mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 23:28:20 +00:00
056b70bd2d
* origin/topic/awelzel/community-id-new-connection:
policy/community-id: Populate conn$community_id in new_connection()
(cherry picked from commit d3579c1f34)
13 lines
474 B
Text
13 lines
474 B
Text
# @TEST-DOC: Ensure community_id is logged even if the connection is flipped.
|
|
|
|
# @TEST-EXEC: zeek -b -r $TRACES/tcp/handshake-reorder.trace %INPUT >out
|
|
# @TEST-EXEC: zeek-cut id.orig_h id.orig_p id.resp_h id.resp_p proto service community_id < conn.log > conn.log.cut
|
|
# @TEST-EXEC: btest-diff out
|
|
# @TEST-EXEC: btest-diff conn.log.cut
|
|
|
|
@load protocols/conn/community-id-logging
|
|
|
|
event new_connection(c: connection)
|
|
{
|
|
print "new_connection", c$uid, c$conn$community_id;
|
|
}
|