zeek/testing/btest/scripts/base/protocols/ssh/one-auth-fail-only.test

7 lines
176 B
Text

# @TEST-EXEC: bro -C -r $TRACES/ssh/sshguess.pcap %INPUT | sort >output
# @TEST-EXEC: btest-diff output
event SSH::ssh_auth_failed(c: connection)
{
print c$uid;
}