mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
5dc630f722
- Introducing analyzer::<protocol> namespaces. - Moving protocol-specific events out of events.bif into analyzer/protocol/<protocol>/events.bif - Moving ARP over (even though it's not an actual analyzer). - Moving NetFlow over (even though it's not an actual analyzer). - Moving MIME over (even though it's not an actual analyzer).
60 lines
1.4 KiB
C++
60 lines
1.4 KiB
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#ifndef arp_h
|
|
#define arp_h
|
|
|
|
#include "config.h"
|
|
#include <sys/types.h>
|
|
#include <sys/socket.h>
|
|
#include <netinet/in.h>
|
|
#include <net/if.h>
|
|
#include <net/if_arp.h>
|
|
#ifdef HAVE_NET_ETHERNET_H
|
|
#include <net/ethernet.h>
|
|
#elif defined(HAVE_SYS_ETHERNET_H)
|
|
#include <sys/ethernet.h>
|
|
#elif defined(HAVE_NETINET_IF_ETHER_H)
|
|
#include <netinet/if_ether.h>
|
|
#elif defined(HAVE_NET_ETHERTYPES_H)
|
|
#include <net/ethertypes.h>
|
|
#endif
|
|
|
|
#ifndef arp_pkthdr
|
|
#define arp_pkthdr arphdr
|
|
#endif
|
|
|
|
#include "NetVar.h"
|
|
#include "PacketSort.h"
|
|
|
|
namespace analyzer { namespace arp {
|
|
|
|
class ARP_Analyzer : public BroObj {
|
|
public:
|
|
ARP_Analyzer();
|
|
virtual ~ARP_Analyzer();
|
|
|
|
void NextPacket(double t, const struct pcap_pkthdr* hdr,
|
|
const u_char* const pkt, int hdr_size);
|
|
|
|
void Describe(ODesc* d) const;
|
|
void RREvent(EventHandlerPtr e, const u_char* src, const u_char* dst,
|
|
const char* spa, const char* sha,
|
|
const char* tpa, const char* tha);
|
|
|
|
// Whether a packet is of interest for ARP analysis.
|
|
static bool IsARP(const u_char* pkt, int hdr_size);
|
|
|
|
protected:
|
|
AddrVal* ConstructAddrVal(const void* addr);
|
|
StringVal* EthAddrToStr(const u_char* addr);
|
|
void BadARP(const struct arp_pkthdr* hdr, const char* string);
|
|
void Corrupted(const char* string);
|
|
|
|
EventHandlerPtr arp_corrupted_packet;
|
|
EventHandlerPtr arp_request;
|
|
EventHandlerPtr arp_reply;
|
|
};
|
|
|
|
} } // namespace analyzer::*
|
|
|
|
#endif
|