Minimal packets to trigger events
Woot4moo <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CALiK30-v4zQh8CRY0w7JYuDDrvm3WnVv5J1=85JboHes7-P+nA@mail.gmail.com> |
I am in the process of covering my team's feature set and we are using Behave (Python) to generate reports. Is there a collection of minimal PCAPs that the community maintains / scapy scripts to generate minimal PCAPs to trigger the events that Zeek supports? For example to trigger the "ssh_server_version(...)" event [ https://docs.zeek.org/en/stable/scripts/base/bif/plugins/Bro_SSH.events.bif.bro.html#id-ssh_server_version] it requires 4 packets (TCP handshake + 1 additional packet) _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek