mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
16 lines
589 B
Text
16 lines
589 B
Text
# @TEST-DOC: IPv6 connection from external ipv6.pcap triggering FTP analyzer violation. Check dpd.log contains the right packet_segment
|
|
# @TEST-EXEC: zeek -r $TRACES/ftp/ipv6-violation.trace %INPUT
|
|
# @TEST-EXEC: btest-diff dpd.log
|
|
|
|
@load frameworks/dpd/packet-segment-logging
|
|
|
|
event analyzer_violation(c: connection, atype: AllAnalyzers::Tag, aid: count, reason: string)
|
|
{
|
|
print "analyzer_violation", c$id, atype, aid, reason;
|
|
}
|
|
|
|
event analyzer_violation_info(tag: AllAnalyzers::Tag, info: AnalyzerViolationInfo)
|
|
{
|
|
print "reason", info$reason;
|
|
print "data", fmt("%s", info$data);
|
|
}
|