mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 19:18:19 +00:00
5f3af9e9eb
This option indicates that the Teredo analyzer should wait until it sees both sides of a connection using a valid Teredo encapsulation before issuing a protocol_confirmation. Previous behavior confirmed on the first instance of a valid encapsulation, which could result in more false positives (and e.g. bogus entries in known-services.log). Addresses #890.
11 lines
815 B
Text
11 lines
815 B
Text
# @TEST-EXEC: bro -b -r $TRACES/tunnels/false-teredo.pcap base/frameworks/dpd protocols/conn/known-services Tunnel::delay_teredo_confirmation=T "Site::local_nets+={192.168.1.0/24}"
|
|
# @TEST-EXEC: test ! -e known_services.log
|
|
# @TEST-EXEC: bro -b -r $TRACES/tunnels/false-teredo.pcap base/frameworks/dpd protocols/conn/known-services Tunnel::delay_teredo_confirmation=F "Site::local_nets+={192.168.1.0/24}"
|
|
# @TEST-EXEC: btest-diff known_services.log
|
|
|
|
# The first case using Tunnel::delay_teredo_confirmation=T doesn't produce
|
|
# a known services.log since valid Teredo encapsulations from both endpoints
|
|
# of a connection is never witnessed and a protocol_confirmation never issued.
|
|
|
|
# The second case issues protocol_confirmations more hastily and so bogus
|
|
# entries in known-services.log are more likely to appear.
|