mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 07:38:19 +00:00
3ac877e20d
This is similar to what the external corelight/zeek-smb-clear-state script does, but leverages the smb2_discarded_messages_state() event instead of regularly checking on the state of SMB connections. The pcap was created using the dperson/samba container image and mounting a share with Linux's CIFS filesystem, then copying the content of a directory with 100 files. The test uses a BPF filter to imitate mostly "half-duplex" traffic. |
||
|---|---|---|
| .. | ||
| base | ||
| policy | ||
| site | ||
| zeekygen | ||
| CMakeLists.txt | ||
| test-all-policy.zeek | ||