These are the trace files that are used by the Zeek test suite.

Note to maintainers: please take care when modifying/removing files from here.
We install these traces with the Zeek distribution and external packages might
depend on them for tests.

Many pcaps in the library are generated by associated Python files using the Scapy
library. Look for Python files with the same name as the pcap file with a .py extension.

Trace Index/Sources:

- modbus/modbus-eit.pcap:
  Sourced from https://www.netresec.com/?page=PCAP4SICS, credit to https://cs3sthlm.se/.
  The packets in this trace were pulled from the 4SICS-GeekLounge-151021.pcap file.
- [ldap/simpleauth.pcap](https://github.com/arkime/arkime/blob/main/tests/pcap/ldap-simpleauth.pcap)
- ldap/simpleauth-diff-port.pcap: made with
  `tcprewrite -r 3268:32681 -i simpleauth.pcap -o simpleauth-diff-port.pcap`
- ldap/krb5-sign-seal-01.pcap: trace is derived from
  <https://wiki.wireshark.org/uploads/__moin_import__/attachments/SampleCaptures/ldap-krb5-sign-seal-01.cap>
  - the LDAP flow selected (filtered out the Kerberos packets)
  - truncated to 10 packets (where packet 10 contains the SASL encrypted LDAP message)
  - one `\x30` byte in the ciphertext changed to `\x00`
- ldap/issue-32.pcapng: Provided by GH user martinvanhensbergen,
  <https://github.com/zeek/spicy-ldap/issues/23>
- ldap/ctu-sme-11-win7ad-1-ldap-tcp-50041.pcap: Harvested from CTU-SME-11
  (Experiment-VM-Microsoft-Windows7AD-1) dataset, filtering on tcp port 389 and port 50041.
  https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).
- ldap/ldap_invalid_credentials.pcap
  Provided by Martin van Hensbergen in issue #3919.
- dns/tkey.pcap: Harvested from CTU-SME-11
  (Experiment-VM-Microsoft-Windows7AD-1) dataset, filtering on tcp port 53.
  https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).
- dns/dynamic-update.pcap: : Harvested from CTU-SME-11
  (Experiment-VM-Microsoft-Windows7AD-1) dataset, filtering on tcp port 53.
  https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).
- pop3/POP3.pcap: Picked up from POP tutorial on tranalyzer.com
  https://tranalyzer.com/tutorial/pop
  https://tranalyzer.com/download/data/pop3.pcap
- http/cooper-grill-dvwa.pcapng
  Provided by cooper-grill on #3995
  https://github.com/zeek/zeek/pull/3995
- http/docker-http-upgrade.pcap
  Provided by blightzero on #4068
  https://github.com/zeek/zeek/issues/4068
- quic/merlinc2_Zeek_example.pcapng
  Provided by Faan Rossouw on #4198
  https://github.com/zeek/zeek/issues/4198
- quic/chromium-dpd-custom-port-4433.pcap
  Derived from quic/chromium-115.0.5790.110-api-cirrus-com.pcap using
  `tcprewrite --portmap=443:4433 --fixcsum` to test QUICv1 DPD on non-standard ports.
- quic/quicv2-echo-dpd-custom-port-4433.pcap
  Derived from quic/quicv2-echo-443.pcap using
  `tcprewrite --portmap=443:4433 --fixcsum` to test QUICv2 DPD on non-standard ports.
- pe/pe.pcap
  VirusTotal reports that this file contains malware. The PE analyzer was originally added
  to decode info for malware, so this is expected. See
  https://zeekorg.slack.com/archives/CSZBXF6TH/p1738261449655049
- tunnels/geneve-tagged-udp-packet.pcap
  Provided by Eldon Koyle Corelight for testing.
- cdp-v1.pcap
  From the Wireshark library of captures at https://wiki.wireshark.org/samplecaptures.
- ldap/adduser1.pcap ldap/adduser1-ntlm.pcap
  Provided by Mohan-Dhawan on #4275
  https://github.com/zeek/zeek/issues/4275
- smb_v2_only_non_zero_reserved1.pcap
  Provided by @predator89090 on #4730
  https://github.com/zeek/zeek/issues/4730
- smb/cifs_negotiate_lanman.pcap
  Generated with scapy/chatgpt by @Mohan-Dhawan
  https://github.com/zeek/zeek/issues/4545
- tcp/one-sided-2745.pcap
  Extracted from short.pcap.gz (port 2745 and port 281) or (port 2745 and port 1433)
  and used tcprewrite to remove mac/ip. No actual payload in the packets.
- tcp/ctu-64702-888.pcap
  Extracted from CTU-SME-11 after observing ConnSize differences when
  fixing is_orig behavior (port 64702 and port 888).
- pcapng-multi-interface.pcapng
  Generated using tshark/wireshark on a docker container and a Windows host, then merged
  together using mergecap.
- http/ctu-62604-80.pcap
  Extracted from CTU-SME-11 after observing http.log differences when
  fixing MIME entity behavior (port 64702 and port 80).
- http/m57-long-49525-80.pcap http/m57-long-49600-80.pcap
  Extracted from m57-long test after observing http.log and files.log differences.
- http/get-to-ssh-server.pcap
  Shared on #5204 by Aashish.
- tls//ssl-to-http-server.pcap
  Extracted from CTU-SME-11 after observing detect-protocols not detecting
  SSL for this connection anymore (because it's SSL client hello to a HTTP server).
- ldap/modify-request.pcapng
  Extracted by Tim from https://weberblog.net/the-ultimate-pcap/ and uploaded
  for #5235. PCAP contains an LDAP connection with a ModifyRequest.
- ldap/gap-data-missing.pcapng
  Extracted by Tim from https://weberblog.net/the-ultimate-pcap/ and uploaded
  for #5221. It's just an LDAP connection that contains a gap.
- postgresql/greenhouse-app.pcap
  Captured via tcpdump and port 5432 while running the greenhouse app
  and inserting a user and a plant.
  https://github.com/grafana/loki-fundamentals?tab=readme-ov-file#deploying-the-sample-application
- dns/tm1t.pcap
  Captured via tcpdump while making DNS requests on a docker instance. Requires
  setting the bind address/port to make sure it uses a single connection. Used
  for documentation samples.
- http/testmyids.com
  HTTP request to testmyids.com. Used for documentation samples.
- igmp/multicast-igmp-version-membership-query-and-report.pcap
  from https://www.cloudshark.org/captures/7bb04610bb7a for testing IGMP v1
- ldap/asn1-max-recursion.pcap
  Generated by Phuong Cao (@pmcao) as part of a security report. Used to test
  limitations on recursion when parsing ASN.1.
- ldap/ldap-max-recursion.pcap
  Generated by Phuong Cao (@pmcao) as part of a security report. Used to test
  limitations on recursion when parsing LDAP search filters.
- zip/a.zip.pcap
  ZIP file created with a truncated pdf and truncated putty.exe file such that
  the size stays small. Downloaded from python3 -m http.server 8080 using curl.
- igmp/home-multicast-short.pcap
  A snippet of a larger pcap generated by Christian Kreibich (@ckreibich) from his home
  network.
- tcp/syn-bad.pcap
  Single syn packet with a corrupt TCP checksum, scrambled with hexedit.
- dns/dns-corrput.pcap
  A query and response for zeek.org to 8.8.8.8, UDP checksums scrambled
  with hexedit.
- tcp/window-scale-range.pcap
  Generated by dxbjavid in #5495 with the SYN packet containing 255 as scale. Very likely AI assisted.
- ntp/ntp-no-extensions-mac.pcap
  Generated from a reproducer for an OSS-Fuzz finding. This is an NTP packet with no extensions
  but with a trailing key ID and message authentication code.
- mount/mount-unmount.pcap and -bad-status.pcap and -bad-auth-flavor.pcap
  Created by setting up a NFSv3 server on a Ubuntu VM and added the
  Python script mount-unmount-scramble.py to override the status fields
  using scapy.
- nfs/nfs_fileop.pcap Created by setting up a NFSv3 server on a Ubuntu VM
  and creating a single file and deleting it again. Used with scramble.py
  to produce some invalid values.
- gnutella/max-line.pcapng
  Generated by corresponding GPT-generated scapy script gnutella/buffer-growth-generator.py
  Used with key length 200, 1 line.
- gnutella/max-header.pcapng
  Generated by corresponding GPT-generated scapy script gnutella/buffer-growth-generator.py
  Used with key length 50, 5 lines.
- http/261:
  Generated by Justice Bovee using an agent/LLM setup to find potential
  evasion tactics that Zeek doesn't report as weirds. Not real traffic.
