mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
ac7bbe6949
This changes service set in the connection record, and thus also the conn.log service field to being ordered. Speficically, the order of the entries in the service field will be the same order in which protocols will be confirmed. This means that it now is possible to see which protocols were layered over each other in which order by looking at the respective conn.log entry.
12 lines
925 B
Text
12 lines
925 B
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path conn
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents ip_proto
|
|
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] count
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.57.103 60108 192.168.57.101 2811 tcp ftp,ssl,gridftp 0.294743 4491 6659 SF T T 0 ShAdDaFf 22 5643 21 7759 - 6
|
|
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.57.103 35391 192.168.57.101 55968 tcp ssl,gridftp-data 0.010760 2109 3196 S1 T T 0 ShADad 7 2481 6 3516 - 6
|
|
#close XXXX-XX-XX-XX-XX-XX
|