mirror of
https://github.com/zeek/zeek.git
synced 2025-10-01 22:28:20 +00:00
8efddf87d9
This makes a change to the record for smb1-negotiate-response as well. Times and dates are two 2-byte sections, not three. Switch the parsing to just use two uint16s, and pass those into the lanman time conversion function.
61 lines
No EOL
3.1 KiB
Text
61 lines
No EOL
3.1 KiB
Text
These are the trace files that are used by the Zeek test suite.
|
|
|
|
Note to maintainers: please take care when modifying/removing files from here.
|
|
We install these traces with the Zeek distribution and external packages might
|
|
depend on them for tests.
|
|
|
|
Trace Index/Sources:
|
|
|
|
- modbus/modbus-eit.trace:
|
|
Sourced from https://www.netresec.com/?page=PCAP4SICS, credit to https://cs3sthlm.se/.
|
|
The packets in this trace were pulled from the 4SICS-GeekLounge-151021.pcap file.
|
|
- [ldap/simpleauth.pcap](https://github.com/arkime/arkime/blob/main/tests/pcap/ldap-simpleauth.pcap)
|
|
- ldap/simpleauth-diff-port.pcap: made with
|
|
`tcprewrite -r 3268:32681 -i simpleauth.pcap -o simpleauth-diff-port.pcap`
|
|
- ldap/krb5-sign-seal-01.pcap: trace is derived from
|
|
<https://wiki.wireshark.org/uploads/__moin_import__/attachments/SampleCaptures/ldap-krb5-sign-seal-01.cap>
|
|
- the LDAP flow selected (filtered out the Kerberos packets)
|
|
- truncated to 10 packets (where packet 10 contains the SASL encrypted LDAP message)
|
|
- one `\x30` byte in the ciphertext changed to `\x00`
|
|
- ldap/issue-32.pcapng: Provided by GH user martinvanhensbergen,
|
|
<https://github.com/zeek/spicy-ldap/issues/23>
|
|
- ldap/ctu-sme-11-win7ad-1-ldap-tcp-50041.pcap: Harvested from CTU-SME-11
|
|
(Experiment-VM-Microsoft-Windows7AD-1) dataset, filtering on tcp port 389 and port 50041.
|
|
https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).
|
|
- ldap/ldap_invalid_credentials.pcap
|
|
Provided by Martin van Hensbergen in issue #3919.
|
|
- dns/tkey.pcap: Harvested from CTU-SME-11
|
|
(Experiment-VM-Microsoft-Windows7AD-1) dataset, filtering on tcp port 53.
|
|
https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).
|
|
- dns/dynamic-update.pcap: : Harvested from CTU-SME-11
|
|
(Experiment-VM-Microsoft-Windows7AD-1) dataset, filtering on tcp port 53.
|
|
https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).
|
|
- pop3/POP3.pcap: Picked up from POP tutorial on tranalyzer.com
|
|
https://tranalyzer.com/tutorial/pop
|
|
https://tranalyzer.com/download/data/pop3.pcap
|
|
- http/cooper-grill-dvwa.pcapng
|
|
Provided by cooper-grill on #3995
|
|
https://github.com/zeek/zeek/pull/3995
|
|
- http/docker-http-upgrade.pcap
|
|
Provided by blightzero on #4068
|
|
https://github.com/zeek/zeek/issues/4068
|
|
- quic/merlinc2_Zeek_example.pcapng
|
|
Provided by Faan Rossouw on #4198
|
|
https://github.com/zeek/zeek/issues/4198
|
|
- pe/pe.trace
|
|
VirusTotal reports that this file contains malware. The PE analyzer was originally added
|
|
to decode info for malware, so this is expected. See
|
|
https://zeekorg.slack.com/archives/CSZBXF6TH/p1738261449655049
|
|
- tunnels/geneve-tagged-udp-packet.pcap
|
|
Provided by Eldon Koyle Corelight for testing.
|
|
- cdp-v1.pcap
|
|
From the Wireshark library of captures at https://wiki.wireshark.org/samplecaptures.
|
|
- ldap/adduser1.pcap ldap/adduser1-ntlm.pcap
|
|
Provided by Mohan-Dhawan on #4275
|
|
https://github.com/zeek/zeek/issues/4275
|
|
- smb_v2_only_non_zero_reserved1.pcap
|
|
Provided by @predator89090 on #4730
|
|
https://github.com/zeek/zeek/issues/4730
|
|
- smb/cifs_negotiate_lanman.pcap
|
|
Generated with scapy/chatgpt by @Mohan-Dhawan
|
|
https://github.com/zeek/zeek/issues/4545 |