mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 07:38:19 +00:00
50cf694aae
The link-layer addresses are now part of the connection endpoints following the originator-responder-pattern. The addresses are printed with leading zeros. Additionally link-layer addresses are also extracted for 802.11 plus RadioTap.
11 lines
321 B
Text
11 lines
321 B
Text
# @TEST-EXEC: bro -C -b -r $TRACES/wikipedia.trace %INPUT >>output
|
|
# @TEST-EXEC: bro -C -b -r $TRACES/radiotap.pcap %INPUT >>output
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
event new_connection(c: connection)
|
|
{
|
|
if ( c$orig?$l2_addr && c$resp?$l2_addr )
|
|
print c$orig$l2_addr, c$resp$l2_addr;
|
|
else
|
|
print "-", "-";
|
|
}
|