mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 05:28:20 +00:00
Add SNMP datagram parsing support.
This supports parsing of SNMPv1 (RFC 1157), SNMPv2 (RFC 1901/3416), and SNMPv2 (RFC 3412). An event is raised for each SNMP PDU type, though there's not currently any event handlers for them and not a default snmp.log either. However, simple presence of SNMP is currently visible now in conn.log service field and known_services.log.
This commit is contained in:
parent
ba81aa4387
commit
a0c06a957b
38 changed files with 2345 additions and 8 deletions
15
scripts/base/protocols/snmp/main.bro
Normal file
15
scripts/base/protocols/snmp/main.bro
Normal file
|
@ -0,0 +1,15 @@
|
|||
##! Enables analysis of SNMP datagrams.
|
||||
|
||||
module SNMP;
|
||||
|
||||
export {
|
||||
}
|
||||
|
||||
const ports = { 161/udp, 162/udp };
|
||||
|
||||
redef likely_server_ports += { ports };
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_SNMP, ports);
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue