zeek/testing/btest/core/tcp
Robin Sommer 39734255be Change TCP analysis to process connections without the initial SYN as
non-partial connections.

Before, if we saw a responder-side SYN/ACK, but had not seen the
initial orginator-side SYN, Bro would treat the connection as partial,
meaning that most application-layer analyzers would refuse to inspect
the payload. That was unfortunate because all payload data was
actually there (and even passed to the analyzers). This change make
Bro consider these connections as complete, so that analyzers will
just normally process them.

The leads to couple more connections in the test-suite to now being
analyzed.

Addresses #1492. (I used an HTTP trace for debugging instead of the
HTTPS trace from the ticket, as the clear-text makes it easier to
track the data flow).
2016-07-11 17:18:32 -07:00
..
fin-retransmit.bro Improve TCP FIN retransmission handling. 2014-01-24 15:51:58 -06:00
large-file-reassembly.bro Fix reassembly of data w/ sizes beyond 32-bit capacities (BIT-348). 2014-04-09 13:03:24 -05:00
miss-end-data.bro Improve gap reporting in TCP connections that never see data. 2014-01-24 16:21:02 -06:00
missing-syn.bro Change TCP analysis to process connections without the initial SYN as 2016-07-11 17:18:32 -07:00
quantum-insert.bro Extending rexmit_inconsistency() event to receive an additional 2015-10-26 14:16:08 -07:00
rst-after-syn.bro Fix a case where c$resp$size is misrepresented. Addresses #730. 2012-12-14 17:08:50 -06:00
rxmit-history.bro Flagging retransmissions in connection history. 2016-07-06 15:01:16 -07:00
truncated-header.bro Fix potential crash TCP headers were captured incompletely. 2015-08-30 18:49:05 -07:00