Re: Time value errors
Justin Azoff <[email protected]> Wed, 18 Dec 2019 18:49:59 -0500
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAPfnCujC8b9B63c1YsdNO+LYcWahnbut0KXTJ5bAU76T-dEZYw@mail.gmail.com> |
--===============1151197768== Content-Type: multipart/related; boundary="00000000000060c41c059a031c78" --00000000000060c41c059a031c78 Content-Type: multipart/alternative; boundary="00000000000060c41a059a031c77" --00000000000060c41a059a031c77 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable If you run that without the -d option, what does the line containing negative times look like? There should be 4 times at the end of each record: ref_time org_time rec_time xmt_time, knowing which one(s) have the out of range value would help. Something like cat ntp.log |zeek-cut uid ref_time org_time rec_time xmt_time | fgrep -- - may help see them better. On Wed, Dec 18, 2019 at 6:08 PM Scot Harris <[email protected]> wrote= : > > Noted what appear to be errors in the ntp.log file. > > > > Using following command: > > > > cat ntp.log | zeek-cut =E2=80=93d | less > > > > > > > > af_packet::eno1 2019-12-18T17:44:39-0500 C7MULpTngYof10ymf 10.1.45.35 123 10.1.5.60 123 2 3 4 64.000000 0.000004 0.070786 0.113083 10.1.5.60 2019-12-18T17:43:35-0500 2019-12-18T17:43:35-0500 2019-12-18T17:43:35-0500 2019-12-18T17:44:39-0500 0 > > af_packet::eno1 2019-12-18T17:44:39-0500 C7MULpTngYof10ymf 10.1.45.35 123 10.1.5.60 123 3 4 3 64.000000 0.015625 0.069839 0.077545 23.239.26.89 2019-:zeek-cut: time value out-of-range: -586465861.545972 > > zeek-cut: time value out-of-range: -586465861.545972 > > 12-18T17:42:18-0500 2019-12-18T17:44:39-0500 2019-12-18T17:44:39-0500 2019-12-18T17:44:39-0500 0 > > af_packet::eno1 2019-12-18T17:44:39-0500 C5GF2T1ozzCZptCbjf 10.1.204.212 123 10.1.5.180 123 3 3 15 64.000000 0.007812 0.000000 2.009995 0.0.0.0 1969-12-31T19:00:00-0500 1969-12-31T19:00:00-0500 1969-12-31T19:00:00-0500 2019-12-18T17:44:46-0500 0 > > af_packet::eno1 2019-12-18T17:44:40-0500 CxaJ6KeJfxVcN8Fw2 10.1.201.150 123 10.1.5.180 123 3 3 15 64.000000 0.007812 0.000000 2.009995 0.0.0.0 1969-12-31T19:00:00-0500 1969-12-31T19:00:00-0500 1969-12-31T19:00:00-0500 2019-12-18T17:44:48-0500 0 > > af_packet::eno1 2019-12-18T17:44:40-0500 C8dZCI37SuYRZB9L7g 10.1.13.61 123 10.1.5.60 123 3 3 4 64.000000 0.007812 0.069839 0.402298 60.5.1.10 2019-12-18T17:43:37-0500 2019-12-18T17:43:36-0500 2019-12-18T17:43:37-0500 2019-12-18T17:44:41-0500 0 > > af_packet::eno1 2019-12-18T17:44:41-0500 CBz4Ww4jjCjKgHYfwc 10.1.221.30 123 10.1.5.180 123 3 3 15 64.000000 0.007812 0.000000 2.009995 0.0.0.0 1969-12-31T19:zeek-cut: time value out-of-range: -1114760693.379112 > > zeek-cut: time value out-of-range: -1114760693.379112 > > zeek-cut: time value out-of-range: -1115340513.842638 > > :00:00-0500 1969-12-31T19:00:00-0500 1969-12-31T19:00:00-0500 2019-12-18T17:44:44-0500 0 > > af_packet::eno1 2019-12-18T17:44:40-0500 C4akh61szBCsYCPJn6 10.1.223.28 123 10.1.5.180 123 3 3 15 64.000000 0.007812 0.000000 2.009995 0.0.0.0 1969-12-31T19: > > > > Have not noticed these errors previously. > > > > > > > > ____________________________________________________ > Scot Harris > Network Engineer | IT | City of Hollywood > > (P) 954-921-3304 | [email protected] > > > > > > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek -- Justin --00000000000060c41a059a031c77 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">If you run that without the -d option, =C2=A0what does the= line containing negative times look like?<div><br></div><div>There should = be 4 times at the end of each record:=C2=A0ref_time =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 org_time =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 rec_time =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 xmt_time, knowing=C2=A0which one(s) have the ou= t of range value would help.=C2=A0 Something like</div><div><br></div><div>= cat ntp.log |zeek-cut uid ref_time org_time rec_time xmt_time=C2=A0| fgrep = -- =C2=A0-</div><div><br></div><div>may help see them better.<br><br>On Wed= , Dec 18, 2019 at 6:08 PM Scot Harris <<a href=3D"mailto:SHARRIS@hollywo= odfl.org">[email protected]</a>> wrote:<br>><br>> Noted what= appear to be errors in the ntp.log file.<br>><br>> =C2=A0<br>><br= >> Using following command:<br>><br>> =C2=A0<br>><br>> cat n= tp.log | zeek-cut =E2=80=93d | less<br>><br>> =C2=A0<br>><br>> = =C2=A0<br>><br>> =C2=A0<br>><br>> af_packet::eno1 2019-12-18T17= :44:39-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A0C7MULpTngYof10ymf =C2=A0 =C2=A0 =C2= =A0 10.1.45.35 =C2=A0 =C2=A0 =C2=A0123 =C2=A0 =C2=A0 10.1.5.60 =C2=A0 =C2= =A0 =C2=A0 123 =C2=A0 =C2=A0 2 =C2=A0 =C2=A0 =C2=A0 3 =C2=A0 =C2=A0 =C2=A0 = 4 =C2=A0 =C2=A0 =C2=A0 64.000000 =C2=A0 =C2=A0 =C2=A0 0.000004 =C2=A0 =C2= =A0 =C2=A0 =C2=A00.070786 =C2=A0 =C2=A0 =C2=A0 =C2=A00.113083 =C2=A0 =C2=A0= =C2=A0 =C2=A010.1.5.60 =C2=A0 =C2=A0 =C2=A0 2019-12-18T17:43:35-0500 =C2= =A0 =C2=A0 =C2=A0 =C2=A02019-12-18T17:43:35-0500 =C2=A0 =C2=A0 =C2=A0 =C2= =A02019-12-18T17:43:35-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A02019-12-18T17:44:39-= 0500 =C2=A0 =C2=A0 =C2=A0 =C2=A00<br>><br>> af_packet::eno1 2019-12-1= 8T17:44:39-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A0C7MULpTngYof10ymf =C2=A0 =C2=A0 = =C2=A0 10.1.45.35 =C2=A0 =C2=A0 =C2=A0123 =C2=A0 =C2=A0 10.1.5.60 =C2=A0 = =C2=A0 =C2=A0 123 =C2=A0 =C2=A0 3 =C2=A0 =C2=A0 =C2=A0 4 =C2=A0 =C2=A0 =C2= =A0 3 =C2=A0 =C2=A0 =C2=A0 64.000000 =C2=A0 =C2=A0 =C2=A0 0.015625 =C2=A0 = =C2=A0 =C2=A0 =C2=A00.069839 =C2=A0 =C2=A0 =C2=A0 =C2=A00.077545 =C2=A0 =C2= =A0 =C2=A0 =C2=A023.239.26.89 =C2=A0 =C2=A02019-:zeek-cut: time value out-o= f-range: -586465861.545972<br>><br>> zeek-cut: time value out-of-rang= e: -586465861.545972<br>><br>> 12-18T17:42:18-0500 =C2=A0 =C2=A0 =C2= =A0 =C2=A02019-12-18T17:44:39-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A02019-12-18T17= :44:39-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A02019-12-18T17:44:39-0500 =C2=A0 =C2= =A0 =C2=A0 =C2=A00<br>><br>> af_packet::eno1 2019-12-18T17:44:39-0500= =C2=A0 =C2=A0 =C2=A0 =C2=A0C5GF2T1ozzCZptCbjf =C2=A0 =C2=A0 =C2=A010.1.204= .212 =C2=A0 =C2=A0123 =C2=A0 =C2=A0 10.1.5.180 =C2=A0 =C2=A0 =C2=A0123 =C2= =A0 =C2=A0 3 =C2=A0 =C2=A0 =C2=A0 3 =C2=A0 =C2=A0 =C2=A0 15 =C2=A0 =C2=A0 = =C2=A064.000000 =C2=A0 =C2=A0 =C2=A0 0.007812 =C2=A0 =C2=A0 =C2=A0 =C2=A00.= 000000 =C2=A0 =C2=A0 =C2=A0 =C2=A02.009995 =C2=A0 =C2=A0 =C2=A0 =C2=A00.0.0= .0 1969-12-31T19:00:00-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A01969-12-31T19:00:00-= 0500 =C2=A0 =C2=A0 =C2=A0 =C2=A01969-12-31T19:00:00-0500 =C2=A0 =C2=A0 =C2= =A0 =C2=A02019-12-18T17:44:46-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A00<br>><br>= > af_packet::eno1 2019-12-18T17:44:40-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A0Cx= aJ6KeJfxVcN8Fw2 =C2=A0 =C2=A0 =C2=A0 10.1.201.150 =C2=A0 =C2=A0123 =C2=A0 = =C2=A0 10.1.5.180 =C2=A0 =C2=A0 =C2=A0123 =C2=A0 =C2=A0 3 =C2=A0 =C2=A0 =C2= =A0 3 =C2=A0 =C2=A0 =C2=A0 15 =C2=A0 =C2=A0 =C2=A064.000000 =C2=A0 =C2=A0 = =C2=A0 0.007812 =C2=A0 =C2=A0 =C2=A0 =C2=A00.000000 =C2=A0 =C2=A0 =C2=A0 = =C2=A02.009995 =C2=A0 =C2=A0 =C2=A0 =C2=A00.0.0.0 1969-12-31T19:00:00-0500 = =C2=A0 =C2=A0 =C2=A0 =C2=A01969-12-31T19:00:00-0500 =C2=A0 =C2=A0 =C2=A0 = =C2=A01969-12-31T19:00:00-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A02019-12-18T17:44:= 48-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A00<br>><br>> af_packet::eno1 2019-1= 2-18T17:44:40-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A0C8dZCI37SuYRZB9L7g =C2=A0 =C2= =A0 =C2=A010.1.13.61 =C2=A0 =C2=A0 =C2=A0123 =C2=A0 =C2=A0 10.1.5.60 =C2=A0= =C2=A0 =C2=A0 123 =C2=A0 =C2=A0 3 =C2=A0 =C2=A0 =C2=A0 3 =C2=A0 =C2=A0 =C2= =A0 4 =C2=A0 =C2=A0 =C2=A0 64.000000 =C2=A0 =C2=A0 =C2=A0 0.007812 =C2=A0 = =C2=A0 =C2=A0 =C2=A00.069839 =C2=A0 =C2=A0 =C2=A0 =C2=A00.402298 =C2=A0 =C2= =A0 =C2=A0 =C2=A060.5.1.10 =C2=A0 =C2=A0 =C2=A0 2019-12-18T17:43:37-0500 = =C2=A0 =C2=A0 =C2=A0 =C2=A02019-12-18T17:43:36-0500 =C2=A0 =C2=A0 =C2=A0 = =C2=A02019-12-18T17:43:37-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A02019-12-18T17:44:= 41-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A00<br>><br>> af_packet::eno1 2019-1= 2-18T17:44:41-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A0CBz4Ww4jjCjKgHYfwc =C2=A0 =C2= =A0 =C2=A010.1.221.30 =C2=A0 =C2=A0 123 =C2=A0 =C2=A0 10.1.5.180 =C2=A0 =C2= =A0 =C2=A0123 =C2=A0 =C2=A0 3 =C2=A0 =C2=A0 =C2=A0 3 =C2=A0 =C2=A0 =C2=A0 1= 5 =C2=A0 =C2=A0 =C2=A064.000000 =C2=A0 =C2=A0 =C2=A0 0.007812 =C2=A0 =C2=A0= =C2=A0 =C2=A00.000000 =C2=A0 =C2=A0 =C2=A0 =C2=A02.009995 =C2=A0 =C2=A0 = =C2=A0 =C2=A00.0.0.0 1969-12-31T19:zeek-cut: time value out-of-range: -1114= 760693.379112<br>><br>> zeek-cut: time value out-of-range: -111476069= 3.379112<br>><br>> zeek-cut: time value out-of-range: -1115340513.842= 638<br>><br>> :00:00-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A01969-12-31T19:00= :00-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A01969-12-31T19:00:00-0500 =C2=A0 =C2=A0 = =C2=A0 =C2=A02019-12-18T17:44:44-0500 =C2=A0 =C2=A0 =C2=A0 =C2=A00<br>><= br>> af_packet::eno1 2019-12-18T17:44:40-0500 =C2=A0 =C2=A0 =C2=A0 =C2= =A0C4akh61szBCsYCPJn6 =C2=A0 =C2=A0 =C2=A010.1.223.28 =C2=A0 =C2=A0 123 =C2= =A0 =C2=A0 10.1.5.180 =C2=A0 =C2=A0 =C2=A0123 =C2=A0 =C2=A0 3 =C2=A0 =C2=A0= =C2=A0 3 =C2=A0 =C2=A0 =C2=A0 15 =C2=A0 =C2=A0 =C2=A064.000000 =C2=A0 =C2= =A0 =C2=A0 0.007812 =C2=A0 =C2=A0 =C2=A0 =C2=A00.000000 =C2=A0 =C2=A0 =C2= =A0 =C2=A02.009995 =C2=A0 =C2=A0 =C2=A0 =C2=A00.0.0.0 1969-12-31T19:<br>>= ;<br>> =C2=A0<br>><br>> Have not noticed these errors previously.<= br>><br>> =C2=A0<br>><br>> =C2=A0<br>><br>> =C2=A0<br>>= ;<br>> ____________________________________________________<br>> Scot= Harris<br>> Network Engineer | IT | City of Hollywood<br>><br>> (= P) 954-921-3304 | <a href=3D"mailto:[email protected]">sharris@hollyw= oodfl.org</a><br>><br>> =C2=A0<br>><br>> =C2=A0<br>><br>>= _______________________________________________<br>> Zeek mailing list<= br>> <a href=3D"mailto:[email protected]">[email protected]</a><br>> <a href= =3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek">http://mailman.= ICSI.Berkeley.EDU/mailman/listinfo/zeek</a><br><br><br><br>--<br>Justin</di= v></div> --00000000000060c41a059a031c77-- --00000000000060c41c059a031c78 Content-Type: image/png; name="image001.png" Content-Disposition: inline; filename="image001.png" Content-Transfer-Encoding: base64 Content-ID: <16f1b68389b4cff311> X-Attachment-Id: 16f1b68389b4cff311 iVBORw0KGgoAAAANSUhEUgAAACwAAAAsCAYAAAAehFoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACx jwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAVYSURBVFhH7ZkLTJVlGMd/53COyP14QRDBZGIs JcsbXsBmCKlQXhIbqClhpZgOECpJbZGX1GRe8kLN+3K5OdJcuuymc5a6mXm3CwozhhdIkYuHi3B6 3u8cyhmHtO0ktvPbvh2+93vf9/vzvP/nebf301kEBPPtOnL2bqehoQG9TqeaHjgNIk2v15MRm4Cb wai1aYK3HtrH5CXpEBismrQHLQeJZ1EBW95czqTIYejKa6ot3mN7Q7cwedZg69TC0Onh1zOU5x3H xa1PyDv7S4vBxWB72hKRKHt44tYgFqmorZWGlmaDptChtOpdxNQPC0rrw6PWhlOwo3EKdjROwY7G KdjROAU7GqdgR+MU7Gicgh2NU7CjcQp2NP9Twer4raYaqm/JrxkabCdEt29DnTrXELQ+8kz1Ue2N qOeqrVbGK9Tpkpqr8aq/q++d903wz4JvVUHZ72QNHcmqUZOZF/28CKqDmzcY3Lkr43r2t774+jWy Y+JZN+YlgkxtrS8vuUxs6JNa29T+Q6VPCa56A7MGD2fGoBjSnxqBv5ePzHUdysu0uR7r0KlZ0c0L FqHxfQdj2byf5H7DMFiMjBkUjWXNbqJ6hhMX+gTLElLg4jksWw+SIAKMIvbS/A1wrZgVSRnsmZlN lWtrciel8dGkVAw6HTmJrxEbPoT4gTFcXriZ5KiRRHbvzYSIZ5gSORwqKmwC/o79AzWJ4sDQnux4 JYtu2VPJP3IIzDoIbi//poGAjp2J6hJKScVNgntFakNCYx+FsHDSP14tMxtJjR5DUEYCRaVXyFyT TUiPPrgarK+MTXkW/AOJ6zeEz9MWoYsLJSwohLKqm+DmpvVpCvsRlmXaNm0ua77dRX7BL9A9DPr2 AJMveJkoluU2uujlMlBw/kdtSM6CjZo1KpRPJarfF/zM6UWbQJ03S+TzS65gbDwaU76urCCwQ4D1 3tNE7v5dbD92UBtrDzuC5QVmM8Gm9nx64ohM5m1NtHpbsikBthfr1TmiuwfBbyUxK2Yslp0nCXLz AA8vIuYmUyS+VZaaE5sIpZetYwXLd6VYPjtN7vgZ9FmaCb5+0NodWrlqz+1hR7BkvG3pQkzt/qoK dyJd/kSWv7CyHN3YXnxx8jCXlm6zVoX2/jyeFs+gJRksGJ1Eyqgkys0SWcFv1gv0WpyKbkIExwt/ AmPzQhuxbwlvEyu+zOPD5Neh6KK1EqjqUFsjkboqf9dqlUwd66toapke0IURmeO5IeUt7ennZIyU ubYdOHz+B17MXcC8kRMxV5Vr01+7cI4Txb+BsoSrfc/ejX3B7p6kb1iCua4Oy+6zTOs/hDC/QKb0 jiR/VR4r41+lSsTrZIn9PDyxbDlAeEBnYuMSaSMCVny1C0vuXl4eEEWXTsG8lzidA2eOYVTLrlDf LGyreD/YF6wIeAT3iRG8kbee+eOmcXruat6fMJNvTh0ldedGKiXiKpGuFhWy6uudHM1ayR7J+BFr s7XViF6exTyxQsHCTZy6dIHxH8zBx0PyQaES605b3SO62TvWWxZLJWguM6mWpa2UciPR1iLjIUnl 5mnbwcQiPuLzW5VSP8us/dvIfSuZT20e5Tes4yQx8W5j3RQkETUrKDvdK2LJ2VGj0dc3lVB301o8 JglExyDJZvl1F8+qbFfVwEd2NRUqJchPdil1KbEKYytoJ9kv9VYTq1DfUnw73p9YG0qr3suovn/9 i7X5z7GgtOpKqiosvokDoKtsCi35s9eFs5R8csT6YTFn3w4y172rlaUWSXEhy1LeJmPYOKtg1XZF Cv9aEV4jPnERfz5ok6j9sF6kucqOOl2E+qvdFvgDfp7pA5gFveIAAAAASUVORK5CYII= --00000000000060c41c059a031c78-- --===============1151197768== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============1151197768==--