Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/timw/1764-geneve-to-ip'

Browse source 
* origin/topic/timw/1764-geneve-to-ip:
  GH-1764: Update mappings for Geneve analyzer to IP4/IP6/ARP
This commit is contained in:
Tim Wojtulewicz 2021-12-07 09:34:45 -07:00
commit 8df195e35f
3 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,3 +1,7 @@
4.2.0-dev.419 | 2021-12-07 09:34:45 -0700
* GH-1764: Update mappings for Geneve analyzer to IP4/IP6/ARP (Tim Wojtulewicz, Corelight)
4.2.0-dev.417 | 2021-12-06 17:00:16 -0800
* Flip C++ unit tests to being enabled by default (Christian Kreibich, Corelight)

2
VERSION
View file

@ -1 +1 @@
4.2.0-dev.417
4.2.0-dev.419

5
scripts/base/packet-protocols/geneve/main.zeek
View file

@ -19,4 +19,9 @@ event zeek_init() &priority=20
# https://datatracker.ietf.org/doc/html/draft-gross-geneve-00#section-3.4
# for details.
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 0x6558, PacketAnalyzer::ANALYZER_ETHERNET);
# Some additional mappings for protocols that we already handle natively.
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 0x0800, PacketAnalyzer::ANALYZER_IP);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 0x08DD, PacketAnalyzer::ANALYZER_IP);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 0x0808, PacketAnalyzer::ANALYZER_ARP);
}