Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 21:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add GPRS Tunnelling Protocol (GTPv1) decapsulation.

Browse source 
This currently supports automatic decapsulation of GTP-U packets on
UDP port 2152.

The GTPv1 headers for such tunnels can be inspected by handling the
"gtpv1_g_pdu_packet" event, which has a parameter of type "gtpv1_hdr".

Analyzer and test cases are derived from submissions by Carsten Langer.

Addresses #690.
This commit is contained in:
Jon Siwek 2012-10-19 14:02:35 -05:00
parent 2915e04db4
commit 9edbf3e53c
52 changed files with 670 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

24
src/GTPv1.cc Normal file
View file

@ -0,0 +1,24 @@
#include "GTPv1.h"
GTPv1_Analyzer::GTPv1_Analyzer(Connection* conn)
: Analyzer(AnalyzerTag::GTPv1, conn)
{
interp = new binpac::GTPv1::GTPv1_Conn(this);
}
GTPv1_Analyzer::~GTPv1_Analyzer()
{
delete interp;
}
void GTPv1_Analyzer::Done()
{
Analyzer::Done();
Event(udp_session_done);
}
void GTPv1_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, int seq, const IP_Hdr* ip, int caplen)
{
Analyzer::DeliverPacket(len, data, orig, seq, ip, caplen);
interp->NewData(orig, data, data + len);
}