mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
177c014cb7
* vlad/topic/vladg/http-verbs: A test for HTTP methods, including some horribly illegal requests. Remove hardcoded HTTP verbs from the analyzer (#741) I added a "bad_HTTP_request" weird for HTTP request lines that don't have more than a single word. Closes #741.
46 lines
3.8 KiB
Text
46 lines
3.8 KiB
Text
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path weird
|
|
#open 2012-12-05-23-27-37
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
|
#types time string addr port addr port string string bool string
|
|
1354328874.278822 k6kgXLOoSKl 128.2.6.136 46564 173.194.75.103 80 bad_HTTP_request - F bro
|
|
1354328874.299063 k6kgXLOoSKl 128.2.6.136 46564 173.194.75.103 80 unmatched_HTTP_reply - F bro
|
|
1354328874.321792 nQcgTWjvg4c 128.2.6.136 46565 173.194.75.103 80 bad_HTTP_request - F bro
|
|
1354328874.342591 nQcgTWjvg4c 128.2.6.136 46565 173.194.75.103 80 unmatched_HTTP_reply - F bro
|
|
1354328882.908690 5OKnoww6xl4 128.2.6.136 46569 173.194.75.103 80 unknown_HTTP_method GET/ F bro
|
|
1354328882.949510 3PKsZ2Uye21 128.2.6.136 46570 173.194.75.103 80 bad_HTTP_request - F bro
|
|
1354328882.968948 3PKsZ2Uye21 128.2.6.136 46570 173.194.75.103 80 unmatched_HTTP_reply - F bro
|
|
1354328887.094494 fRFu0wcOle6 128.2.6.136 46572 173.194.75.103 80 unknown_HTTP_method \xc3\x83\xc3\x82\xc3\x83 F bro
|
|
1354328891.141058 qSsw6ESzHV4 128.2.6.136 46573 173.194.75.103 80 unknown_HTTP_method \xc3\x83\xc3\x82\xc3\x83 F bro
|
|
1354328891.183942 iE6yhOq3SF 128.2.6.136 46574 173.194.75.103 80 unknown_HTTP_method \xc3\x83\xc3\x82\xc3\x83/ F bro
|
|
1354328891.226199 GSxOnSLghOa 128.2.6.136 46575 173.194.75.103 80 bad_HTTP_request - F bro
|
|
1354328891.245592 GSxOnSLghOa 128.2.6.136 46575 173.194.75.103 80 unmatched_HTTP_reply - F bro
|
|
1354328891.267625 qCaWGmzFtM5 128.2.6.136 46576 173.194.75.103 80 unknown_HTTP_method \xc3\x83\xc3\x82\xc3\x83/ F bro
|
|
1354328891.309065 70MGiRM1Qf4 128.2.6.136 46577 173.194.75.103 80 unknown_HTTP_method CCM_POST F bro
|
|
1354328895.355012 h5DsfNtYzi1 128.2.6.136 46578 173.194.75.103 80 unknown_HTTP_method CCM_POST F bro
|
|
1354328895.396634 P654jzLoe3a 128.2.6.136 46579 173.194.75.103 80 unknown_HTTP_method CCM_POST/ F bro
|
|
1354328895.438812 Tw8jXtpTGu6 128.2.6.136 46580 173.194.75.103 80 bad_HTTP_request - F bro
|
|
1354328895.459490 Tw8jXtpTGu6 128.2.6.136 46580 173.194.75.103 80 unmatched_HTTP_reply - F bro
|
|
1354328895.480865 c4Zw9TmAE05 128.2.6.136 46581 173.194.75.103 80 unknown_HTTP_method CCM_POST F bro
|
|
1354328903.614145 0Q4FH8sESw5 128.2.6.136 46584 173.194.75.103 80 unknown_HTTP_method CONNECT/ F bro
|
|
1354328903.656369 slFea8xwSmb 128.2.6.136 46585 173.194.75.103 80 bad_HTTP_request - F bro
|
|
1354328903.676395 slFea8xwSmb 128.2.6.136 46585 173.194.75.103 80 unmatched_HTTP_reply - F bro
|
|
1354328911.832856 BWaU4aSuwkc 128.2.6.136 46589 173.194.75.103 80 unknown_HTTP_method TRACE/ F bro
|
|
1354328911.876341 10XodEwRycf 128.2.6.136 46590 173.194.75.103 80 bad_HTTP_request - F bro
|
|
1354328911.897044 10XodEwRycf 128.2.6.136 46590 173.194.75.103 80 unmatched_HTTP_reply - F bro
|
|
1354328920.052085 0Pwk3ntf8O3 128.2.6.136 46594 173.194.75.103 80 unknown_HTTP_method DELETE/ F bro
|
|
1354328920.094072 0HKorjr8Zp7 128.2.6.136 46595 173.194.75.103 80 bad_HTTP_request - F bro
|
|
1354328920.114526 0HKorjr8Zp7 128.2.6.136 46595 173.194.75.103 80 unmatched_HTTP_reply - F bro
|
|
1354328924.266693 zHqb7t7kv28 128.2.6.136 46599 173.194.75.103 80 unknown_HTTP_method PUT/ F bro
|
|
1354328924.308714 rrZWoMUQpv8 128.2.6.136 46600 173.194.75.103 80 bad_HTTP_request - F bro
|
|
1354328924.328257 rrZWoMUQpv8 128.2.6.136 46600 173.194.75.103 80 unmatched_HTTP_reply - F bro
|
|
1354328924.476011 Rv8AJVfi9Zi 128.2.6.136 46604 173.194.75.103 80 unknown_HTTP_method POST/ F bro
|
|
1354328924.518204 wEyF3OvvcQe 128.2.6.136 46605 173.194.75.103 80 bad_HTTP_request - F bro
|
|
1354328924.537671 wEyF3OvvcQe 128.2.6.136 46605 173.194.75.103 80 unmatched_HTTP_reply - F bro
|
|
1354328932.734579 HFYOnBqSE5e 128.2.6.136 46609 173.194.75.103 80 unknown_HTTP_method HEAD/ F bro
|
|
1354328932.776609 JcUvhfWUMgd 128.2.6.136 46610 173.194.75.103 80 bad_HTTP_request - F bro
|
|
1354328932.796568 JcUvhfWUMgd 128.2.6.136 46610 173.194.75.103 80 unmatched_HTTP_reply - F bro
|
|
#close 2012-12-05-23-27-37
|