mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 16:18:19 +00:00
99db264775
- Fix for time-as-int on 32-bit systems.
- Skipping ds2txt's index output for test diffing, as it seems
non-portable.
81 lines
4.2 KiB
Text
81 lines
4.2 KiB
Text
# Extent Types ...
|
|
<ExtentType name="DataSeries: ExtentIndex">
|
|
<field type="int64" name="offset" />
|
|
<field type="variable32" name="extenttype" />
|
|
</ExtentType>
|
|
|
|
<ExtentType name="DataSeries: XmlType">
|
|
<field type="variable32" name="xmltype" />
|
|
</ExtentType>
|
|
|
|
<ExtentType name="http" version="1.0" namespace="bro-ids.org">
|
|
<field type="double" name="ts" pack_relative="ts" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
|
<field type="variable32" name="uid" pack_unique="yes"/>
|
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
|
<field type="int64" name="id.orig_p" />
|
|
<field type="variable32" name="id.resp_h" pack_unique="yes"/>
|
|
<field type="int64" name="id.resp_p" />
|
|
<field type="int64" name="trans_depth" />
|
|
<field type="variable32" name="method" pack_unique="yes"/>
|
|
<field type="variable32" name="host" pack_unique="yes"/>
|
|
<field type="variable32" name="uri" pack_unique="yes"/>
|
|
<field type="variable32" name="referrer" pack_unique="yes"/>
|
|
<field type="variable32" name="user_agent" pack_unique="yes"/>
|
|
<field type="int64" name="request_body_len" />
|
|
<field type="int64" name="response_body_len" />
|
|
<field type="int64" name="status_code" />
|
|
<field type="variable32" name="status_msg" pack_unique="yes"/>
|
|
<field type="int64" name="info_code" />
|
|
<field type="variable32" name="info_msg" pack_unique="yes"/>
|
|
<field type="variable32" name="filename" pack_unique="yes"/>
|
|
<field type="variable32" name="tags" pack_unique="yes"/>
|
|
<field type="variable32" name="username" pack_unique="yes"/>
|
|
<field type="variable32" name="password" pack_unique="yes"/>
|
|
<field type="variable32" name="proxied" pack_unique="yes"/>
|
|
<field type="variable32" name="mime_type" pack_unique="yes"/>
|
|
<field type="variable32" name="md5" pack_unique="yes"/>
|
|
<field type="variable32" name="extraction_file" pack_unique="yes"/>
|
|
</ExtentType>
|
|
<!-- ts : time -->
|
|
<!-- uid : string -->
|
|
<!-- id.orig_h : addr -->
|
|
<!-- id.orig_p : port -->
|
|
<!-- id.resp_h : addr -->
|
|
<!-- id.resp_p : port -->
|
|
<!-- trans_depth : count -->
|
|
<!-- method : string -->
|
|
<!-- host : string -->
|
|
<!-- uri : string -->
|
|
<!-- referrer : string -->
|
|
<!-- user_agent : string -->
|
|
<!-- request_body_len : count -->
|
|
<!-- response_body_len : count -->
|
|
<!-- status_code : count -->
|
|
<!-- status_msg : string -->
|
|
<!-- info_code : count -->
|
|
<!-- info_msg : string -->
|
|
<!-- filename : string -->
|
|
<!-- tags : table[enum] -->
|
|
<!-- username : string -->
|
|
<!-- password : string -->
|
|
<!-- proxied : table[string] -->
|
|
<!-- mime_type : string -->
|
|
<!-- md5 : string -->
|
|
<!-- extraction_file : file -->
|
|
|
|
# Extent, type='http'
|
|
ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
|
1300475168.843894 j4u32Pc5bif 141.142.220.118 48649 208.80.152.118 80 0 0 0 304 Not Modified 0
|
|
1300475168.975800 c4Zw9TmAE05 141.142.220.118 49997 208.80.152.3 80 0 0 0 304 Not Modified 0
|
|
1300475168.976327 EAr0uf4mhq 141.142.220.118 49996 208.80.152.3 80 0 0 0 304 Not Modified 0
|
|
1300475168.979160 GvmoxJFXdTa 141.142.220.118 49998 208.80.152.3 80 0 0 0 304 Not Modified 0
|
|
1300475169.012666 0Q4FH8sESw5 141.142.220.118 50000 208.80.152.3 80 0 0 0 304 Not Modified 0
|
|
1300475169.012730 slFea8xwSmb 141.142.220.118 49999 208.80.152.3 80 0 0 0 304 Not Modified 0
|
|
1300475169.014860 UfGkYA2HI2g 141.142.220.118 50001 208.80.152.3 80 0 0 0 304 Not Modified 0
|
|
1300475169.022665 i2rO3KD1Syg 141.142.220.118 35642 208.80.152.2 80 0 0 0 304 Not Modified 0
|
|
1300475169.036294 c4Zw9TmAE05 141.142.220.118 49997 208.80.152.3 80 0 0 0 304 Not Modified 0
|
|
1300475169.036798 EAr0uf4mhq 141.142.220.118 49996 208.80.152.3 80 0 0 0 304 Not Modified 0
|
|
1300475169.039923 GvmoxJFXdTa 141.142.220.118 49998 208.80.152.3 80 0 0 0 304 Not Modified 0
|
|
1300475169.074793 0Q4FH8sESw5 141.142.220.118 50000 208.80.152.3 80 0 0 0 304 Not Modified 0
|
|
1300475169.074938 slFea8xwSmb 141.142.220.118 49999 208.80.152.3 80 0 0 0 304 Not Modified 0
|
|
1300475169.075065 UfGkYA2HI2g 141.142.220.118 50001 208.80.152.3 80 0 0 0 304 Not Modified 0
|