Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Move ARP analysis into packet analyzer.

Browse source
This commit is contained in:
Jan Grashoefer 2020-08-28 16:27:53 +02:00 • committed by Tim Wojtulewicz
parent 0ec7516602
commit 24babf096e
17 changed files with 238 additions and 368 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/packet_analysis/protocol/arp/ARP.h
View file

@ -5,6 +5,12 @@
#include <packet_analysis/Analyzer.h>
#include <packet_analysis/Component.h>
#include <net/if_arp.h>
#ifndef arp_pkthdr
#define arp_pkthdr arphdr
#endif
namespace zeek::packet_analysis::ARP {
class ARPAnalyzer : public Analyzer {
@ -18,6 +24,15 @@ public:
{
return std::make_shared<ARPAnalyzer>();
}
private:
zeek::AddrValPtr ToAddrVal(const void* addr);
zeek::StringValPtr ToEthAddrStr(const u_char* addr);
void BadARPEvent(const struct arp_pkthdr* hdr, const char* fmt, ...)
__attribute__((format(printf, 3, 4)));
void RequestReplyEvent(EventHandlerPtr e, const u_char* src, const u_char* dst,
const char* spa, const char* sha, const char* tpa, const char* tha);
};
}