zeek/testing/btest/Baseline/scripts.base.protocols.ssl.basic/ssl.log
Jon Siwek e34f6d9e3b Enable GridFTP detection by default. Track/log SSL client certs.
In the *service* field of connection records, GridFTP control channels
are labeled as "gridftp" and data channels as "gridftp-data".

Added *client_subject* and *client_issuer_subject* as &log'd fields to
SSL::Info record.  Also added *client_cert* and *client_cert_chain*
fields to track client cert chain.
2012-10-08 11:38:29 -05:00

10 lines
719 B
Text

#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path ssl
#open 2012-10-08-16-18-56
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher server_name session_id subject issuer_subject not_valid_before not_valid_after last_alert client_subject client_issuer_subject
#types time string addr port addr port string string string string string string time time string string string
1335538392.319381 UWkUyAuUGXf 192.168.1.105 62045 74.125.224.79 443 TLSv10 TLS_ECDHE_RSA_WITH_RC4_128_SHA ssl.gstatic.com - CN=*.gstatic.com,O=Google Inc,L=Mountain View,ST=California,C=US CN=Google Internet Authority,O=Google Inc,C=US 1334102677.000000 1365639277.000000 - - -
#close 2012-10-08-16-18-56