mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
11 lines
No EOL
309 B
Text
11 lines
No EOL
309 B
Text
# @TEST-DOC: Test that raw_packet works correctly with a truncated packet
|
|
# @TEST-EXEC: zeek -r $TRACES/trunc/trunc-hdr.pcap %INPUT
|
|
# @TEST-EXEC: btest-diff weird.log
|
|
|
|
event raw_packet(p: raw_pkt_hdr) {
|
|
if ( ! p?$ip )
|
|
return;
|
|
|
|
if ( p$ip$hl != 20 )
|
|
print p$ip;
|
|
} |