mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
aef9fe11dc
Redis seems to only want client data first to request server data. The DPD signature seems to pick up on some cases where server data comes first, but is otherwise "valid" RESP. See if this helps lower FP rates.
14 lines
419 B
Text
14 lines
419 B
Text
# @TEST-DOC: Test that Redis does not parse if it starts with the server data
|
|
#
|
|
# @TEST-EXEC: zeek -Cr $TRACES/redis/start-with-server.pcap base/protocols/redis %INPUT >output
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
event Redis::command(c: connection, is_orig: bool, command: Redis::Command)
|
|
{
|
|
print "BAD", command;
|
|
}
|
|
|
|
event Redis::server_data(c: connection, is_orig: bool, dat: Redis::ServerData)
|
|
{
|
|
print "BAD", dat;
|
|
}
|