# @TEST-DOC: Reproduce the first BDAT example from RFC3030. # # @TEST-EXEC: zeek -b -r $TRACES/smtp/rfc3030-bdat-example1.pcap %INPUT >out # @TEST-EXEC: zeek-cut -m uid id.orig_h id.orig_p id.resp_h id.resp_p service duration < conn.log > conn.log.cut # @TEST-EXEC: btest-diff out # @TEST-EXEC: btest-diff conn.log.cut # @TEST-EXEC: btest-diff smtp.log # @TEST-EXEC: test ! -f weird.log @load base/protocols/conn @load base/protocols/smtp event smtp_request(c: connection, is_orig: bool, command: string, arg: string) { print c$uid, is_orig, command, arg; }