From fb4858d42b09680bb1ed2555746bc5c0087c992a Mon Sep 17 00:00:00 2001 From: Peter Cullen Date: Thu, 28 Jul 2022 11:34:18 -0700 Subject: [PATCH] Prevent large dhcp log entries A flood of DHCP traffic can result if very large log entries consisting of many uids and/or msg_types. Such large log entries can disrupt a SIEM ingestion pipeline. This change forcing a log entry to be written when the number of uids or the number of msg_Types exceed a certain value. The values are treated as options for easy configuration. --- scripts/base/protocols/dhcp/main.zeek | 13 ++++ .../dhcp.log | 73 ++++++++++++++++++ .../dhcp.log | 73 ++++++++++++++++++ testing/btest/Traces/dhcp/dhcp_flood.pcap | Bin 0 -> 165774 bytes .../dhcp/dhcp-prevent-large-msgtypes.zeek | 7 ++ .../dhcp/dhcp-prevent-large-uids.zeek | 7 ++ 6 files changed, 173 insertions(+) create mode 100644 testing/btest/Baseline/scripts.base.protocols.dhcp.dhcp-prevent-large-msgtypes/dhcp.log create mode 100644 testing/btest/Baseline/scripts.base.protocols.dhcp.dhcp-prevent-large-uids/dhcp.log create mode 100644 testing/btest/Traces/dhcp/dhcp_flood.pcap create mode 100644 testing/btest/scripts/base/protocols/dhcp/dhcp-prevent-large-msgtypes.zeek create mode 100644 testing/btest/scripts/base/protocols/dhcp/dhcp-prevent-large-uids.zeek diff --git a/scripts/base/protocols/dhcp/main.zeek b/scripts/base/protocols/dhcp/main.zeek index d6a6807540..5625826b57 100644 --- a/scripts/base/protocols/dhcp/main.zeek +++ b/scripts/base/protocols/dhcp/main.zeek @@ -91,6 +91,12 @@ export { ## transaction narrative. option DHCP::max_txid_watch_time = 30secs; + ## The maximum number of uids allowed in a single log entry. + option DHCP::max_uids_per_log_entry = 10; + + ## The maximum number of msg_types allowed in a single log entry. + option DHCP::max_msg_types_per_log_entry = 50; + ## This event is used internally to distribute data around clusters ## since DHCP doesn't follow the normal "connection" model used by ## most protocols. It can also be handled to extend the DHCP log. @@ -266,6 +272,13 @@ event DHCP::aggregate_msgs(ts: time, id: conn_id, uid: string, is_orig: bool, ms if ( options?$lease ) log_info$lease_time = options$lease; } + + # Write log entry if |uids| or |msg_types| becomes too large + if ( |log_info$uids| >= max_uids_per_log_entry || |log_info$msg_types| >= max_msg_types_per_log_entry ) + { + Log::write(LOG, log_info); + delete join_data[msg$xid]; + } } @endif diff --git a/testing/btest/Baseline/scripts.base.protocols.dhcp.dhcp-prevent-large-msgtypes/dhcp.log b/testing/btest/Baseline/scripts.base.protocols.dhcp.dhcp-prevent-large-msgtypes/dhcp.log new file mode 100644 index 0000000000..ab623734b1 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.dhcp.dhcp-prevent-large-msgtypes/dhcp.log @@ -0,0 +1,73 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path dhcp +#open XXXX-XX-XX-XX-XX-XX +#fields ts uids client_addr server_addr mac host_name client_fqdn domain requested_addr assigned_addr lease_time client_message server_message msg_types duration +#types time set[string] addr addr string string string string addr addr interval string string vector[string] interval +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h,CHhAvVGS1DHFjwGM9,C4J4Th3PJpwUYZZ6gc,CtPZjS20MLrsMUOJi2 128.2.5.240 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069977 +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg,CmES5u32sYpV7JYN,C37jN32gN3y3AZzyf6,CUM0KZ3MLUfNB0cl11 128.2.5.236 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069992 +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6,C0LAHyvtKSQHyJxIl,CFLRIC3zaTU1loLGxh,C3eiCBGOLw3VtHfOj 128.2.5.232 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069975 +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri,C9mvWx3ezztgzcexV7,CNnMIj2QSd84NKf7U3,C9rXSW3KSpTYvPrlI1 128.2.5.228 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069990 +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb,CpmdRlaUoJLN3uIRa,CykQaM33ztNt0csB9a,CtxTCR2Yer0FR1tIBg 128.2.5.224 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069990 +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7,C1Xkzz2MaGtLrc1Tla,CBA8792iHmnhPLksKa,CqlVyW1YwZ15RhTBc4 128.2.5.220 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069985 +XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf,CFSwNi4CNGxcuffo49,CGLPPc35OzDQij1XX8,CiyBAq1bBLNaTiTAc 128.2.5.216 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069975 +XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf,CAnFrb2Cvxr5T7quOc,C8rquZ3DjgNW06JGLl,CPhDKt12KQPUVbQz06 128.2.5.212 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069989 +XXXXXXXXXX.XXXXXX CNdne23ox8SQTgPoy3,CaGCc13FffXe6RkQl9,CzrZOtXqhwwndQva3,CeGt004UBsXLoZSeCg 128.2.5.208 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069977 +XXXXXXXXXX.XXXXXX CzmEfj4RValNyLfT58,CCk2V03QgWwIurU3f,Cgc67J2CpHIVN7HAw4,CTrywc2ra7tcWn2af 128.2.5.204 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069987 +XXXXXXXXXX.XXXXXX CKJVAj1rNx0nolFFc4,CD7vfu1qu4YJKe1nGi,CImWJ03GsvPvA0P67i,CgwPkWkJfuBIJsNi4 128.2.5.200 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069990 +XXXXXXXXXX.XXXXXX CWhRtK3eXodviHmbo7,CqVUM4vyqCacqFiud,CudMuD3jKHCaCU5CE,CRJ9x54IaE7bkVEpad 128.2.5.196 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069986 +XXXXXXXXXX.XXXXXX CAvUKGaEgLlR4i6t2,Cgwg7Z1MHA1YkiZmm3,CDNchHwRoXhVzzHB2,Ck78JG32Y4I7AGp7Vb 128.2.5.192 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069973 +XXXXXXXXXX.XXXXXX CQcXCjONUKqMfnhXb,CeP1sc28dOzbbYkbA,COOKv01AQPAqfGMN9k,C0JEpR1Ij6308CwEhh 128.2.5.188 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069979 +XXXXXXXXXX.XXXXXX C5pL731XEkARXOq253,CM4z3Z2rdNfyHYQ0Df,CVcd914ZFpaUisaVf2,CB0Ovs3cNZgLQ93FSh 128.2.5.184 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069995 +XXXXXXXXXX.XXXXXX CdY2UF17xGQ6lUx7e8,CkD1144ZtRYffh5zjg,C1dGa34JRiYAKbMI0c,CtEfXf4f39NRDu1Dr4 128.2.5.180 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069992 +XXXXXXXXXX.XXXXXX CjGaD11BLkmCG5cEVf,C1ejhC4SXsZ4pEdOd,CbI5Qt4rlFnOHuL522,CdGkzc4fIBRo0721v 128.2.5.176 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069978 +XXXXXXXXXX.XXXXXX CWqViP2k4EKfYWy7Y1,CisPKv3PhjrFFhZbq7,CCgIHR2Vna1ZW9BPjd,CBr8Cp4juBTcRQZAA4 128.2.5.172 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069989 +XXXXXXXXXX.XXXXXX CWMTYT1vZEQXErCXY7,C4C8Lr4DOGUTRZPAW8,CGwfOa4GYyzNItzc9j,C9Mb033HGlhETKxUbj 128.2.5.168 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069988 +XXXXXXXXXX.XXXXXX CdzNo91LLZlfe0pmT8,CKvlqe4bTVu5HNGrb1,C04EG53Yaw6dgjGT3k,CfQutTEgs3g8sUrsa 128.2.5.164 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069991 +XXXXXXXXXX.XXXXXX CF00uX66iWHtiV1q1,CkVqlMyWLZSpdNcPa,CsLUyBLEs5x3GKtgk,Cb2Rv3Wek35VDwxDk 128.2.5.160 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069986 +XXXXXXXXXX.XXXXXX C6Frs83UqNszgcqN15,CQCAYJ2zCov16vZwf,CgHhMv2Ww0Y4oQNtd,Cil9Tc1rwfQS9uqdsb 128.2.5.156 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069981 +XXXXXXXXXX.XXXXXX CoVJDI3K3qTiTnPoV9,ChHNpz2Xf9xMo2lnC4,Ch5tsG3OlOd7l83JFc,CFTS591Wnlb7gnrpP7 128.2.5.152 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069980 +XXXXXXXXXX.XXXXXX C2qZRm2yQg9RoQNkVg,CggxJkLPcdPyKjfma,C6tA8aOk3QI9oIaHl,C3AXaL2up5k3PR4VW4 128.2.5.148 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069987 +XXXXXXXXXX.XXXXXX CKpb612OxJundLAeRf,CcwXC81REVUrKprLz,C5OBjqCVHlPAjKQXi,CI5pddk2aeicnmmoj 128.2.5.144 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069991 +XXXXXXXXXX.XXXXXX COvnS21VmREmS5Xzuf,Cb7w0T1dHZUPXzdgRi,CJmTVn4YcEf19Wo137,Cuhrwt2ypWdmhxNcjb 128.2.5.140 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069991 +XXXXXXXXXX.XXXXXX C68HZHafWQbOYWkYi,C5II0Z3yZFhDzHSKrl,CQ7b0y4Vd4NVQ3nJRi,CpKJJiDUPEBNMGSC 128.2.5.136 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069990 +XXXXXXXXXX.XXXXXX CUTgljebkkh2Ydhzi,CX9xXW3s3cSCaIB9a2,CuIjKg2hEOBmXsIvx4,CsnMLaDyNeIqxq6i2 128.2.5.132 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069951 +XXXXXXXXXX.XXXXXX C1alUz23K74AR4WZUc,C9ywcdnOP5TLfD97e,C7aJ8S1bYoBzPdxRDb,CTISqXQMVxGJCVG2i 128.2.5.128 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069972 +XXXXXXXXXX.XXXXXX CjsoT83JnYI2Be2f8j,CL7JR54e4lOc3aUAph,CohWkh4QvZcB1WXOVe,CS9xQJ3Jly032E9jC2 128.2.5.124 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069953 +XXXXXXXXXX.XXXXXX CIWOQa2vaf6TxyZ2Jg,CPEPje2CwXXxGGPo27,CgYh1L1mwsOxSqVBu9,CPOg0SZxpoHbNzpG5 128.2.5.120 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069970 +XXXXXXXXXX.XXXXXX CqyxRG6TRKYW41Zz5,CalQkN3MoYim6AEEe4,C823dt2fd3qQ26XyU,C3HR3r12iwKiqXa9c 128.2.5.116 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069991 +XXXXXXXXXX.XXXXXX CVgpXQ1plHZSjZoGq9,Cr5ot64fYu8c0wBtik,CPnPwW1vseaFvOVKZc,CzZuKd2XEy2jlcWqT6 128.2.5.112 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069985 +XXXXXXXXXX.XXXXXX CceZRf3q969iOibom4,CeYlkM3WxZVUmujyB9,CkgPZ03tcwpxYjnOSc,Cfv1oI1ypkphPOMD7g 128.2.5.108 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069979 +XXXXXXXXXX.XXXXXX CjTrQkID6Z2SNK3ha,C8yjkq23bmUk9MkLf,ChN5cQ1faCW2xBl8Ki,CevQX3116xo72LIoK9 128.2.5.104 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069986 +XXXXXXXXXX.XXXXXX CPjxvb4XleEtywR72,CA4o9G1CB2Af4WWhCf,Cf8FAq4I77xaBMSVT9,C7XVqL2qUJ1enNZYag 128.2.5.100 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069977 +XXXXXXXXXX.XXXXXX CjqWgiHlaYFi9YImg,CAy1xs4SqOffMYYoi6,CbIFhV2t1dFcA47mxb,C1uJul2gbxeDRNFura 128.2.5.96 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069992 +XXXXXXXXXX.XXXXXX CwkPvf43XtOGn09xUb,Cz7T4t4CVp8k2htbIk,Cqn0E64YUKHGEJtXE9,C3sUxYJbMLLrlkY2l 128.2.5.92 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069995 +XXXXXXXXXX.XXXXXX Cq5Tn24Flxl5ykcPB4,Cx1J5T2RlUHdnWX4P7,C4DpKm2ihMjo33xAK9,CQKymemsGWxk8qNhi 128.2.5.88 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069979 +XXXXXXXXXX.XXXXXX CauDdy1kS45qWx7Jaf,CwalhH1EmkTCp6Z5oj,CoBPIr1bmfwOHYS8k7,CBMc5Bq8xeq3TqHyl 128.2.5.84 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069984 +XXXXXXXXXX.XXXXXX COzc1t4726TvteJAq9,Cwks1t1XCX1VVKWlui,CeivHI16nJNE1XoDn8,CySyNg2Q7X5Wig9qXc 128.2.5.80 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069984 +XXXXXXXXXX.XXXXXX CytmUVLD1AW7Bjdda,CdHHGD21PDk8qHCNZi,CyAz9V2XDShWvc9X85,C9mSwv1EoAGeQwdxia 128.2.5.76 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069978 +XXXXXXXXXX.XXXXXX CSqd0W3t872JJDPQR7,CHxNzE4i1HGC9aNQb8,CBdUFS64H8SD3CRc7,CXmENaHXj6AAZ6z67 128.2.5.72 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069981 +XXXXXXXXXX.XXXXXX CCOssQ1lVW9L4luov7,CH4Zqaz7LIoXnVdx6,CmYN6N1hsT2MgdKQo9,CkH9U915OzOOjvkSJi 128.2.5.68 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069989 +XXXXXXXXXX.XXXXXX CTy7qulV8eG6LkeUd,C3JRhD4EKTLL9ETgB6,CCwJVWbbaSCkRe2K9,CRGnRy2aYiKuVFnIG 128.2.5.64 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069985 +XXXXXXXXXX.XXXXXX CUN1fq1Nh9yg0qjEZk,CsTLYp3UVyKHvvF8jl,Cy1IPuLzKTRb2fGF8,C2sbOw4qh4NrDdHRH2 128.2.5.60 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069987 +XXXXXXXXXX.XXXXXX CYXkGL3OwfyucBURVl,COJL3m2IFflzZ1Cvdk,CAR8U13yNQoRQJZLcd,CfyyuF35s6IHIKaPy1 128.2.5.56 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069993 +XXXXXXXXXX.XXXXXX CnB5fj2ShUFnGngqf8,CJBk991FDSqc8wRBK1,CeoHSa1uBAQlDI3FEe,C6lrWz3udBitB6moKf 128.2.5.52 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069982 +XXXXXXXXXX.XXXXXX CRM6Kv2JvySZyj1qrl,CiZMlr41UYw4zUSiH7,ChDijs42aziwiDYP4c,C850go2IsfiAcSGCfc 128.2.5.48 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069978 +XXXXXXXXXX.XXXXXX C45NxP1qI6S5UMi6Ta,CwUICHbZAZuWABr9,Car6PO34Q2yGqFhtw8,CLvoof1o65FluhXQI6 128.2.5.44 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069989 +XXXXXXXXXX.XXXXXX CaEkUY1AI0qcJSl8Cd,CwP7As3BK8V5lwj7D8,CWnddL27sIwroPwU4h,C73cNq1ss4gZpfV8Jj 128.2.5.40 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069986 +XXXXXXXXXX.XXXXXX CBkOwg2KK7rXFXUTmd,C0u03i3hv4B4fSd7zg,CITjhO2n7PZKsy3Mw4,Ci0XPI2JfTjInNGHJ7 128.2.5.36 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069993 +XXXXXXXXXX.XXXXXX CUAWQS1YtxjDhtxxte,Cgcc4N2eKsv3m3nA87,CvRIiA3mohju9nTku6,CWT4zv7sNwj1cnBeb 128.2.5.32 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069982 +XXXXXXXXXX.XXXXXX CT4t8k1zeBe7ZRUBg5,CylDMs45x5z5lRx9se,CZvB3g1drtq6h6KP8,CQHUiY2AW9ZT2iB0x8 128.2.5.28 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069989 +XXXXXXXXXX.XXXXXX Cs4vHa2laJaNpjym2a,CzcPSa4HIZVpmSAZQ1,CBeoy737B8VrP0iSS6,CYwHEGkAUO1v9YGk8 128.2.5.24 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069990 +XXXXXXXXXX.XXXXXX CmVWUQ1Zj8v9tk8Tn9,Cyyy781JVg92X5mDUc,CMU7t24bL4QMZtMO2l,Czv7tI2Aq1yfgdryG 128.2.5.20 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069983 +XXXXXXXXXX.XXXXXX CVLeLf3d954JlCj5Ch,CmDpIN2aFGjiOMOJWe,CR7XxA2W5vLwE5KTs,C5p9eh4XiSATtqsZi5 128.2.5.16 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069993 +XXXXXXXXXX.XXXXXX CUeKfb4nbjydJsNdId,Cekrs3zkM6eSou1mg,CUVPVWOtpPH13Hfck,CfhuF84Ji7AdXxsAA6 128.2.5.12 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069973 +XXXXXXXXXX.XXXXXX CpDj0c1fnKaDIGyqma,CRYwli4VJ5IlPTDWIl,CguHTc3ErOLWFoQyBa,CgfSWCkLmMlaKMWUl 128.2.5.8 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069977 +XXXXXXXXXX.XXXXXX C9xsW63PP2wB8hiDUk,CzWoyC1HE4FO1zdT3a,CbaJQC9l9K3ELB1u1,CF5tR03Af5y0DJD2he 128.2.5.4 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069990 +XXXXXXXXXX.XXXXXX C57jQA4eBlGbOkJ0xc,COlS4I3p8lZG3vxBag,CimLTH3Vi2F5nxs6Bf,CyVhox28QHRlYRbY9 128.2.5.0 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069991 +XXXXXXXXXX.XXXXXX CzTeK32euJBRHTY2z5,CA1qPq3zXlCZGMTF3d,ClzajT3YA0FYcHeIsi,Ch4OGK13MCwxE2a1O9 128.2.4.252 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK 0.069991 +XXXXXXXXXX.XXXXXX CoW1ycpevZQjU9uK,C4mAqd3q1os6WQrFGi 128.2.4.250 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK 0.029976 +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.dhcp.dhcp-prevent-large-uids/dhcp.log b/testing/btest/Baseline/scripts.base.protocols.dhcp.dhcp-prevent-large-uids/dhcp.log new file mode 100644 index 0000000000..9ac9a51a88 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.dhcp.dhcp-prevent-large-uids/dhcp.log @@ -0,0 +1,73 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path dhcp +#open XXXX-XX-XX-XX-XX-XX +#fields ts uids client_addr server_addr mac host_name client_fqdn domain requested_addr assigned_addr lease_time client_message server_message msg_types duration +#types time set[string] addr addr string string string string addr addr interval string string vector[string] interval +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h,CHhAvVGS1DHFjwGM9,C4J4Th3PJpwUYZZ6gc,CtPZjS20MLrsMUOJi2,CUM0KZ3MLUfNB0cl11 128.2.5.239 - 90:b1:1c:99:49:29 - - - - - - - - INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.079988 +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg,CmES5u32sYpV7JYN,C37jN32gN3y3AZzyf6,CUM0KZ3MLUfNB0cl11,C3eiCBGOLw3VtHfOj 128.2.5.235 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070025 +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6,C0LAHyvtKSQHyJxIl,CFLRIC3zaTU1loLGxh,C9rXSW3KSpTYvPrlI1,C3eiCBGOLw3VtHfOj 128.2.5.231 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070011 +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb,Ck51lg1bScffFj34Ri,C9mvWx3ezztgzcexV7,CNnMIj2QSd84NKf7U3,C9rXSW3KSpTYvPrlI1 128.2.5.227 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070011 +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb,CpmdRlaUoJLN3uIRa,CykQaM33ztNt0csB9a,C1Xkzz2MaGtLrc1Tla,CtxTCR2Yer0FR1tIBg 128.2.5.223 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070015 +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7,C1Xkzz2MaGtLrc1Tla,CBA8792iHmnhPLksKa,CqlVyW1YwZ15RhTBc4,CGLPPc35OzDQij1XX8 128.2.5.219 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070017 +XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf,CV5WJ42jPYbNW9JNWf,CFSwNi4CNGxcuffo49,CGLPPc35OzDQij1XX8,CiyBAq1bBLNaTiTAc 128.2.5.215 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070010 +XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf,CAnFrb2Cvxr5T7quOc,CzrZOtXqhwwndQva3,C8rquZ3DjgNW06JGLl,CPhDKt12KQPUVbQz06 128.2.5.211 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070022 +XXXXXXXXXX.XXXXXX CNdne23ox8SQTgPoy3,CaGCc13FffXe6RkQl9,CzrZOtXqhwwndQva3,CeGt004UBsXLoZSeCg,CTrywc2ra7tcWn2af 128.2.5.207 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070012 +XXXXXXXXXX.XXXXXX CzmEfj4RValNyLfT58,CCk2V03QgWwIurU3f,Cgc67J2CpHIVN7HAw4,CTrywc2ra7tcWn2af,CgwPkWkJfuBIJsNi4 128.2.5.203 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070008 +XXXXXXXXXX.XXXXXX CKJVAj1rNx0nolFFc4,CWhRtK3eXodviHmbo7,CImWJ03GsvPvA0P67i,CD7vfu1qu4YJKe1nGi,CgwPkWkJfuBIJsNi4 128.2.5.199 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070018 +XXXXXXXXXX.XXXXXX CWhRtK3eXodviHmbo7,CqVUM4vyqCacqFiud,CudMuD3jKHCaCU5CE,CAvUKGaEgLlR4i6t2,CRJ9x54IaE7bkVEpad 128.2.5.195 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070039 +XXXXXXXXXX.XXXXXX CAvUKGaEgLlR4i6t2,Cgwg7Z1MHA1YkiZmm3,CDNchHwRoXhVzzHB2,Ck78JG32Y4I7AGp7Vb,CeP1sc28dOzbbYkbA 128.2.5.191 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070014 +XXXXXXXXXX.XXXXXX CQcXCjONUKqMfnhXb,CVcd914ZFpaUisaVf2,CeP1sc28dOzbbYkbA,COOKv01AQPAqfGMN9k,C0JEpR1Ij6308CwEhh 128.2.5.187 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070005 +XXXXXXXXXX.XXXXXX C5pL731XEkARXOq253,CM4z3Z2rdNfyHYQ0Df,CVcd914ZFpaUisaVf2,CB0Ovs3cNZgLQ93FSh,C1dGa34JRiYAKbMI0c 128.2.5.183 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070003 +XXXXXXXXXX.XXXXXX CdY2UF17xGQ6lUx7e8,CkD1144ZtRYffh5zjg,CbI5Qt4rlFnOHuL522,CtEfXf4f39NRDu1Dr4,C1dGa34JRiYAKbMI0c 128.2.5.179 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070021 +XXXXXXXXXX.XXXXXX CjGaD11BLkmCG5cEVf,C1ejhC4SXsZ4pEdOd,CbI5Qt4rlFnOHuL522,CdGkzc4fIBRo0721v,CisPKv3PhjrFFhZbq7 128.2.5.175 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070010 +XXXXXXXXXX.XXXXXX CWMTYT1vZEQXErCXY7,CWqViP2k4EKfYWy7Y1,CisPKv3PhjrFFhZbq7,CCgIHR2Vna1ZW9BPjd,CBr8Cp4juBTcRQZAA4 128.2.5.171 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070012 +XXXXXXXXXX.XXXXXX CWMTYT1vZEQXErCXY7,C4C8Lr4DOGUTRZPAW8,CGwfOa4GYyzNItzc9j,C9Mb033HGlhETKxUbj,CfQutTEgs3g8sUrsa 128.2.5.167 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070011 +XXXXXXXXXX.XXXXXX CdzNo91LLZlfe0pmT8,CKvlqe4bTVu5HNGrb1,C04EG53Yaw6dgjGT3k,CfQutTEgs3g8sUrsa,Cb2Rv3Wek35VDwxDk 128.2.5.163 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070013 +XXXXXXXXXX.XXXXXX CF00uX66iWHtiV1q1,C6Frs83UqNszgcqN15,CkVqlMyWLZSpdNcPa,CsLUyBLEs5x3GKtgk,Cb2Rv3Wek35VDwxDk 128.2.5.159 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070019 +XXXXXXXXXX.XXXXXX C6Frs83UqNszgcqN15,CQCAYJ2zCov16vZwf,CgHhMv2Ww0Y4oQNtd,CFTS591Wnlb7gnrpP7,Cil9Tc1rwfQS9uqdsb 128.2.5.155 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070021 +XXXXXXXXXX.XXXXXX CoVJDI3K3qTiTnPoV9,ChHNpz2Xf9xMo2lnC4,Ch5tsG3OlOd7l83JFc,CFTS591Wnlb7gnrpP7,C3AXaL2up5k3PR4VW4 128.2.5.151 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070007 +XXXXXXXXXX.XXXXXX C2qZRm2yQg9RoQNkVg,CggxJkLPcdPyKjfma,C6tA8aOk3QI9oIaHl,C3AXaL2up5k3PR4VW4,CI5pddk2aeicnmmoj 128.2.5.147 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070009 +XXXXXXXXXX.XXXXXX CKpb612OxJundLAeRf,CcwXC81REVUrKprLz,C5OBjqCVHlPAjKQXi,CI5pddk2aeicnmmoj,Cb7w0T1dHZUPXzdgRi 128.2.5.143 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070010 +XXXXXXXXXX.XXXXXX COvnS21VmREmS5Xzuf,Cb7w0T1dHZUPXzdgRi,CJmTVn4YcEf19Wo137,Cuhrwt2ypWdmhxNcjb,CpKJJiDUPEBNMGSC 128.2.5.139 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070024 +XXXXXXXXXX.XXXXXX C68HZHafWQbOYWkYi,C5II0Z3yZFhDzHSKrl,CQ7b0y4Vd4NVQ3nJRi,CX9xXW3s3cSCaIB9a2,CpKJJiDUPEBNMGSC 128.2.5.135 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070055 +XXXXXXXXXX.XXXXXX CUTgljebkkh2Ydhzi,C1alUz23K74AR4WZUc,CX9xXW3s3cSCaIB9a2,CuIjKg2hEOBmXsIvx4,CsnMLaDyNeIqxq6i2 128.2.5.131 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070029 +XXXXXXXXXX.XXXXXX C1alUz23K74AR4WZUc,CjsoT83JnYI2Be2f8j,C9ywcdnOP5TLfD97e,C7aJ8S1bYoBzPdxRDb,CTISqXQMVxGJCVG2i 128.2.5.127 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070045 +XXXXXXXXXX.XXXXXX CjsoT83JnYI2Be2f8j,CL7JR54e4lOc3aUAph,CohWkh4QvZcB1WXOVe,CS9xQJ3Jly032E9jC2,CPOg0SZxpoHbNzpG5 128.2.5.123 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070022 +XXXXXXXXXX.XXXXXX CIWOQa2vaf6TxyZ2Jg,CqyxRG6TRKYW41Zz5,CPEPje2CwXXxGGPo27,CgYh1L1mwsOxSqVBu9,CPOg0SZxpoHbNzpG5 128.2.5.119 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070009 +XXXXXXXXXX.XXXXXX CqyxRG6TRKYW41Zz5,CalQkN3MoYim6AEEe4,C823dt2fd3qQ26XyU,C3HR3r12iwKiqXa9c,CzZuKd2XEy2jlcWqT6 128.2.5.115 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070012 +XXXXXXXXXX.XXXXXX CceZRf3q969iOibom4,CVgpXQ1plHZSjZoGq9,Cr5ot64fYu8c0wBtik,CPnPwW1vseaFvOVKZc,CzZuKd2XEy2jlcWqT6 128.2.5.111 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070022 +XXXXXXXXXX.XXXXXX CceZRf3q969iOibom4,CeYlkM3WxZVUmujyB9,CkgPZ03tcwpxYjnOSc,Cfv1oI1ypkphPOMD7g,C8yjkq23bmUk9MkLf 128.2.5.107 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070013 +XXXXXXXXXX.XXXXXX CjTrQkID6Z2SNK3ha,CA4o9G1CB2Af4WWhCf,C8yjkq23bmUk9MkLf,CevQX3116xo72LIoK9,ChN5cQ1faCW2xBl8Ki 128.2.5.103 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070021 +XXXXXXXXXX.XXXXXX CPjxvb4XleEtywR72,CjqWgiHlaYFi9YImg,CA4o9G1CB2Af4WWhCf,Cf8FAq4I77xaBMSVT9,C7XVqL2qUJ1enNZYag 128.2.5.99 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070007 +XXXXXXXXXX.XXXXXX CjqWgiHlaYFi9YImg,CAy1xs4SqOffMYYoi6,CbIFhV2t1dFcA47mxb,C3sUxYJbMLLrlkY2l,C1uJul2gbxeDRNFura 128.2.5.95 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070007 +XXXXXXXXXX.XXXXXX CwkPvf43XtOGn09xUb,Cz7T4t4CVp8k2htbIk,Cqn0E64YUKHGEJtXE9,C3sUxYJbMLLrlkY2l,CQKymemsGWxk8qNhi 128.2.5.91 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070023 +XXXXXXXXXX.XXXXXX Cq5Tn24Flxl5ykcPB4,Cx1J5T2RlUHdnWX4P7,C4DpKm2ihMjo33xAK9,CBMc5Bq8xeq3TqHyl,CQKymemsGWxk8qNhi 128.2.5.87 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070006 +XXXXXXXXXX.XXXXXX CauDdy1kS45qWx7Jaf,CwalhH1EmkTCp6Z5oj,CoBPIr1bmfwOHYS8k7,CBMc5Bq8xeq3TqHyl,CeivHI16nJNE1XoDn8 128.2.5.83 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070017 +XXXXXXXXXX.XXXXXX COzc1t4726TvteJAq9,CdHHGD21PDk8qHCNZi,CeivHI16nJNE1XoDn8,Cwks1t1XCX1VVKWlui,CySyNg2Q7X5Wig9qXc 128.2.5.79 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070018 +XXXXXXXXXX.XXXXXX CytmUVLD1AW7Bjdda,CSqd0W3t872JJDPQR7,CyAz9V2XDShWvc9X85,CdHHGD21PDk8qHCNZi,C9mSwv1EoAGeQwdxia 128.2.5.75 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070018 +XXXXXXXXXX.XXXXXX CSqd0W3t872JJDPQR7,CCOssQ1lVW9L4luov7,CHxNzE4i1HGC9aNQb8,CBdUFS64H8SD3CRc7,CXmENaHXj6AAZ6z67 128.2.5.71 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070012 +XXXXXXXXXX.XXXXXX CCOssQ1lVW9L4luov7,CH4Zqaz7LIoXnVdx6,CmYN6N1hsT2MgdKQo9,CCwJVWbbaSCkRe2K9,CkH9U915OzOOjvkSJi 128.2.5.67 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070016 +XXXXXXXXXX.XXXXXX CUN1fq1Nh9yg0qjEZk,CTy7qulV8eG6LkeUd,C3JRhD4EKTLL9ETgB6,CCwJVWbbaSCkRe2K9,CRGnRy2aYiKuVFnIG 128.2.5.63 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070010 +XXXXXXXXXX.XXXXXX CUN1fq1Nh9yg0qjEZk,CsTLYp3UVyKHvvF8jl,Cy1IPuLzKTRb2fGF8,C2sbOw4qh4NrDdHRH2,COJL3m2IFflzZ1Cvdk 128.2.5.59 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070007 +XXXXXXXXXX.XXXXXX CYXkGL3OwfyucBURVl,CfyyuF35s6IHIKaPy1,C6lrWz3udBitB6moKf,CAR8U13yNQoRQJZLcd,COJL3m2IFflzZ1Cvdk 128.2.5.55 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070021 +XXXXXXXXXX.XXXXXX CnB5fj2ShUFnGngqf8,CJBk991FDSqc8wRBK1,CeoHSa1uBAQlDI3FEe,C6lrWz3udBitB6moKf,C850go2IsfiAcSGCfc 128.2.5.51 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070023 +XXXXXXXXXX.XXXXXX CRM6Kv2JvySZyj1qrl,CiZMlr41UYw4zUSiH7,ChDijs42aziwiDYP4c,Car6PO34Q2yGqFhtw8,C850go2IsfiAcSGCfc 128.2.5.47 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070010 +XXXXXXXXXX.XXXXXX C45NxP1qI6S5UMi6Ta,CwUICHbZAZuWABr9,Car6PO34Q2yGqFhtw8,CLvoof1o65FluhXQI6,C73cNq1ss4gZpfV8Jj 128.2.5.43 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070014 +XXXXXXXXXX.XXXXXX CaEkUY1AI0qcJSl8Cd,CBkOwg2KK7rXFXUTmd,CwP7As3BK8V5lwj7D8,CWnddL27sIwroPwU4h,C73cNq1ss4gZpfV8Jj 128.2.5.39 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070010 +XXXXXXXXXX.XXXXXX CBkOwg2KK7rXFXUTmd,C0u03i3hv4B4fSd7zg,CITjhO2n7PZKsy3Mw4,Ci0XPI2JfTjInNGHJ7,CvRIiA3mohju9nTku6 128.2.5.35 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070018 +XXXXXXXXXX.XXXXXX CUAWQS1YtxjDhtxxte,Cgcc4N2eKsv3m3nA87,CvRIiA3mohju9nTku6,CylDMs45x5z5lRx9se,CWT4zv7sNwj1cnBeb 128.2.5.31 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070010 +XXXXXXXXXX.XXXXXX CT4t8k1zeBe7ZRUBg5,CylDMs45x5z5lRx9se,CZvB3g1drtq6h6KP8,CQHUiY2AW9ZT2iB0x8,CBeoy737B8VrP0iSS6 128.2.5.27 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070011 +XXXXXXXXXX.XXXXXX Cs4vHa2laJaNpjym2a,CmVWUQ1Zj8v9tk8Tn9,CzcPSa4HIZVpmSAZQ1,CBeoy737B8VrP0iSS6,CYwHEGkAUO1v9YGk8 128.2.5.23 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070017 +XXXXXXXXXX.XXXXXX CmVWUQ1Zj8v9tk8Tn9,Cyyy781JVg92X5mDUc,CMU7t24bL4QMZtMO2l,Czv7tI2Aq1yfgdryG,CR7XxA2W5vLwE5KTs 128.2.5.19 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070012 +XXXXXXXXXX.XXXXXX CVLeLf3d954JlCj5Ch,CUeKfb4nbjydJsNdId,CmDpIN2aFGjiOMOJWe,CR7XxA2W5vLwE5KTs,C5p9eh4XiSATtqsZi5 128.2.5.15 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070028 +XXXXXXXXXX.XXXXXX CUeKfb4nbjydJsNdId,Cekrs3zkM6eSou1mg,CUVPVWOtpPH13Hfck,CfhuF84Ji7AdXxsAA6,CgfSWCkLmMlaKMWUl 128.2.5.11 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070020 +XXXXXXXXXX.XXXXXX CpDj0c1fnKaDIGyqma,CRYwli4VJ5IlPTDWIl,CguHTc3ErOLWFoQyBa,CgfSWCkLmMlaKMWUl,CF5tR03Af5y0DJD2he 128.2.5.7 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070009 +XXXXXXXXXX.XXXXXX C9xsW63PP2wB8hiDUk,CzWoyC1HE4FO1zdT3a,CbaJQC9l9K3ELB1u1,CF5tR03Af5y0DJD2he,CyVhox28QHRlYRbY9 128.2.5.3 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070009 +XXXXXXXXXX.XXXXXX C57jQA4eBlGbOkJ0xc,COlS4I3p8lZG3vxBag,CimLTH3Vi2F5nxs6Bf,Ch4OGK13MCwxE2a1O9,CyVhox28QHRlYRbY9 128.2.4.255 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070010 +XXXXXXXXXX.XXXXXX CzTeK32euJBRHTY2z5,CoW1ycpevZQjU9uK,CA1qPq3zXlCZGMTF3d,Ch4OGK13MCwxE2a1O9,ClzajT3YA0FYcHeIsi 128.2.4.251 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK,INFORM,ACK,INFORM,ACK,INFORM 0.070024 +XXXXXXXXXX.XXXXXX CoW1ycpevZQjU9uK,C4mAqd3q1os6WQrFGi 128.2.4.250 - 90:b1:1c:99:49:29 - - - - - - - - ACK,INFORM,ACK 0.019997 +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/dhcp/dhcp_flood.pcap b/testing/btest/Traces/dhcp/dhcp_flood.pcap new file mode 100644 index 0000000000000000000000000000000000000000..fef54d6870a8f3b0a245839a55aaf7a286899f14 GIT binary patch literal 165774 zcmeI*dvMg{*~anRkj-u)B*oN13oS>L#h^q16%}H_At5ND5u*i_n}Z|>Dq3nyYmkEy z4izf2rk1t_1d^bUgMxyJ2U1=TJ~&QAU^QFkN7|k-%Mz+%{q@v4z$5H4bMR1Xh!nUSxZ}%=0qcb z-hp6hAdnHrXqvWuLR{!C6XL?H0=)uRfis8K1%nBJ1!+eHHvEed;u0Qd`1dV_hr#j^v9yBYB+E;{@~~L? zSWalsh+D)Dfn}Ol+O*6@+_hyISRN8fAIpUWB+G+f*-0#I@hp;MC$KyymOhs2R+20a zfaRrPX`A+tEH4Gi17hi8c_0+eE#fs`d6`&RZCX6Hh+hVlHDc*w8ObAA?gz`xVrhv* zB+JfVxnC@OEZdfmEcbzBx>#B?MzTx?%Y9<$V|hb8$?`L>yj(1;U$YRmh+httpNXZ9 z<)|JZ?%HxMSY9EP_P_{|8+&v3#>b0=I~N0+!vx(qaQhmfgVe6S4HMJT{(Wxf?966icg{ zN3y&UEO(2gk7c6`B+Ff3d6igN(h-v7RbaVGEPX87rG~jh{9~}ZS}d(&_b_*Dc{Nym zES5f&*+WT|AAx0ev9z42B+Kq#`H@)qSPriuS$+tX*NCMR?j%`W1C}3(rH|#b(?}??4Wqh|pZV}%BmKkDci9<-18DP0X zEPX87O(t1x2g~cl(xR0l%j>~%yIA^IUcZB6xeY8c#nN(4kt{R8a+_HCSdMI+#4Y0Q zf+Y?D$DF^rXQwwDyIR;ciMzJU0?T*B(#LYzSd!&du36fCRc zGBc|&cWwC&SoRZ3%Pu5Y_5;gz#L~xd^lXyl+hCb1mNt47$ubu#-xf zf3dVV2~D^~ygyiO6iXk=^_`k9mOhrdib$60!SY72wCXaF z<&9vuUMzhq<2I2j-vY}4VrgI3lPm{-aJODmj2vb+^6UlU6o%PAEk%Qav*NGxsIc9P{Fuv{aSK9-A5k}Ow)M6touZX3O zWl9anaurzKA(ob!M24I10LxWk>0{Y8o$QIP1k0a_rFG0FS^g9(SBj;NWv^nA<;!3> zSS&4jA<1$uSiUTlK9(b@NtQ2xwLyyTEd}So&D5TS>B929|e=rES_nvb-BCmx-m1q(X`faP$pw0_OVp7?OEd_gRIEXVdBd*aW7aXAz0okmXWO*-GE)+{2%i&cd%jdvy zj96O1PLkyquzXG|eJm%RCRr{3%dui<)7z6h@v&gJKrDSM7v+*Y@%dnRpIBP?IFjXk zU^!nbeJt0Pk}S)>@_w0{Y$B+2qgu$&~87M)45oCKCnilvX`jVnl&zXr?6Vrl(%lPo8L<*&uk$MTW5 z6fQ+N6D+5Qr9Bu;2@DFJjW^F)+Ojk!8fYBNNIn_~^bQ2G1A&Y{M$@#0rDY0O&J@dY zXE~|GHhVak3^&ifq#yr|vuqexzpi9Y{Bf|HA(lRt4-6(*P6x{;#M17aM6!GWET@a5 zk7a2E$#NQ4P8Cb5d!J-E6)dNTrH|$AlO)R$uq+WvThWT_iDO`)60!8LJk*EmiQ|Vq zJWVX^!!aaFEH9y{V(DXivL}wW;leY;(k{;@S>lb}&=j%su^d}Wvc!iL;a`iT-Mo-wiI2rX zlf}}<^3iINB|hQ}KPi?r?l{R3pY((#iKUO_GcCxTI5xzDXNjfF%Orc^*m4z`D3(5! zH3cL~Y#$8I7E4<;i)4uns-efk(#P`PN|GfuTZexmmbPOL$r9W7LleZ($1){>3^(J} zl<-qxX~)vYo;YrP3Kff`kL6GDNS3&fFFZ#qtwj;Z61R$m9u-R;%RXf!OWgJxo-3Ai zMT}&L8|y>A5=$S;;q@d-91;=!tytPk&B&fOjv)#CQY?KeAMQc+#Brof_;+GyqeqY| zacEPhNGyFUAD=<8!~taCr^V8yFDF^zh`Z1uV(DYKd>6?Q$2Epa#nQ@yWVjgzf`)z} zmOhpnJCHqb9Bv!_y;$0&0VGQtpB#EvEPX5wj3-&*DDdzzVrfU_kt}i8eCX$5>0{Y! z1IZHMgzz84(i$HjSt8958ZVYUmYq|{a5FM9;dx?dow}1fafFOQKNCwI%bSOiED_}j z|4}S0cPhye*|*R`V(DW!s)}TZgkktkVrd0CNtTFYh8`44AIr(7NtOt{hW{*0>!#EXlGEEEkKVO`l7$Tnv_lV(DX9xrSs}0G8!qX_Yl3%W|+R5KAA+ZAoOf zc@$Vyh^58S$)0!xSdJ1)AItiDlI1;MSt*uQS4^_31j~EG(#JAk5y^5SSS}GuYqFJO zxdbdnilvWb&l4oe5n%beSX#6t*%N;rEJui?k7aHa*%KcQmM@5<Tp^Yg=}Gp)SAgZ6V(DYqb|lGi2w1)(mez45$?_$z93qxJmVH-{EC++- z%VKH$catn%2Ft->>0^0+TuPu#@N6YF&^Vfre00{*mZdq-NT7Ehm>LLV1TvbYt;d9a z3YIIy(jJPY1O{PX4bQWqIy<&+2A2Kpz|iCguWT5aSe`q}$t|{7|70@UdO0P| zVPH93$)5Nsu)ISoeJn=|CRyGNmamAVjhaNVd<86T7fT<@k_wV#K3KjgmNtDm$?{dO z%oj@^%ZigE%iF+mwOCqZE3zlP8Z2)UOCQUFeaN2pAh28`mbPUK$#M-?4iZZr%epxv z%Ui+nHLA(qxD zpJe$4Sl%L*K9&QENtQQ*>%j6RvGlR5Dj-=70L!<;(kf<=EZ+jl0b=Q6xp^hY@TbWz;c6FT3s616W;)qH;AQ=Wz#&8Wq+{TD3+F3M6%on zmi@)j$1<&qWSI+=Z;PcxV0|laE|O(mu-q(`Rvsk7 z&6~lpuUPt6Zs|bw#QT8d7O}M00Fvbvu%dKG9ODugXqp4)LISVY`6-!I&PWHs#1V#U#s5!LqAZ`dD7Dh-BFXEcb||HQq|H+yj0r4}EUj=A$#Nf9ri-PIGO_fr+*m}iyc8@Ch^58KNR|h{@=~$%vD_CUS#|=;gJNm*^(4!KVA)A5eJqV(DW!CN3q=CU~}z8)zKONIp7iY0J`_Xe7`(5KIjOG6ES*(;7~vkAh{b zSXyB;B`^pBYj~a=)!DIqGqCJ$2liycuo{LYmgmlLN{elll}v`4J7Cgv-*J`=1Iy`3 z_QdPJvV&OqSPmadvb-29zYt3+m_)Mt0xT~UOCQTg6(q}x!19P#+SKhN%OhZUky!dz zE;vcDybvtE6iZvuitLGh36>X%rH|!~K4ee4Jy?DvmR3E6Wcd|Xwiinu%P;1TEZc$Q zQL(hz)g;TKVA)PAeJq1DB+Is7Sud6rNg~6|^6}?T5THH6aO1nwh&7n%TON4@<(8KQYAfaUpO>0{Y8l?*pG1mmWP=Z+cSk7NVvc%hPktSkkSl3{v8^k0$9rUr>pHH&HN4${~v9#J^k|j0~gc^yZk7c7pBui|FiF{8i zEpaQ!5?ii9aboFX+5QB{659tOO~ulpExDd}1RGRCL9z6)%*`Tu;EcJ@qZV~b7%QK DXAe2v literal 0 HcmV?d00001 diff --git a/testing/btest/scripts/base/protocols/dhcp/dhcp-prevent-large-msgtypes.zeek b/testing/btest/scripts/base/protocols/dhcp/dhcp-prevent-large-msgtypes.zeek new file mode 100644 index 0000000000..6cf2b8dce8 --- /dev/null +++ b/testing/btest/scripts/base/protocols/dhcp/dhcp-prevent-large-msgtypes.zeek @@ -0,0 +1,7 @@ +# This tests that DHCP log entries do not contain large numbers +# of msg_types. + +# @TEST-EXEC: zeek -b -r $TRACES/dhcp/dhcp_flood.pcap -e ' redef DHCP::max_uids_per_log_entry=500; redef DHCP::max_msg_types_per_log_entry=8;' %INPUT +# @TEST-EXEC: btest-diff dhcp.log + +@load base/protocols/dhcp diff --git a/testing/btest/scripts/base/protocols/dhcp/dhcp-prevent-large-uids.zeek b/testing/btest/scripts/base/protocols/dhcp/dhcp-prevent-large-uids.zeek new file mode 100644 index 0000000000..a8c7374417 --- /dev/null +++ b/testing/btest/scripts/base/protocols/dhcp/dhcp-prevent-large-uids.zeek @@ -0,0 +1,7 @@ +# This tests that DHCP log entries do not contain large numbers +# of uids. + +# @TEST-EXEC: zeek -b -r $TRACES/dhcp/dhcp_flood.pcap -e ' redef DHCP::max_uids_per_log_entry=5' %INPUT +# @TEST-EXEC: btest-diff dhcp.log + +@load base/protocols/dhcp