Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 19:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-999: Stop formatting DHCP Client ID Hardware Type 0 as MAC

Browse source 
For `DHCP::ClientID$hwtype` fields equal to 0, the `hwaddr` field is
no longer misformatted as a MAC and instead just contains the raw bytes
seen in the DHCP Client ID Option.
This commit is contained in:
Jon Siwek 2020-06-04 10:26:23 -07:00
parent 02476453bc
commit 96f7226b52
4 changed files with 27 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
testing/btest/scripts/base/protocols/dhcp/hw-type0.zeek Normal file
View file

@ -0,0 +1,16 @@
# @TEST-EXEC: zeek -b -r $TRACES/dhcp/hw-type0.pcap %INPUT >out
# @TEST-EXEC: btest-diff out
const ports = { 67/udp, 68/udp };
redef likely_server_ports += { 67/udp };
event zeek_init() &priority=5
{
Analyzer::register_for_ports(Analyzer::ANALYZER_DHCP, ports);
}
event dhcp_message(c: connection, is_orig: bool, msg: DHCP::Msg, options: DHCP::Options)
{
if ( options?$client_id )
print "dhcp client_id option", options$client_id;
}