Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Remove non-standard way of forwarding out of the Ethernet analyzer

Browse source
This commit is contained in:
Tim Wojtulewicz 2023-04-19 10:25:39 -07:00 • committed by Tim Wojtulewicz
parent 7e88a2b3fb
commit c5b8603218
14 changed files with 48 additions and 102 deletions
Download patch file Download diff file Expand all files Collapse all files

23
scripts/base/packet-protocols/ethernet/main.zeek
View file

@ -1,13 +1,13 @@
module PacketAnalyzer::ETHERNET;
export {
## IEEE 802.2 SNAP analyzer
global snap_analyzer: PacketAnalyzer::Tag &redef;
## Novell raw IEEE 802.3 analyzer
global novell_raw_analyzer: PacketAnalyzer::Tag &redef;
## IEEE 802.2 LLC analyzer
global llc_analyzer: PacketAnalyzer::Tag &redef;
}
export
{
# We use some magic numbers here to denote these. The values here are outside the range of the
# standard ethertypes, which should always be above 1536.
const SNAP_FORWARDING_KEY : count = 0x0001;
const NOVELL_FORWARDING_KEY : count = 0x0002;
const LLC_FORWARDING_KEY : count = 0x0003;
}
event zeek_init() &priority=20
{
@ -22,4 +22,11 @@ event zeek_init() &priority=20
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x9100, PacketAnalyzer::ANALYZER_VLAN);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x8864, PacketAnalyzer::ANALYZER_PPPOE);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x8926, PacketAnalyzer::ANALYZER_VNTAG);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, SNAP_FORWARDING_KEY,
PacketAnalyzer::ANALYZER_SNAP);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, NOVELL_FORWARDING_KEY,
PacketAnalyzer::ANALYZER_NOVELL_802_3);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, LLC_FORWARDING_KEY,
PacketAnalyzer::ANALYZER_LLC);
}