mirror of
https://github.com/zeek/zeek.git
synced 2025-10-14 12:38:20 +00:00
c151a25843
Patch by Eric Karasuda. I slightly tweaked the patch to not need a new member variable. Also turned the provided trace into a test case.
10 lines
321 B
Text
10 lines
321 B
Text
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path tunnel
|
|
#open 2015-10-23-20-09-55
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
|
#types time string addr port addr port enum enum
|
|
1443732977.848660 - ::1 0 ::1 80 Tunnel::HTTP Tunnel::DISCOVER
|
|
#close 2015-10-23-20-09-55
|