Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 09:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

NTP: Detect out-of-order packets

Browse source 
The NTP mode provides us with the identity of the endpoints. For the
simple CLIENT / SERVER modes, flip the connection if we detect
orig/resp disagreeing with what the message says. This mainly
results in the history getting a ^ and the ntp.log / conn.log
showing the corrected endpoints.

Closes #2998.
This commit is contained in:
Arne Welzel 2023-05-04 17:23:14 +02:00
parent 12252743b1
commit 2c8b97c522
8 changed files with 66 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
testing/btest/scripts/base/protocols/ntp/misordered-ntp.test Normal file
View file

@ -0,0 +1,12 @@
# @TEST-EXEC: zeek -b -C -r $TRACES/ntp/misordered-ntp.pcap %INPUT
# @TEST-EXEC: btest-diff ntp.log
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/conn
@load base/protocols/ntp
event ntp_message(c: connection, is_orig: bool, msg: NTP::Message)
{
print fmt("ntp_message %s -> %s:%d (%s)", c$id$orig_h, c$id$resp_h, c$id$resp_p, c$history);
}