mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
04a1ead978
As initial examples, this branch ports the Syslog and Finger analyzers over. We leave the old analyzers in place for now and activate them iff we compile without any Spicy. Needs `zeek-spicy-infra` branches in `spicy/`, `spicy-plugin/`, `CMake/`, and `zeek/zeek-testing-private`. Note that the analyzer events remain associated with the Spicy plugin for now: that's where they will show up with `-NN`, and also inside the Zeekygen documentation. We switch CMake over to linking the runtime library into the plugin, vs. at the top-level through object libraries.
18 lines
465 B
Text
18 lines
465 B
Text
# @TEST-EXEC: zeek -r $TRACES/finger/standard.pcap %INPUT >>output
|
|
# @TEST-EXEC: zeek -r $TRACES/finger/verbose.pcap %INPUT >>output
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
global resp_lines = 0;
|
|
|
|
event finger_request(c: connection, full: bool, username: string, hostname: string)
|
|
{
|
|
print "request", c$id, full, username, hostname;
|
|
}
|
|
|
|
event finger_reply(c: connection, reply_line: string)
|
|
{
|
|
if ( ++resp_lines >= 5 )
|
|
return;
|
|
|
|
print "response", c$id, reply_line;
|
|
}
|