/frameworks/netcontrol-5-hook.bro
|
||||
1
testing/btest/doc/sphinx/netcontrol-6-find.bro.btest
Normal file
1
testing/btest/doc/sphinx/netcontrol-6-find.bro.btest
Normal file
|
|
@ -0,0 +1 @@
|
|||
@TEST-EXEC: btest-rst-cmd bro -C -r ${TRACES}/tls/google-duplicate.trace ${DOC_ROOT}/frameworks/netcontrol-6-find.bro
|
||||
|
|
@ -0,0 +1 @@
|
|||
@TEST-EXEC: btest-rst-cmd bro -C -r ${TRACES}/tls/ecdhe.pcap ${DOC_ROOT}/frameworks/netcontrol-7-catch-release.bro
|
||||
|
|
@ -0,0 +1 @@
|
|||
@TEST-EXEC: btest-rst-cmd cat netcontrol_catch_release.log
|
||||
1
testing/btest/doc/sphinx/netcontrol-8-multiple.bro.btest
Normal file
1
testing/btest/doc/sphinx/netcontrol-8-multiple.bro.btest
Normal file
|
|
@ -0,0 +1 @@
|
|||
@TEST-EXEC: btest-rst-cmd bro ${DOC_ROOT}/frameworks/netcontrol-8-multiple.bro
|
||||
|
|
@ -0,0 +1 @@
|
|||
@TEST-EXEC: btest-rst-cmd cat netcontrol.log
|
||||
|
|
@ -0,0 +1 @@
|
|||
@TEST-EXEC: btest-rst-cmd cat openflow.log
|
||||
|
|
@ -0,0 +1 @@
|
|||
@TEST-EXEC: btest-rst-cmd bro -C -r ${TRACES}/tls/ecdhe.pcap ${DOC_ROOT}/frameworks/netcontrol-9-skeleton.bro ${DOC_ROOT}/frameworks/netcontrol-10-use-skeleton.bro
|
||||
1
testing/btest/doc/sphinx/netcontrol-9-skeleton.bro.btest
Normal file
1
testing/btest/doc/sphinx/netcontrol-9-skeleton.bro.btest
Normal file
|
|
@ -0,0 +1 @@
|
|||
@TEST-EXEC: btest-rst-cmd bro -C -r ${TRACES}/tls/ecdhe.pcap ${DOC_ROOT}/frameworks/netcontrol-9-skeleton.bro ${DOC_ROOT}/frameworks/netcontrol-10-use-skeleton.bro
|
||||
Loading…
Add table
Add a link
Reference in a new issue