Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 20:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Bring back default packet analysis.

Browse source 
Default analyzers can be configured per packet analyzer by omitting the
identifier in the ConfigEntry.
This commit is contained in:
Jan Grashoefer 2020-08-21 18:11:05 +02:00 • committed by Tim Wojtulewicz
parent d4ff5a236c
commit 462b1fe3a2
9 changed files with 81 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/base/init-bare.zeek
View file

@ -5357,8 +5357,9 @@ export {
parent : PacketAnalyzer::Tag &optional;
# A numeric identifier, which can be found in the packet data, that denotes the
# encapsulated protocol.
identifier : count;
# encapsulated protocol. This field is optional. If it is not included, the
# configured child analyzer will be used as default analyzer.
identifier : count &optional;
# The analyzer that corresponds to the above identifier.
analyzer : PacketAnalyzer::Tag;

2
scripts/base/packet-protocols/__load__.zeek
View file

@ -1,4 +1,4 @@
#@load base/packet-protocols/default
@load base/packet-protocols/default
@load base/packet-protocols/ethernet
#@load base/packet-protocols/fddi
#@load base/packet-protocols/ieee802_11

1
scripts/base/packet-protocols/default/main.zeek
View file

@ -1,6 +1,7 @@
module LL_DEFAULT;
redef PacketAnalyzer::config_map += {
PacketAnalyzer::ConfigEntry($analyzer=PacketAnalyzer::ANALYZER_DEFAULTANALYZER),
PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_DEFAULTANALYZER, $identifier=4, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_DEFAULTANALYZER, $identifier=6, $analyzer=PacketAnalyzer::ANALYZER_IPV6)
};

3
scripts/base/packet-protocols/ethernet/main.zeek
View file

@ -12,5 +12,6 @@ redef PacketAnalyzer::config_map += {
#PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x8100, $analyzer=PacketAnalyzer::ANALYZER_VLAN),
#PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x88A8, $analyzer=PacketAnalyzer::ANALYZER_VLAN),
#PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x9100, $analyzer=PacketAnalyzer::ANALYZER_VLAN),
#PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x8864, $analyzer=PacketAnalyzer::ANALYZER_PPPOE)
#PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x8864, $analyzer=PacketAnalyzer::ANALYZER_PPPOE),
PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $analyzer=PacketAnalyzer::ANALYZER_DEFAULTANALYZER)
};