Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Improvements for the "bad checksums" detector to make it detect bad TCP checksums.

Browse source
This commit is contained in:
Seth Hall 2012-12-13 11:09:41 -05:00
parent 0cf98ac325
commit 3c27267223
1 changed files with 20 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

24
scripts/base/misc/find-checksum-offloading.bro
View file

@ -14,7 +14,8 @@ export {
}
# Keep track of how many bad checksums have been seen.
global bad_checksums = 0;
global bad_ip_checksums = 0;
global bad_tcp_checksums = 0;
# Track to see if this script is done so that messages aren't created multiple times.
global done = F;
@ -25,10 +26,19 @@ event ChecksumOffloading::check()
return;
local pkts_recvd = net_stats()$pkts_recvd;
if ( (bad_checksums*1.0 / net_stats()$pkts_recvd*1.0) > 0.05 )
local bad_ip_checksum_pct = bad_ip_checksums*1.0 / net_stats()$pkts_recvd*1.0;
local bad_tcp_checksum_pct = bad_tcp_checksums*1.0 / net_stats()$pkts_recvd*1.0;
if ( bad_ip_checksum_pct > 0.05 || bad_tcp_checksum_pct > 0.05 )
{
local packet_src = reading_traces() ? "trace file likely has" : "interface is likely receiving";
local message = fmt("Your %s invalid IP checksums, most likely from NIC checksum offloading.", packet_src);
local bad_checksum_msg = bad_ip_checksum_pct > 0.0 ? "IP" : "";
if ( bad_tcp_checksum_pct > 0.0 )
{
if ( |bad_checksum_msg| > 0 )
bad_checksum_msg += " and ";
bad_checksum_msg += "TCP";
}
local message = fmt("Your %s invalid %s checksums, most likely from NIC checksum offloading.", packet_src, bad_checksum_msg);
Reporter::warning(message);
done = T;
}
@ -48,7 +58,13 @@ event bro_init()
event net_weird(name: string)
{
if ( name == "bad_IP_checksum" )
++bad_checksums;
++bad_ip_checksums;
}
event conn_weird(name: string, c: connection, addl: string)
{
if ( name == "bad_TCP_checksum" )
++bad_tcp_checksums;
}
event bro_done()