mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 19:18:19 +00:00
Add Teredo-specific events.
These are called "teredo_packet", "teredo_authentication", "teredo_origin_indication", and "teredo_bubble" and may be raised on a per-packet basis depending on Teredo encapsulation method.
This commit is contained in:
Jon Siwek
parent
b52436a53b
commit
854c625275
10 changed files with 330 additions and 1 deletions
|
|
@ -1347,6 +1347,42 @@ type pkt_hdr: record {
|
||||||
icmp: icmp_hdr &optional; ##< The ICMP header if an ICMP packet.
|
icmp: icmp_hdr &optional; ##< The ICMP header if an ICMP packet.
|
||||||
};
|
};
|
||||||
|
|
||||||
|
## A Teredo origin indication header. See :rfc:`4380` for more information
|
||||||
|
## about the Teredo protocol.
|
||||||
|
##
|
||||||
|
## .. bro:see:: teredo_bubble teredo_origin_indication teredo_authentication
|
||||||
|
## teredo_hdr
|
||||||
|
type teredo_auth: record {
|
||||||
|
id: string; ##< Teredo client identifier.
|
||||||
|
value: string; ##< HMAC-SHA1 over shared secret key between client and
|
||||||
|
##< server, nonce, confirmation byte, origin indication
|
||||||
|
##< (if present), and the IPv6 packet.
|
||||||
|
nonce: count; ##< Nonce chosen by Teredo client to be repeated by
|
||||||
|
##< Teredo server.
|
||||||
|
confirm: count; ##< Confirmation byte to be set to 0 by Teredo client
|
||||||
|
##< and non-zero by server if client needs new key.
|
||||||
|
};
|
||||||
|
|
||||||
|
## A Teredo authentication header. See :rfc:`4380` for more information
|
||||||
|
## about the Teredo protocol.
|
||||||
|
##
|
||||||
|
## .. bro:see:: teredo_bubble teredo_origin_indication teredo_authentication
|
||||||
|
## teredo_hdr
|
||||||
|
type teredo_origin: record {
|
||||||
|
p: port; ##< Unobfuscated UDP port of Teredo client.
|
||||||
|
a: addr; ##< Unobfuscated IPv4 address of Teredo client.
|
||||||
|
};
|
||||||
|
|
||||||
|
## A Teredo packet header. See :rfc:`4380` for more information about the
|
||||||
|
## Teredo protocol.
|
||||||
|
##
|
||||||
|
## .. bro:see:: teredo_bubble teredo_origin_indication teredo_authentication
|
||||||
|
type teredo_hdr: record {
|
||||||
|
auth: teredo_auth &optional; ##< Teredo authentication header.
|
||||||
|
origin: teredo_origin &optional; ##< Teredo origin indication header.
|
||||||
|
hdr: pkt_hdr; ##< IPv6 and transport protocol headers.
|
||||||
|
};
|
||||||
|
|
||||||
## Definition of "secondary filters". A secondary filter is a BPF filter given as
|
## Definition of "secondary filters". A secondary filter is a BPF filter given as
|
||||||
## index in this table. For each such filter, the corresponding event is raised for
|
## index in this table. For each such filter, the corresponding event is raised for
|
||||||
## all matching packets.
|
## all matching packets.
|
||||||
|
|
|
||||||
|
|
@ -88,6 +88,51 @@ bool TeredoEncapsulation::DoParse(const u_char* data, int& len,
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
RecordVal* TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
|
||||||
|
{
|
||||||
|
static RecordType* teredo_hdr_type = 0;
|
||||||
|
static RecordType* teredo_auth_type = 0;
|
||||||
|
static RecordType* teredo_origin_type = 0;
|
||||||
|
|
||||||
|
if ( ! teredo_hdr_type )
|
||||||
|
{
|
||||||
|
teredo_hdr_type = internal_type("teredo_hdr")->AsRecordType();
|
||||||
|
teredo_auth_type = internal_type("teredo_auth")->AsRecordType();
|
||||||
|
teredo_origin_type = internal_type("teredo_origin")->AsRecordType();
|
||||||
|
}
|
||||||
|
|
||||||
|
RecordVal* teredo_hdr = new RecordVal(teredo_hdr_type);
|
||||||
|
|
||||||
|
if ( auth )
|
||||||
|
{
|
||||||
|
RecordVal* teredo_auth = new RecordVal(teredo_auth_type);
|
||||||
|
uint8 id_len = *((uint8*)(auth + 2));
|
||||||
|
uint8 au_len = *((uint8*)(auth + 3));
|
||||||
|
uint64 nonce = ntohll(*((uint64*)(auth + 4 + id_len + au_len)));
|
||||||
|
uint8 conf = *((uint8*)(auth + 4 + id_len + au_len + 8));
|
||||||
|
teredo_auth->Assign(0, new StringVal(
|
||||||
|
new BroString(auth + 4, id_len, 1)));
|
||||||
|
teredo_auth->Assign(1, new StringVal(
|
||||||
|
new BroString(auth + 4 + id_len, au_len, 1)));
|
||||||
|
teredo_auth->Assign(2, new Val(nonce, TYPE_COUNT));
|
||||||
|
teredo_auth->Assign(3, new Val(conf, TYPE_COUNT));
|
||||||
|
teredo_hdr->Assign(0, teredo_auth);
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( origin_indication )
|
||||||
|
{
|
||||||
|
RecordVal* teredo_origin = new RecordVal(teredo_origin_type);
|
||||||
|
uint16 port = ntohs(*((uint16*)(origin_indication + 2))) ^ 0xFFFF;
|
||||||
|
uint32 addr = ntohl(*((uint32*)(origin_indication + 4))) ^ 0xFFFFFFFF;
|
||||||
|
teredo_origin->Assign(0, new PortVal(port, TRANSPORT_UDP));
|
||||||
|
teredo_origin->Assign(1, new AddrVal(htonl(addr)));
|
||||||
|
teredo_hdr->Assign(1, teredo_origin);
|
||||||
|
}
|
||||||
|
|
||||||
|
teredo_hdr->Assign(2, inner->BuildPktHdrVal());
|
||||||
|
return teredo_hdr;
|
||||||
|
}
|
||||||
|
|
||||||
void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
|
void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
|
||||||
int seq, const IP_Hdr* ip, int caplen)
|
int seq, const IP_Hdr* ip, int caplen)
|
||||||
{
|
{
|
||||||
|
|
@ -121,7 +166,28 @@ void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
|
||||||
|
|
||||||
if ( rslt != 0 ) return;
|
if ( rslt != 0 ) return;
|
||||||
|
|
||||||
// TODO: raise Teredo-specific events for bubbles, origin/authentication
|
Val* teredo_hdr = 0;
|
||||||
|
|
||||||
|
if ( teredo_packet )
|
||||||
|
{
|
||||||
|
teredo_hdr = te.BuildVal(inner);
|
||||||
|
Conn()->Event(teredo_packet, 0, teredo_hdr);
|
||||||
|
}
|
||||||
|
if ( te.Authentication() && teredo_authentication )
|
||||||
|
{
|
||||||
|
teredo_hdr = teredo_hdr ? teredo_hdr->Ref() : te.BuildVal(inner);
|
||||||
|
Conn()->Event(teredo_authentication, 0, teredo_hdr);
|
||||||
|
}
|
||||||
|
if ( te.OriginIndication() && teredo_origin_indication )
|
||||||
|
{
|
||||||
|
teredo_hdr = teredo_hdr ? teredo_hdr->Ref() : te.BuildVal(inner);
|
||||||
|
Conn()->Event(teredo_origin_indication, 0, teredo_hdr);
|
||||||
|
}
|
||||||
|
if ( inner->NextProto() == IPPROTO_NONE && teredo_bubble )
|
||||||
|
{
|
||||||
|
teredo_hdr = teredo_hdr ? teredo_hdr->Ref() : te.BuildVal(inner);
|
||||||
|
Conn()->Event(teredo_bubble, 0, teredo_hdr);
|
||||||
|
}
|
||||||
|
|
||||||
Encapsulation* outer = new Encapsulation(e);
|
Encapsulation* outer = new Encapsulation(e);
|
||||||
EncapsulatingConn ec(Conn(), BifEnum::Tunnel::TEREDO);
|
EncapsulatingConn ec(Conn(), BifEnum::Tunnel::TEREDO);
|
||||||
|
|
|
||||||
|
|
@ -62,6 +62,8 @@ public:
|
||||||
const u_char* Authentication() const
|
const u_char* Authentication() const
|
||||||
{ return auth; }
|
{ return auth; }
|
||||||
|
|
||||||
|
RecordVal* BuildVal(const IP_Hdr* inner) const;
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
bool DoParse(const u_char* data, int& len, bool found_orig, bool found_au);
|
bool DoParse(const u_char* data, int& len, bool found_orig, bool found_au);
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -511,6 +511,61 @@ event esp_packet%(p: pkt_hdr%);
|
||||||
## .. bro:see:: new_packet tcp_packet ipv6_ext_headers
|
## .. bro:see:: new_packet tcp_packet ipv6_ext_headers
|
||||||
event mobile_ipv6_message%(p: pkt_hdr%);
|
event mobile_ipv6_message%(p: pkt_hdr%);
|
||||||
|
|
||||||
|
## Genereated for any IPv6 packet encapsulated in a Teredo tunnel.
|
||||||
|
## See :rfc:`4380` for more information about the Teredo protocol.
|
||||||
|
##
|
||||||
|
## outer: The Teredo tunnel connection.
|
||||||
|
##
|
||||||
|
## inner: The Teredo-encapsulated IPv6 packet header and transport header.
|
||||||
|
##
|
||||||
|
## .. bro:see:: teredo_authentication teredo_origin_indication teredo_bubble
|
||||||
|
##
|
||||||
|
## .. note:: Since this event may be raised on a per-packet basis, handling
|
||||||
|
## it may become particular expensive for real-time analysis.
|
||||||
|
event teredo_packet%(outer: connection, inner: teredo_hdr%);
|
||||||
|
|
||||||
|
## Genereated for IPv6 packets encapsulated in a Teredo tunnel that
|
||||||
|
## use the Teredo authentication encapsulation method.
|
||||||
|
## See :rfc:`4380` for more information about the Teredo protocol.
|
||||||
|
##
|
||||||
|
## outer: The Teredo tunnel connection.
|
||||||
|
##
|
||||||
|
## inner: The Teredo-encapsulated IPv6 packet header and transport header.
|
||||||
|
##
|
||||||
|
## .. bro:see:: teredo_packet teredo_origin_indication teredo_bubble
|
||||||
|
##
|
||||||
|
## .. note:: Since this event may be raised on a per-packet basis, handling
|
||||||
|
## it may become particular expensive for real-time analysis.
|
||||||
|
event teredo_authentication%(outer: connection, inner: teredo_hdr%);
|
||||||
|
|
||||||
|
## Genereated for IPv6 packets encapsulated in a Teredo tunnel that
|
||||||
|
## use the Teredo origin indication encapsulation method.
|
||||||
|
## See :rfc:`4380` for more information about the Teredo protocol.
|
||||||
|
##
|
||||||
|
## outer: The Teredo tunnel connection.
|
||||||
|
##
|
||||||
|
## inner: The Teredo-encapsulated IPv6 packet header and transport header.
|
||||||
|
##
|
||||||
|
## .. bro:see:: teredo_packet teredo_authentication teredo_bubble
|
||||||
|
##
|
||||||
|
## .. note:: Since this event may be raised on a per-packet basis, handling
|
||||||
|
## it may become particular expensive for real-time analysis.
|
||||||
|
event teredo_origin_indication%(outer: connection, inner: teredo_hdr%);
|
||||||
|
|
||||||
|
## Genereated for Teredo bubble packets. That is, IPv6 packets encapsulated
|
||||||
|
## in a Teredo tunnel that have a Next Header value of :bro:id:`IPPROTO_NONE`.
|
||||||
|
## See :rfc:`4380` for more information about the Teredo protocol.
|
||||||
|
##
|
||||||
|
## outer: The Teredo tunnel connection.
|
||||||
|
##
|
||||||
|
## inner: The Teredo-encapsulated IPv6 packet header and transport header.
|
||||||
|
##
|
||||||
|
## .. bro:see:: teredo_packet teredo_authentication teredo_origin_indication
|
||||||
|
##
|
||||||
|
## .. note:: Since this event may be raised on a per-packet basis, handling
|
||||||
|
## it may become particular expensive for real-time analysis.
|
||||||
|
event teredo_bubble%(outer: connection, inner: teredo_hdr%);
|
||||||
|
|
||||||
## Generated for every packet that has non-empty transport-layer payload. This is a
|
## Generated for every packet that has non-empty transport-layer payload. This is a
|
||||||
## very low-level and expensive event that should be avoided when at all possible.
|
## very low-level and expensive event that should be avoided when at all possible.
|
||||||
## It's usually infeasible to handle when processing even medium volumes of
|
## It's usually infeasible to handle when processing even medium volumes of
|
||||||
|
|
|
||||||
28
testing/btest/Baseline/core.tunnels.teredo/conn.log
Normal file
28
testing/btest/Baseline/core.tunnels.teredo/conn.log
Normal file
|
|
@ -0,0 +1,28 @@
|
||||||
|
#separator \x09
|
||||||
|
#set_separator ,
|
||||||
|
#empty_field (empty)
|
||||||
|
#unset_field -
|
||||||
|
#path conn
|
||||||
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes parents
|
||||||
|
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
||||||
|
1210953047.736921 arKYeMETxOg 192.168.2.16 1576 75.126.130.163 80 tcp - 0.000357 0 0 SHR - 0 fA 1 40 1 40 (empty)
|
||||||
|
1210953050.867067 k6kgXLOoSKl 192.168.2.16 1577 75.126.203.78 80 tcp - 0.000387 0 0 SHR - 0 fA 1 40 1 40 (empty)
|
||||||
|
1210953057.833364 5OKnoww6xl4 192.168.2.16 1577 75.126.203.78 80 tcp - 0.079208 0 0 SH - 0 Fa 1 40 1 40 (empty)
|
||||||
|
1210953058.007081 VW0XPVINV8a 192.168.2.16 1576 75.126.130.163 80 tcp - - - - RSTOS0 - 0 R 1 40 0 0 (empty)
|
||||||
|
1210953057.834454 3PKsZ2Uye21 192.168.2.16 1578 75.126.203.78 80 tcp http 0.407908 790 171 RSTO - 0 ShADadR 6 1038 4 335 (empty)
|
||||||
|
1210953058.350065 fRFu0wcOle6 192.168.2.16 1920 192.168.2.1 53 udp dns 0.223055 66 438 SF - 0 Dd 2 122 2 494 (empty)
|
||||||
|
1210953058.577231 qSsw6ESzHV4 192.168.2.16 137 192.168.2.255 137 udp dns 1.499261 150 0 S0 - 0 D 3 234 0 0 (empty)
|
||||||
|
1210953074.264819 Tw8jXtpTGu6 192.168.2.16 1920 192.168.2.1 53 udp dns 0.297723 123 598 SF - 0 Dd 3 207 3 682 (empty)
|
||||||
|
1210953061.312379 70MGiRM1Qf4 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 12.810848 1675 10467 S1 - 0 ShADad 10 2279 12 11191 GSxOnSLghOa
|
||||||
|
1210953076.058333 EAr0uf4mhq 192.168.2.16 1578 75.126.203.78 80 tcp - - - - RSTRH - 0 r 0 0 1 40 (empty)
|
||||||
|
1210953074.055744 h5DsfNtYzi1 192.168.2.16 1577 75.126.203.78 80 tcp - - - - RSTRH - 0 r 0 0 1 40 (empty)
|
||||||
|
1210953074.057124 P654jzLoe3a 192.168.2.16 1576 75.126.130.163 80 tcp - - - - RSTRH - 0 r 0 0 1 40 (empty)
|
||||||
|
1210953074.570439 c4Zw9TmAE05 192.168.2.16 1580 67.228.110.120 80 tcp http 0.466677 469 3916 SF - 0 ShADadFf 7 757 6 4164 (empty)
|
||||||
|
1210953052.202579 nQcgTWjvg4c 192.168.2.16 3797 65.55.158.80 3544 udp teredo 8.928880 129 48 SF - 0 Dd 2 185 1 76 (empty)
|
||||||
|
1210953060.829233 GSxOnSLghOa 192.168.2.16 3797 83.170.1.38 32900 udp teredo 13.293994 2359 11243 SF - 0 Dd 12 2695 13 11607 (empty)
|
||||||
|
1210953058.933954 iE6yhOq3SF 0.0.0.0 68 255.255.255.255 67 udp - - - - S0 - 0 D 1 328 0 0 (empty)
|
||||||
|
1210953052.324629 TEfuqmmG4bh 192.168.2.16 3797 65.55.158.81 3544 udp teredo - - - SHR - 0 d 0 0 1 137 (empty)
|
||||||
|
1210953046.591933 UWkUyAuUGXf 192.168.2.16 138 192.168.2.255 138 udp - 28.448321 416 0 S0 - 0 D 2 472 0 0 (empty)
|
||||||
|
1210953052.324629 FrJExwHcSal fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - 0 - 1 88 0 0 TEfuqmmG4bh
|
||||||
|
1210953060.829303 qCaWGmzFtM5 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.463615 4 4 OTH - 0 - 1 52 1 52 GSxOnSLghOa,nQcgTWjvg4c
|
||||||
|
1210953052.202579 j4u32Pc5bif fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - 0 - 1 64 0 0 nQcgTWjvg4c
|
||||||
11
testing/btest/Baseline/core.tunnels.teredo/http.log
Normal file
11
testing/btest/Baseline/core.tunnels.teredo/http.log
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
#separator \x09
|
||||||
|
#set_separator ,
|
||||||
|
#empty_field (empty)
|
||||||
|
#unset_field -
|
||||||
|
#path http
|
||||||
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||||
|
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
|
||||||
|
1210953057.917183 3PKsZ2Uye21 192.168.2.16 1578 75.126.203.78 80 1 POST download913.avast.com /cgi-bin/iavs4stats.cgi - Syncer/4.80 (av_pro-1169;f) 589 0 204 <empty> - - - (empty) - - - text/plain - -
|
||||||
|
1210953061.585996 70MGiRM1Qf4 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - text/html - -
|
||||||
|
1210953073.381474 70MGiRM1Qf4 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - text/html - -
|
||||||
|
1210953074.674817 c4Zw9TmAE05 192.168.2.16 1580 67.228.110.120 80 1 GET www.wireshark.org / http://ipv6.google.com/search?hl=en&q=Wireshark+%21&btnG=Google+Search Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 11845 200 OK - - - (empty) - - - text/xml - -
|
||||||
83
testing/btest/Baseline/core.tunnels.teredo/output
Normal file
83
testing/btest/Baseline/core.tunnels.teredo/output
Normal file
|
|
@ -0,0 +1,83 @@
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=65.55.158.80, resp_p=3544/udp]
|
||||||
|
ip6: [class=0, flow=0, len=24, nxt=58, hlim=255, src=fe80::8000:ffff:ffff:fffd, dst=ff02::2, exts=[]]
|
||||||
|
auth: [id=, value=, nonce=14796129349558001544, confirm=0]
|
||||||
|
auth: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=65.55.158.80, resp_p=3544/udp]
|
||||||
|
ip6: [class=0, flow=0, len=24, nxt=58, hlim=255, src=fe80::8000:ffff:ffff:fffd, dst=ff02::2, exts=[]]
|
||||||
|
auth: [id=, value=, nonce=14796129349558001544, confirm=0]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=65.55.158.81, resp_p=3544/udp]
|
||||||
|
ip6: [class=0, flow=0, len=48, nxt=58, hlim=255, src=fe80::8000:f227:bec8:61af, dst=fe80::8000:ffff:ffff:fffd, exts=[]]
|
||||||
|
auth: [id=, value=, nonce=14796129349558001544, confirm=0]
|
||||||
|
origin: [p=3797/udp, a=70.55.215.234]
|
||||||
|
auth: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=65.55.158.81, resp_p=3544/udp]
|
||||||
|
ip6: [class=0, flow=0, len=48, nxt=58, hlim=255, src=fe80::8000:f227:bec8:61af, dst=fe80::8000:ffff:ffff:fffd, exts=[]]
|
||||||
|
auth: [id=, value=, nonce=14796129349558001544, confirm=0]
|
||||||
|
origin: [p=3797/udp, a=70.55.215.234]
|
||||||
|
origin: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=65.55.158.81, resp_p=3544/udp]
|
||||||
|
ip6: [class=0, flow=0, len=48, nxt=58, hlim=255, src=fe80::8000:f227:bec8:61af, dst=fe80::8000:ffff:ffff:fffd, exts=[]]
|
||||||
|
auth: [id=, value=, nonce=14796129349558001544, confirm=0]
|
||||||
|
origin: [p=3797/udp, a=70.55.215.234]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=0, nxt=59, hlim=21, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
bubble: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=0, nxt=59, hlim=21, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=65.55.158.80, resp_p=3544/udp]
|
||||||
|
ip6: [class=0, flow=0, len=12, nxt=58, hlim=21, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=65.55.158.80, resp_p=3544/udp]
|
||||||
|
ip6: [class=0, flow=0, len=0, nxt=59, hlim=0, src=fe80::708d:fe83:4114:a512, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
origin: [p=32900/udp, a=83.170.1.38]
|
||||||
|
origin: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=65.55.158.80, resp_p=3544/udp]
|
||||||
|
ip6: [class=0, flow=0, len=0, nxt=59, hlim=0, src=fe80::708d:fe83:4114:a512, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
origin: [p=32900/udp, a=83.170.1.38]
|
||||||
|
bubble: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=65.55.158.80, resp_p=3544/udp]
|
||||||
|
ip6: [class=0, flow=0, len=0, nxt=59, hlim=0, src=fe80::708d:fe83:4114:a512, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
origin: [p=32900/udp, a=83.170.1.38]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=0, nxt=59, hlim=0, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=fe80::708d:fe83:4114:a512, exts=[]]
|
||||||
|
bubble: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=0, nxt=59, hlim=0, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=fe80::708d:fe83:4114:a512, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=12, nxt=58, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=24, nxt=6, hlim=128, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=24, nxt=6, hlim=245, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=20, nxt=6, hlim=128, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=817, nxt=6, hlim=128, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=20, nxt=6, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=1232, nxt=6, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=1232, nxt=6, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=20, nxt=6, hlim=128, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=514, nxt=6, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=20, nxt=6, hlim=128, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=898, nxt=6, hlim=128, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=1232, nxt=6, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=1232, nxt=6, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=20, nxt=6, hlim=128, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=812, nxt=6, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=20, nxt=6, hlim=128, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=1232, nxt=6, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=1232, nxt=6, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=20, nxt=6, hlim=128, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=1232, nxt=6, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=717, nxt=6, hlim=58, src=2001:4860:0:2001::68, dst=2001:0:4137:9e50:8000:f12a:b9c8:2815, exts=[]]
|
||||||
|
packet: [orig_h=192.168.2.16, orig_p=3797/udp, resp_h=83.170.1.38, resp_p=32900/udp]
|
||||||
|
ip6: [class=0, flow=0, len=20, nxt=6, hlim=128, src=2001:0:4137:9e50:8000:f12a:b9c8:2815, dst=2001:4860:0:2001::68, exts=[]]
|
||||||
13
testing/btest/Baseline/core.tunnels.teredo/tunnel.log
Normal file
13
testing/btest/Baseline/core.tunnels.teredo/tunnel.log
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
#separator \x09
|
||||||
|
#set_separator ,
|
||||||
|
#empty_field (empty)
|
||||||
|
#unset_field -
|
||||||
|
#path tunnel
|
||||||
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p action tunnel_type user
|
||||||
|
#types time string addr port addr port enum enum string
|
||||||
|
1210953052.202579 nQcgTWjvg4c 192.168.2.16 3797 65.55.158.80 3544 Tunnel::DISCOVER Tunnel::TEREDO -
|
||||||
|
1210953052.324629 TEfuqmmG4bh 192.168.2.16 3797 65.55.158.81 3544 Tunnel::DISCOVER Tunnel::TEREDO -
|
||||||
|
1210953061.292918 GSxOnSLghOa 192.168.2.16 3797 83.170.1.38 32900 Tunnel::DISCOVER Tunnel::TEREDO -
|
||||||
|
1210953076.058333 nQcgTWjvg4c 192.168.2.16 3797 65.55.158.80 3544 Tunnel::CLOSE Tunnel::TEREDO -
|
||||||
|
1210953076.058333 GSxOnSLghOa 192.168.2.16 3797 83.170.1.38 32900 Tunnel::CLOSE Tunnel::TEREDO -
|
||||||
|
1210953076.058333 TEfuqmmG4bh 192.168.2.16 3797 65.55.158.81 3544 Tunnel::CLOSE Tunnel::TEREDO -
|
||||||
BIN
testing/btest/Traces/tunnels/Teredo.pcap
Normal file
BIN
testing/btest/Traces/tunnels/Teredo.pcap
Normal file
Binary file not shown.
35
testing/btest/core/tunnels/teredo.bro
Normal file
35
testing/btest/core/tunnels/teredo.bro
Normal file
|
|
@ -0,0 +1,35 @@
|
||||||
|
# @TEST-EXEC: bro -r $TRACES/tunnels/Teredo.pcap %INPUT >output
|
||||||
|
# @TEST-EXEC: btest-diff output
|
||||||
|
# @TEST-EXEC: btest-diff tunnel.log
|
||||||
|
# @TEST-EXEC: btest-diff conn.log
|
||||||
|
# @TEST-EXEC: btest-diff http.log
|
||||||
|
|
||||||
|
function print_teredo(name: string, outer: connection, inner: teredo_hdr)
|
||||||
|
{
|
||||||
|
print fmt("%s: %s", name, outer$id);
|
||||||
|
print fmt(" ip6: %s", inner$hdr$ip6);
|
||||||
|
if ( inner?$auth )
|
||||||
|
print fmt(" auth: %s", inner$auth);
|
||||||
|
if ( inner?$origin )
|
||||||
|
print fmt(" origin: %s", inner$origin);
|
||||||
|
}
|
||||||
|
|
||||||
|
event teredo_packet(outer: connection, inner: teredo_hdr)
|
||||||
|
{
|
||||||
|
print_teredo("packet", outer, inner);
|
||||||
|
}
|
||||||
|
|
||||||
|
event teredo_authentication(outer: connection, inner: teredo_hdr)
|
||||||
|
{
|
||||||
|
print_teredo("auth", outer, inner);
|
||||||
|
}
|
||||||
|
|
||||||
|
event teredo_origin_indication(outer: connection, inner: teredo_hdr)
|
||||||
|
{
|
||||||
|
print_teredo("origin", outer, inner);
|
||||||
|
}
|
||||||
|
|
||||||
|
event teredo_bubble(outer: connection, inner: teredo_hdr)
|
||||||
|
{
|
||||||
|
print_teredo("bubble", outer, inner);
|
||||||
|
}
|
||||||
Loading…
Add table
Add a link
Reference in a new issue