mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
eff11c5ef4
- Minor whitespace/format adjustments * 'network-time-init' of https://github.com/J-Gras/zeek: Fix documentation for network_time_init. Improve network_time_init() test and add baseline. Add network_time_init() event. Add test for network_time behavior.
54 lines
1.2 KiB
Text
54 lines
1.2 KiB
Text
# @TEST-EXEC: zeek -b -C -r $TRACES/wikipedia.trace %INPUT > output
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
redef exit_only_after_terminate = T;
|
|
|
|
global sde_init: bool = F;
|
|
|
|
event scheduled_delayed_event()
|
|
{
|
|
if ( ! sde_init )
|
|
{
|
|
# When network_time is set we (usually) leap forward and the event
|
|
# fires with the first packet. Thus, we reschedule.
|
|
sde_init = T;
|
|
schedule 2sec { scheduled_delayed_event() };
|
|
}
|
|
else
|
|
{
|
|
print fmt("scheduled_delayed_event: %T", network_time());
|
|
}
|
|
}
|
|
|
|
event scheduled_event()
|
|
{
|
|
# This event is immediately executed
|
|
print fmt("scheduled_event: %T", network_time());
|
|
}
|
|
|
|
event zeek_init()
|
|
{
|
|
# Reading a PCAP network_time is not initialized yet
|
|
print fmt("zeek_init: %T", network_time());
|
|
schedule 0sec { scheduled_event() };
|
|
schedule 2sec { scheduled_delayed_event() };
|
|
}
|
|
|
|
event network_time_init()
|
|
{
|
|
# This event is executed when network_time is initialized
|
|
print fmt("network_time_init: %T", network_time());
|
|
}
|
|
|
|
global pkt_count: count = 0;
|
|
|
|
event new_packet(c: connection, p: pkt_hdr) &priority=10
|
|
{
|
|
pkt_count += 1;
|
|
|
|
if ( pkt_count % 25 == 0 )
|
|
print fmt("Processing packet %s at %T", pkt_count, network_time());
|
|
|
|
if ( pkt_count == 100)
|
|
terminate();
|
|
}
|