用于EagleEye3.0 规则集漏报和误报测试的示例项目,项目收集于github和gitee
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

123 lines
4.9 KiB

#FIG 3.2 Produced by xfig version 3.2.5-alpha5
Portrait
Center
Metric
A4
100.00
Single
-2
1200 2
6 900 945 3015 1800
6 1035 1215 3015 1800
6 1035 1215 3015 1350
2 2 0 1 26 6 51 -1 20 0.000 0 0 -1 0 0 5
1035 1215 1620 1215 1620 1350 1035 1350 1035 1215
4 0 0 50 -1 12 7 0.0000 4 90 1275 1710 1305 Standard settings\001
-6
6 1035 1440 2385 1575
2 2 0 1 9 11 51 -1 20 0.000 0 0 -1 0 0 5
1035 1440 1620 1440 1620 1575 1035 1575 1035 1440
4 0 0 50 -1 12 7 0.0000 4 60 675 1710 1530 Rule sets\001
-6
6 1035 1665 2790 1800
2 2 0 1 13 2 52 -1 20 0.000 0 0 -1 0 0 5
1035 1665 1620 1665 1620 1800 1035 1800 1035 1665
4 0 0 50 -1 12 7 0.0000 4 75 1050 1710 1755 HTTP mode only\001
-6
-6
2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 2
945 1125 945 1800
4 0 0 50 -1 17 10 0.0000 4 150 615 900 1080 Captions\001
-6
6 450 2250 3510 3195
4 0 0 50 -1 16 10 0.0000 4 150 2865 450 2385 Each time a poller detects an activity on a\001
4 0 0 50 -1 16 10 0.0000 4 150 2940 450 2580 listening socket, this sequence is executed.\001
4 0 0 50 -1 16 10 0.0000 4 150 3000 450 2775 Note that stream_sock_accept() loops until\001
4 0 0 50 -1 16 10 0.0000 4 150 3030 450 2970 accept() returns an error or tune.maxaccept\001
4 0 0 50 -1 16 10 0.0000 4 150 1830 450 3165 loops have been executed.\001
-6
6 450 3375 3420 4275
4 0 0 50 -1 16 10 0.0000 4 150 2535 450 3510 Once the session is started, function\001
4 0 0 50 -1 16 10 0.0000 4 150 2880 450 3705 process_session() will be called once then\001
4 0 0 50 -1 16 10 0.0000 4 150 2895 450 3900 each time an activity is detected on any of\001
4 0 0 50 -1 16 10 0.0000 4 150 2955 450 4095 monitored file descriptors belonging to the\001
4 0 0 50 -1 16 10 0.0000 4 120 555 450 4275 session.\001
-6
6 4230 945 6480 1125
2 2 0 1 26 6 51 -1 20 0.000 0 0 -1 0 0 5
4230 945 6345 945 6345 1125 4230 1125 4230 945
4 0 0 50 -1 14 10 0.0000 4 105 2205 4275 1080 rate-limit sessions ?\001
-6
6 4455 1620 7065 1800
2 2 0 1 26 6 51 -1 20 0.000 0 0 -1 0 0 5
4455 1620 6885 1620 6885 1800 4455 1800 4455 1620
4 0 0 50 -1 14 10 0.0000 4 135 2520 4521 1755 monitor-net (mode=tcp) ?\001
-6
6 4455 1845 7470 2025
2 2 0 1 9 11 51 -1 20 0.000 0 0 -1 0 0 5
4455 1845 7290 1845 7290 2025 4455 2025 4455 1845
4 0 0 50 -1 14 10 0.0000 4 135 2940 4500 1980 tcp-request connection {...}\001
-6
6 4635 3195 7425 3735
6 4680 3420 7380 3600
2 2 0 1 26 6 51 -1 20 0.000 0 0 -1 0 0 5
4680 3420 7200 3420 7200 3600 4680 3600 4680 3420
4 0 0 50 -1 14 10 0.0000 4 135 2625 4725 3555 monitor-net (mode=http) ?\001
-6
2 2 0 1 13 2 52 -1 20 0.000 0 0 -1 0 0 5
4635 3195 7425 3195 7425 3735 4635 3735 4635 3195
4 0 0 50 -1 14 10 0.0000 4 135 1575 4725 3330 http_init_txn()\001
-6
2 1 0 1 0 7 51 -1 -1 4.000 0 0 -1 1 0 3
1 1 1.00 60.00 120.00
6885 1710 7200 1710 7200 675
2 1 0 1 0 7 51 -1 -1 4.000 0 0 -1 1 0 3
1 1 1.00 60.00 120.00
7290 1935 7425 1935 7425 675
2 1 0 1 0 7 51 -1 -1 4.000 0 0 -1 1 0 3
1 1 1.00 60.00 120.00
5850 2340 7650 2340 7650 675
2 1 0 1 0 7 51 -1 -1 4.000 0 0 -1 1 0 3
1 1 1.00 60.00 120.00
7200 3510 7875 3510 7875 675
2 1 0 1 0 7 51 -1 -1 0.000 0 0 -1 0 0 2
4140 675 4140 4275
2 1 0 1 0 7 51 -1 -1 0.000 0 0 -1 0 0 2
4320 1575 4320 4275
2 1 0 1 0 7 51 -1 -1 4.000 0 0 -1 1 0 3
1 1 1.00 60.00 120.00
5580 1260 6750 1260 6750 675
2 1 0 1 0 7 51 -1 -1 0.000 0 0 -1 0 0 2
4545 2700 4545 4050
2 1 0 1 0 7 51 -1 -1 4.000 0 0 -1 1 0 3
1 1 1.00 60.00 120.00
6345 1035 6525 1035 6525 675
2 2 0 1 26 6 51 -1 20 0.000 0 0 -1 0 0 5
4635 3825 6030 3825 6030 4005 4635 4005 4635 3825
2 1 0 1 0 7 50 -1 -1 4.000 0 0 -1 0 0 3
6030 3915 7875 3915 7875 3510
2 2 0 1 26 6 51 -1 20 0.000 0 0 -1 0 0 5
4230 720 5895 720 5895 900 4230 900 4230 720
2 1 0 1 0 7 51 -1 -1 4.000 0 0 -1 1 0 3
1 1 1.00 60.00 120.00
5895 810 6300 810 6300 675
4 1 0 51 -1 12 7 0.0000 4 60 375 7515 585 close\001
4 1 0 51 -1 12 7 0.0000 4 75 1275 6930 2250 not enough memory\001
4 0 0 51 -1 12 7 1.5708 4 60 1575 8010 2790 return "OK" and close\001
4 0 0 50 -1 14 10 0.0000 4 135 1365 4275 1305 sock=accept()\001
4 0 0 50 -1 14 10 0.0000 4 135 1890 4500 2655 frontend_accept(s)\001
4 0 0 50 -1 14 10 0.0000 4 135 2100 4275 1530 session_accept(sock)\001
4 0 0 50 -1 14 10 0.0000 4 105 1365 4500 2385 s=new session\001
4 0 0 50 -1 14 10 0.0000 4 135 1575 4635 2880 prepare logs(s)\001
4 0 0 50 -1 14 10 0.0000 4 135 2100 4635 3105 prepare socket(sock)\001
4 0 0 50 -1 14 10 0.0000 4 105 1365 4680 3960 mode=health ?\001
4 1 0 51 -1 12 7 0.0000 4 60 225 7605 3465 Yes\001
4 1 0 51 -1 12 7 0.0000 4 60 225 7605 3870 Yes\001
4 1 0 51 -1 12 7 0.0000 4 60 225 7065 1665 Yes\001
4 1 0 51 -1 12 7 0.0000 4 75 300 6570 1215 Fail\001
4 0 0 50 -1 14 10 0.0000 4 120 1680 4500 4230 start session(s)\001
4 0 0 50 -1 14 10 0.0000 4 105 1785 4275 855 maxconn reached ?\001
4 1 0 51 -1 12 7 0.0000 4 90 450 6525 585 ignore\001
4 1 0 51 -1 12 7 0.0000 4 60 225 6120 765 Yes\001
4 0 0 50 -1 17 12 0.0000 4 210 3000 450 630 Session instantiation sequence\001
4 0 0 50 -1 14 10 0.0000 4 135 2100 4050 630 stream_sock_accept()\001