zeek/testing/btest/Baseline/scripts.base.frameworks.notice.file-info-multiple-conns/notice.log
Arne Welzel 1e06c8bfda frameworks/notice: Handle fa_file with no or more than a single connection better
* When a file is transferred over multiple connection, have
  create_file_info() just pick the first one instead of none.

* Do not unconditionally assume cid and cuid as set on a
  Notice::FileInfo object.
2022-12-06 11:17:30 +01:00

11 lines
779 B
Text

### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path notice
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions email_dest suppress_for
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] set[string] interval
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 48768 127.0.0.1 8080 FDXrtA2UOyNDs2wzk8 text/plain http://localhost:8080:8080/zeek.txt tcp NoticeTestType test - 127.0.0.1 127.0.0.1 8080 - - Notice::ACTION_LOG (empty) 3600.000000
#close XXXX-XX-XX-XX-XX-XX