mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
e2dc0092f3
* 'ntp-rewrite' of https://github.com/mauropalumbo75/zeek: (25 commits) update tests baseline Apply requested changes: - file dpd.sig and TODO comments for signature protocol detection removed - missing doc field filled in events.bif - rename OpCode and ReqCode fields into op_code and req_code respectively - removed unnecessary child method in NTP.h/.cc - main.zeek and ntp-protocol.pac reformatted minor changes in the documentation fix some initializations fix wrong assignment of control key_id/crypto_checksum code clean up add extension fields parsing add extended mac field with 20 byte digest (+4 byte key id) update tests and add a new one for key_id and mac fix auth field (key_id and mac) in standard and control msg remove old NTP record in init-bare.zeek fix key_id and digest (WIP) fix wrong Assign with reference_id add tests for ntp protocol (finished) add tests for ntp protocol (WIP) fix problem with time vals add ntp records to init-bare.zeek update ntp analyzer to val_mgr extend and refact script-side of NTP analyzer extend and refactor several fields ...
49 lines
8.5 KiB
Text
49 lines
8.5 KiB
Text
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path ntp
|
|
#open 2019-06-16-00-50-01
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version mode stratum poll precision root_delay root_disp ref_id ref_time org_time rec_time xmt_time num_exts
|
|
#types time string addr port addr port count count count interval interval interval interval string time time time time count
|
|
1495804929.483801 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.026230 182.165.128.219 1495804247.476651 0.000000 0.000000 1495804929.482904 0
|
|
1495804987.484143 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.027100 182.165.128.219 1495804247.476651 0.000000 0.000000 1495804987.483591 0
|
|
1495805006.484270 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.027374 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805006.483955 0
|
|
1495805043.485165 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.027939 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805043.484331 0
|
|
1495805081.485865 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.028503 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805081.484917 0
|
|
1495805105.485765 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.028870 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805105.485150 0
|
|
1495805159.486908 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.029678 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805159.485867 0
|
|
1495805203.487540 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.030334 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805203.486536 0
|
|
1495805207.487345 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.030396 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805207.486593 0
|
|
1495805256.488426 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.031128 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805256.487243 0
|
|
1495805279.488216 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.031479 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805279.487564 0
|
|
1495805330.489109 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.032242 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805330.488240 0
|
|
1495805357.489015 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.032639 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805357.488596 0
|
|
1495805382.489247 CHhAvVGS1DHFjwGM9 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.033020 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805382.488826 0
|
|
1495805442.490416 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.033920 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805442.489609 0
|
|
1495805451.490156 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.034058 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805451.489738 0
|
|
1495805453.490234 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.034088 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805453.489803 0
|
|
1495805461.490303 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.034210 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805461.489877 0
|
|
1495805478.490697 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.034454 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805478.490201 0
|
|
1495805504.491041 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.034851 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805504.490512 0
|
|
1495805532.491194 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.035263 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805532.490810 0
|
|
1495805537.491291 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.035339 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805537.490953 0
|
|
1495805571.492008 ClEkJM2Vm5giqnMf4h 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.035858 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805571.491412 0
|
|
1495805634.493022 C4J4Th3PJpwUYZZ6gc 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.036804 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805634.492157 0
|
|
1495805644.492819 C4J4Th3PJpwUYZZ6gc 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.036942 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805644.492282 0
|
|
1495805696.493954 C4J4Th3PJpwUYZZ6gc 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.037735 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805696.492977 0
|
|
1495805758.494168 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.038666 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805758.493804 0
|
|
1495805776.494105 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.038925 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805776.494147 0
|
|
1495805815.494785 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.039520 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805815.494543 0
|
|
1495805864.495551 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.040253 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805864.495286 0
|
|
1495805865.495215 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.040268 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805865.495321 0
|
|
1495805916.496467 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.041031 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805916.495973 0
|
|
1495805964.497107 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.041748 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805964.496596 0
|
|
1495805992.497281 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.042175 182.165.128.219 1495804247.476651 0.000000 0.000000 1495805992.496969 0
|
|
1495806035.498089 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.042816 182.165.128.219 1495804247.476651 0.000000 0.000000 1495806035.497545 0
|
|
1495806055.497837 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.043106 182.165.128.219 1495804247.476651 0.000000 0.000000 1495806055.497725 0
|
|
1495806069.497947 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.043320 182.165.128.219 1495804247.476651 0.000000 0.000000 1495806069.497937 0
|
|
1495806080.498110 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.043488 182.165.128.219 1495804247.476651 0.000000 0.000000 1495806080.498132 0
|
|
1495806100.498331 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.043793 182.165.128.219 1495804247.476651 0.000000 0.000000 1495806100.498395 0
|
|
1495806130.498492 CtPZjS20MLrsMUOJi2 2003:51:6012:121::2 123 2003:51:6012:110::dcf7:123 123 4 3 2 64.000000 0.000000 0.002213 0.044235 182.165.128.219 1495804247.476651 0.000000 0.000000 1495806130.498813 0
|
|
#close 2019-06-16-00-50-01
|