-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
14 changed files
with
85 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1 @@ | ||
| module PacketAnalyzer::UDP; | ||
|
|
||
| #event zeek_init() &priority=20 | ||
| # { | ||
| # } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. | ||
| #separator \x09 | ||
| #set_separator , | ||
| #empty_field (empty) | ||
| #unset_field - | ||
| #path conn | ||
| #open XXXX-XX-XX-XX-XX-XX | ||
| #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents | ||
| #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] | ||
| XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 172.17.0.5 45690 1.1.1.1 53 udp dns 0.000158 52 0 S0 T F 0 D 2 108 0 0 ClEkJM2Vm5giqnMf4h | ||
| XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 172.17.0.5 47478 192.0.78.150 80 tcp http 0.090287 72 0 SH T F 0 SADF 6 332 0 0 ClEkJM2Vm5giqnMf4h | ||
| XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.0.107 48282 192.168.5.1 4754 udp - 0.000158 116 0 S0 T T 0 D 2 172 0 0 - | ||
| XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.0.107 49714 192.168.5.1 4754 udp - 0.090287 356 0 S0 T T 0 D 6 524 0 0 - | ||
| #close XXXX-XX-XX-XX-XX-XX |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. | ||
| #separator \x09 | ||
| #set_separator , | ||
| #empty_field (empty) | ||
| #unset_field - | ||
| #path dns | ||
| #open XXXX-XX-XX-XX-XX-XX | ||
| #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id rtt query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs rejected | ||
| #types time string addr port addr port enum count interval string count string count string count string bool bool bool bool count vector[string] vector[interval] bool | ||
| XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 172.17.0.5 45690 1.1.1.1 53 udp 55478 - zeek.org 1 C_INTERNET 1 A - - F F T F 0 - - F | ||
| XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 172.17.0.5 45690 1.1.1.1 53 udp 42431 - zeek.org 1 C_INTERNET 28 AAAA - - F F T F 0 - - F | ||
| #close XXXX-XX-XX-XX-XX-XX |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. | ||
| #separator \x09 | ||
| #set_separator , | ||
| #empty_field (empty) | ||
| #unset_field - | ||
| #path http | ||
| #open XXXX-XX-XX-XX-XX-XX | ||
| #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types | ||
| #types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string] | ||
| XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 172.17.0.5 47478 192.0.78.150 80 1 GET zeek.org / - - curl/7.87.0 - 0 0 - - - - (empty) - - - - - - - - - | ||
| #close XXXX-XX-XX-XX-XX-XX |
11 changes: 11 additions & 0 deletions
11
testing/btest/Baseline/core.tunnels.gre-over-udp/tunnel.log
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. | ||
| #separator \x09 | ||
| #set_separator , | ||
| #empty_field (empty) | ||
| #unset_field - | ||
| #path tunnel | ||
| #open XXXX-XX-XX-XX-XX-XX | ||
| #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action | ||
| #types time string addr port addr port enum enum | ||
| XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.0.107 0 192.168.5.1 0 Tunnel::GRE Tunnel::DISCOVER | ||
| #close XXXX-XX-XX-XX-XX-XX |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,2 @@ | ||
| ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. | ||
| |Analyzer::all_registered_ports()|, 5 | ||
| |Analyzer::all_registered_ports()|, 6 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,2 @@ | ||
| ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. | ||
| |Analyzer::all_registered_ports()|, 5 | ||
| |Analyzer::all_registered_ports()|, 6 |
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # @TEST-EXEC: zeek -b -r $TRACES/tunnels/gre-over-udp-4754.pcap %INPUT | ||
| # @TEST-EXEC: btest-diff conn.log | ||
| # @TEST-EXEC: btest-diff tunnel.log | ||
| # @TEST-EXEC: btest-diff dns.log | ||
| # @TEST-EXEC: btest-diff http.log | ||
| # | ||
| @load base/frameworks/tunnels | ||
| @load base/protocols/conn | ||
| @load base/protocols/dns | ||
| @load base/protocols/http |