zeek/testing
Arne Welzel e11c20e1eb test-all-policy: Do not load iso-9660.zeek
Changing the default_file_bof_buffer_size has subtle impact on
MIME type detection and changed the zeek-testing baseline. Do
not load this new script via test-all-policy to avoid this.

The new test was mainly an aid to understand what is actually going on.
In short, if default_file_bof_buffer_size is larger than the file MIME
detection only runs when the buffer is full, or when the file is removed.
When a file transfer happens over multiple HTTP connections, only
some or one of the http.log entries will have a proper response MIME type.

PCAP extracted from 2009-M57-day11-18.trace.gz.
2024-02-26 17:58:26 +01:00
..
benchmark/broker Port Zeek to latest Broker API 2022-04-27 23:02:27 +02:00
btest test-all-policy: Do not load iso-9660.zeek 2024-02-26 17:58:26 +01:00
builtin-plugins Reformat Zeek in Spicy style 2023-10-30 09:40:55 +01:00
coverage Remove files in build/src/3rdparty from coverage reports 2023-02-09 12:04:53 -07:00
external Merge remote-tracking branch 'origin/topic/awelzel/ftp-clear-fuid-after-logging' 2024-02-22 12:23:21 +01:00
scripts spicy/diff-remove-timestamp: Fix missing -e 2024-01-31 14:06:32 +01:00
.gitignore
CMakeLists.txt Integrate the Spicy plugin into Zeek proper. 2023-05-16 10:17:45 +02:00
Makefile
README

This directory contains suites for testing for Zeek's correct
operation:

    btest/
        An ever-growing set of small unit tests testing Zeek's
        functionality.

    external/
        A framework for downloading additional test sets that run more
        complex Zeek configuration on larger traces files. Due to their
        size, these are not included directly. See the README for more
        information. 

    scripts/
        Helpers scripts used by some tests.