15 lines
446 B
Plaintext
15 lines
446 B
Plaintext
# @TEST-EXEC: zcat <$TRACES/smb/smb_many_open_files_500.pcap.gz | zeek -b -Cr - %INPUT
|
|
# @TEST-DOC: Regression test #3523; no output check, just shouldn't crash
|
|
|
|
redef table_expire_delay = 0.1sec;
|
|
redef table_incremental_step = 1;
|
|
redef table_expire_interval = 0.1sec;
|
|
|
|
redef record connection += {
|
|
recent_tcp: set[string] &default=set() &read_expire=3min;
|
|
};
|
|
|
|
event new_packet(c: connection, pkt: pkt_hdr) {
|
|
add c$recent_tcp[cat(pkt$tcp)];
|
|
}
|