Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add forwarding from VLAN analyzer into LLC, SNAP, and Novell 802.3 analyzers

Browse source
This commit is contained in:
Tim Wojtulewicz 2023-04-19 10:40:44 -07:00 • committed by Tim Wojtulewicz
parent c5b8603218
commit 7aa7909c94
4 changed files with 63 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
scripts/base/packet-protocols/vlan/main.zeek
View file

@ -1,5 +1,14 @@
module PacketAnalyzer::VLAN;
export
{
# We use some magic numbers here to denote these. The values here are outside the range of the
# standard ethertypes, which should always be above 1536.
const SNAP_FORWARDING_KEY : count = 0x0001;
const NOVELL_FORWARDING_KEY : count = 0x0002;
const LLC_FORWARDING_KEY : count = 0x0003;
}
event zeek_init() &priority=20
{
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 0x8847, PacketAnalyzer::ANALYZER_MPLS);
@ -10,4 +19,11 @@ event zeek_init() &priority=20
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 0x8035, PacketAnalyzer::ANALYZER_ARP);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 0x8100, PacketAnalyzer::ANALYZER_VLAN);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 0x8864, PacketAnalyzer::ANALYZER_PPPOE);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, SNAP_FORWARDING_KEY,
PacketAnalyzer::ANALYZER_SNAP);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, NOVELL_FORWARDING_KEY,
PacketAnalyzer::ANALYZER_NOVELL_802_3);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, LLC_FORWARDING_KEY,
PacketAnalyzer::ANALYZER_LLC);
}