zeek/testing/btest/scripts/base/protocols/ssh/one-auth-fail-only.test at 176d9f23be753c21936b28889d507719f3059c78 - Mirror/zeek - git.uphillsecurity.com: We code.

Mirror/zeek

mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00

Robin Sommer 176d9f23be Fixing duplicate SSH authentication failure events.

We now do not raise more than one failure event per connection.

Addresses BIT-1641.

2016-08-01 12:42:03 -07:00

7 lines

181 B

Text

Raw Blame History

 # @TEST-EXEC: bro -C -r $TRACES/ssh/sshguess.pcap %INPUT | sort | uniq -c >output
 # @TEST-EXEC: btest-diff output
 event ssh_auth_failed(c: connection)
     {
     print c$uid;
     }