mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
789cb376fd
This also installs symlinks from "zeek" and "bro-config" to a wrapper script that prints a deprecation warning. The btests pass, but this is still WIP. broctl renaming is still missing. #239
27 lines
527 B
Text
27 lines
527 B
Text
# @TEST-EXEC: zeek -b -s id -r $TRACES/chksums/ip4-udp-good-chksum.pcap %INPUT >id.out
|
|
# @TEST-EXEC: btest-diff id.out
|
|
|
|
@TEST-START-FILE id.sig
|
|
signature id {
|
|
ip-proto == udp_proto_number
|
|
event "id"
|
|
}
|
|
|
|
signature idtable {
|
|
dst-ip == mynets
|
|
event "idtable"
|
|
}
|
|
@TEST-END-FILE
|
|
|
|
const udp_proto_number = 17;
|
|
|
|
const mynets: set[subnet] = {
|
|
192.168.1.0/24,
|
|
10.0.0.0/8,
|
|
127.0.0.0/24
|
|
};
|
|
|
|
event signature_match(state: signature_state, msg: string, data: string)
|
|
{
|
|
print fmt("signature_match %s - %s", state$conn$id, msg);
|
|
}
|