zeek/testing
Tim Wojtulewicz f7e3556a67 Store a single map of Sessions instead of split maps of Connections.
This commit also includes:
- Storing the transport protocol in ConnID and ConnIDKey to allow tcp and
  udp connections from the same IP/Port combinations. This happens in the
  core.cisco-fabric-path test, for example.
- Lots of test updates. The reasons for these are two fold. First, with
  the change to only store a single map means that TCP, UDP, and ICMP
  connections are now mixed. When Zeek drains the map at shutdown, it drains
  each of those protocols together instead of separately. The second is
  because of how Sessions are stored in the map. We're now storing them
  keyed by the hash of the key stored by the Session objects, which causes
  them to again be in the map in a different order.
2021-04-29 10:24:45 -07:00
..
btest Store a single map of Sessions instead of split maps of Connections. 2021-04-29 10:24:45 -07:00
coverage Add a script to cleanup the file listing before sending to Coveralls 2021-02-09 23:07:47 +00:00
external Merge remote-tracking branch 'origin/topic/seth/fix-smb-ts-fields' 2021-03-11 12:44:04 -08:00
scripts Remove newline-eof canonification attempt in diff-remove-timestamps 2021-03-30 16:04:34 -07:00
.gitignore
Makefile Added coverage to .PHONY in Makefile due to testing/coverage 2018-07-30 12:17:40 -07:00
README More bro-to-zeek renaming in the unit tests 2019-05-16 02:27:54 -05:00

This directory contains suites for testing for Zeek's correct
operation:

    btest/
        An ever-growing set of small unit tests testing Zeek's
        functionality.

    external/
        A framework for downloading additional test sets that run more
        complex Zeek configuration on larger traces files. Due to their
        size, these are not included directly. See the README for more
        information. 

    scripts/
        Helpers scripts used by some tests.