mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 21:48:21 +00:00
18499fd7d9
Add the folowing option types: - 55 Parameters Request List; - 58 Renewal time; - 59 Rebinding time; - 61 Client Identifier; - 82 Relay Agent Information. Extend the following events with new parameters, specifically: - dhcp_discover exports client identifier and parameters request list; - dhcp_request exports client_identifier and parameters request list; - dhcp_ack exports rebinding time, renewal time and list of suboptions value of dhcp relay agent information option; - dhcp_inform exports parameters request list. Add option type specific variables within the scope of DHCP module (see src/analyzer/protocol/dhcp/types.bif). Move protocol specific variables "dhcp_msg" and "dhcp_router_list" from scope Global to DHCP:: and adapt inet_net_var in src/NetVar.cc consequently. Extend src/analyzer/protocols/dhcp/main.bro to handle the new events and to log dhcp_ack, dhcp_request and dhcp_discover. Modify scripts/policy/protocols/dhcp/known-devices-and-hostnames.bro to include new events' variables.
37 lines
1,020 B
Text
37 lines
1,020 B
Text
##! Tracks MAC address with hostnames seen in DHCP traffic. They are logged into
|
|
##! ``devices.log``.
|
|
|
|
@load policy/misc/known-devices
|
|
|
|
module Known;
|
|
|
|
export {
|
|
redef record DevicesInfo += {
|
|
## The value of the DHCP host name option, if seen.
|
|
dhcp_host_name: string &log &optional;
|
|
};
|
|
}
|
|
|
|
event dhcp_request(c: connection, msg: DHCP::dhcp_msg, req_addr: addr, serv_addr: addr, host_name: string, client_id: DHCP::dhcp_client_id, req_params: DHCP::dhcp_params_list)
|
|
{
|
|
if ( msg$h_addr == "" )
|
|
return;
|
|
|
|
if ( msg$h_addr !in known_devices )
|
|
{
|
|
add known_devices[msg$h_addr];
|
|
Log::write(Known::DEVICES_LOG, [$ts=network_time(), $mac=msg$h_addr, $dhcp_host_name=host_name]);
|
|
}
|
|
}
|
|
|
|
event dhcp_inform(c: connection, msg: DHCP::dhcp_msg, host_name: string, req_params: DHCP::dhcp_params_list)
|
|
{
|
|
if ( msg$h_addr == "" )
|
|
return;
|
|
|
|
if ( msg$h_addr !in known_devices )
|
|
{
|
|
add known_devices[msg$h_addr];
|
|
Log::write(Known::DEVICES_LOG, [$ts=network_time(), $mac=msg$h_addr, $dhcp_host_name=host_name]);
|
|
}
|
|
}
|