Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 23:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add MAC addresses to connection record.

Browse source 
c$eth_src and c$eth_dst now contain the Ethernet address if available.
A new script protocols/conn/mac-logging.bro adds these to conn.log
when loaded.
This commit is contained in:
Robin Sommer 2016-05-29 13:27:21 -07:00
parent 35686fb93a
commit 57aef6d49f
20 changed files with 486 additions and 321 deletions
Download patch file Download diff file Expand all files Collapse all files

25
src/iosource/Packet.h
View file

@ -1,6 +1,8 @@
#ifndef packet_h
#define packet_h
#include <netinet/ether.h>
#include "Desc.h"
#include "IP.h"
#include "NetVar.h"
@ -50,7 +52,8 @@ public:
*/
Packet(int link_type, struct timeval *ts, uint32 caplen,
uint32 len, const u_char *data, int copy = false,
std::string tag = std::string("")) : data(0)
std::string tag = std::string(""))
: data(0), eth_src(), eth_dst()
{
Init(link_type, ts, caplen, len, data, copy, tag);
}
@ -58,7 +61,7 @@ public:
/**
* Default constructor. For internal use only.
*/
Packet() : data(0)
Packet() : data(0), eth_src(), eth_dst()
{
struct timeval ts = {0, 0};
Init(0, &ts, 0, 0, 0);
@ -167,19 +170,31 @@ public:
* Layer 3 protocol identified (if any). Valid iff Layer2Valid()
* returns true.
*/
Layer3Proto l3_proto; ///
Layer3Proto l3_proto;
/**
* If layer 2 is Ethernet, innermost ethertype field. Valid iff
* Layer2Valid() returns true.
*/
uint32 eth_type; ///
uint32 eth_type;
/**
* If layer 2 is Ethernet, the source MAC address. Valid iff
* Layer2Valid() returns true.
*/
ether_addr eth_src[6];
/**
* If layer 2 is Ethernet, the destiantion MAC address. Valid iff
* Layer2Valid() returns true.
*/
ether_addr eth_dst[6];
/**
* (Outermost) VLAN tag if any, else 0. Valid iff Layer2Valid()
* returns true.
*/
uint32 vlan; ///
uint32 vlan;
/**
* (Innermost) VLAN tag if any, else 0. Valid iff Layer2Valid()