Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix IEEE 802.11 analyzer to properly forward tunneled packets

Browse source 
This mostly happens with Aruba, but could possibly happen with other tunnels too.
This commit is contained in:
Tim Wojtulewicz 2023-04-13 17:11:23 -07:00 • committed by Tim Wojtulewicz
parent e4a1c30828
commit 5b1c6216bd
3 changed files with 26 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/packet-protocols/ieee802_11/main.zeek
View file

@ -6,4 +6,8 @@ event zeek_init() &priority=20
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 0x86DD, PacketAnalyzer::ANALYZER_IP);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 0x0806, PacketAnalyzer::ANALYZER_ARP);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 0x8035, PacketAnalyzer::ANALYZER_ARP);
# IPv4 and IPv6 tunnels
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 0x0004, PacketAnalyzer::ANALYZER_IPTUNNEL);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 0x0029, PacketAnalyzer::ANALYZER_IPTUNNEL);
}