mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
3ac877e20d
This is similar to what the external corelight/zeek-smb-clear-state script does, but leverages the smb2_discarded_messages_state() event instead of regularly checking on the state of SMB connections. The pcap was created using the dperson/samba container image and mounting a share with Linux's CIFS filesystem, then copying the content of a directory with 100 files. The test uses a BPF filter to imitate mostly "half-duplex" traffic.
18 lines
875 B
Text
18 lines
875 B
Text
# @TEST-DOC: Pcap contains 100 file transfers (read requests), force BPF filtering such that the responses aren't seen and we have state growth. Verify a low SMB::max_pending_messages triggers, logs a weird and that script-land message state is reset.
|
|
# @TEST-EXEC: zeek -b -C -r $TRACES/smb/smb2_100_small_files.pcap -f 'src port not 445 or tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0' %INPUT >out
|
|
# @TEST-EXEC: btest-diff weird.log
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
@load base/protocols/smb
|
|
|
|
redef SMB::max_pending_messages = 20;
|
|
|
|
event smb2_discarded_messages_state(c: connection, request: string) &priority=10
|
|
{
|
|
print "smb2_discarded_messages_state before", request, |c$smb_state$pending_cmds|;
|
|
}
|
|
|
|
event smb2_discarded_messages_state(c: connection, request: string) &priority=-10
|
|
{
|
|
print "smb2_discarded_messages_state after", request, |c$smb_state$pending_cmds|;
|
|
}
|