mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
e11c20e1eb
Changing the default_file_bof_buffer_size has subtle impact on MIME type detection and changed the zeek-testing baseline. Do not load this new script via test-all-policy to avoid this. The new test was mainly an aid to understand what is actually going on. In short, if default_file_bof_buffer_size is larger than the file MIME detection only runs when the buffer is full, or when the file is removed. When a file transfer happens over multiple HTTP connections, only some or one of the http.log entries will have a proper response MIME type. PCAP extracted from 2009-M57-day11-18.trace.gz.
7 lines
635 B
Text
7 lines
635 B
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
uid method host status_code resp_fuids response_body_len resp_mime_types
|
|
CHhAvVGS1DHFjwGM9 GET au.download.windowsupdate.com 206 FJYJFE2AmtoQavCYEh 5473 -
|
|
ClEkJM2Vm5giqnMf4h GET au.download.windowsupdate.com 206 FJYJFE2AmtoQavCYEh 6622 -
|
|
C4J4Th3PJpwUYZZ6gc GET au.download.windowsupdate.com 206 FJYJFE2AmtoQavCYEh 7551 -
|
|
CtPZjS20MLrsMUOJi2 GET au.download.windowsupdate.com 206 FJYJFE2AmtoQavCYEh 11791 -
|
|
CUM0KZ3MLUfNB0cl11 GET au.download.windowsupdate.com 206 FJYJFE2AmtoQavCYEh 8181 application/vnd.ms-cab-compressed
|