19 lines
465 B
Plaintext
19 lines
465 B
Plaintext
# @TEST-EXEC: zeek -r $TRACES/finger/standard.pcap %INPUT >>output
|
|
# @TEST-EXEC: zeek -r $TRACES/finger/verbose.pcap %INPUT >>output
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
global resp_lines = 0;
|
|
|
|
event finger_request(c: connection, full: bool, username: string, hostname: string)
|
|
{
|
|
print "request", c$id, full, username, hostname;
|
|
}
|
|
|
|
event finger_reply(c: connection, reply_line: string)
|
|
{
|
|
if ( ++resp_lines >= 5 )
|
|
return;
|
|
|
|
print "response", c$id, reply_line;
|
|
}
|