mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 10:08:20 +00:00
Improve ERSPAN Type III support
Added check for the optional sub-header in ERSPAN Type III as well as additional truncation checks to the GRE parsing logic in general. Also added a unit test for ERSPAN Type II.
This commit is contained in:
parent
995e67147a
commit
5618b21cca
7 changed files with 83 additions and 12 deletions
10
testing/btest/Baseline/core.erspanII/conn.log
Normal file
10
testing/btest/Baseline/core.erspanII/conn.log
Normal file
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2019-01-17-23-57-23
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1402723255.667881 ClEkJM2Vm5giqnMf4h 23.0.0.2 8 23.0.0.3 0 icmp - 0.001727 144 144 OTH - - 0 - 2 200 2 200 CHhAvVGS1DHFjwGM9
|
||||
#close 2019-01-17-23-57-23
|
10
testing/btest/Baseline/core.erspanII/tunnel.log
Normal file
10
testing/btest/Baseline/core.erspanII/tunnel.log
Normal file
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path tunnel
|
||||
#open 2019-01-17-23-57-23
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||
#types time string addr port addr port enum enum
|
||||
1402723255.667881 CHhAvVGS1DHFjwGM9 2.2.2.2 0 1.1.1.1 0 Tunnel::GRE Tunnel::DISCOVER
|
||||
#close 2019-01-17-23-57-23
|
BIN
testing/btest/Traces/erspanII.pcap
Normal file
BIN
testing/btest/Traces/erspanII.pcap
Normal file
Binary file not shown.
6
testing/btest/core/erspanII.bro
Normal file
6
testing/btest/core/erspanII.bro
Normal file
|
@ -0,0 +1,6 @@
|
|||
# @TEST-EXEC: bro -C -b -r $TRACES/erspanII.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff tunnel.log
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
|
||||
@load base/frameworks/tunnels
|
||||
@load base/protocols/conn
|
Loading…
Add table
Add a link
Reference in a new issue