Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 21:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Move ARP analysis into packet analyzer.

Browse source
This commit is contained in:
Jan Grashoefer 2020-08-28 16:27:53 +02:00 • committed by Tim Wojtulewicz
parent 0ec7516602
commit 24babf096e
17 changed files with 238 additions and 368 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/Sessions.cc
View file

@ -22,8 +22,6 @@
#include "analyzer/protocol/stepping-stone/SteppingStone.h"
#include "analyzer/protocol/stepping-stone/events.bif.h"
#include "analyzer/protocol/arp/ARP.h"
#include "analyzer/protocol/arp/events.bif.h"
#include "Discard.h"
#include "RuleMatcher.h"
@ -33,6 +31,8 @@
#include "iosource/IOSource.h"
#include "iosource/PktDumper.h"
#include "pcap.h"
// These represent NetBIOS services on ephemeral ports. They're numbered
// so that we can use a single int to hold either an actual TCP/UDP server
// port or one of these.
@ -96,11 +96,6 @@ NetSessions::NetSessions()
else
pkt_profiler = nullptr;
if ( arp_request || arp_reply || bad_arp )
arp_analyzer = new analyzer::arp::ARP_Analyzer();
else
arp_analyzer = nullptr;
memset(&stats, 0, sizeof(SessionStats));
}
@ -108,7 +103,6 @@ NetSessions::~NetSessions()
{
delete packet_filter;
delete pkt_profiler;
Unref(arp_analyzer);
delete discarder;
delete stp_manager;
@ -178,8 +172,8 @@ void NetSessions::NextPacket(double t, const Packet* pkt)
else if ( pkt->l3_proto == L3_ARP )
{
if ( arp_analyzer )
arp_analyzer->NextPacket(t, pkt);
// Do nothing here as ARP has moved into a packet analyzer
//TODO: Revisit the use of packet's l3_proto
}
else