Exemplo n.º 1
0
int DissecRegist(const char *file_cfg)
{
    proto_dep dep;

    memset(&dep, 0, sizeof(proto_dep));

    /* protocol name */
    ProtName("802.11 Radiotap", "radiotap");

    /* pcapf dependence */
    dep.name = "pcapf";
    dep.attr = "pcapf.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_IEEE802_11_RADIO;
    ProtDep(&dep);
    
    /* pol dependence */
    dep.name = "pol";
    dep.attr = "pol.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_IEEE802_11_RADIO;
    ProtDep(&dep);

    /* dissectors registration */
    ProtDissectors(RadiotapDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 2
0
int DissecRegist(const char *file_cfg)
{
    proto_heury_dep hdep;
    pei_cmpt peic;
    char cfg[TCP_GRB_FILENAME_PATH_SIZE];

    memset(&hdep, 0, sizeof(proto_heury_dep));
    memset(&peic, 0, sizeof(pei_cmpt));
 
    /* protocol name */
    ProtName("TCP garbage", "tcp-grb");

    /* dep: tcp */
    hdep.name = "tcp";
    hdep.ProtCheck = TcpGrbCheck;
    ProtHeuDep(&hdep);

    /* PEI components */
    peic.abbrev = "l7prot";
    peic.desc = "L7 protocol march";
    ProtPeiComponent(&peic);

    peic.abbrev = "txt";
    peic.desc = "Text file";
    ProtPeiComponent(&peic);

    peic.abbrev = "size";
    peic.desc = "Flow total size";
    ProtPeiComponent(&peic);

    peic.abbrev = "file";
    peic.desc = "File extracted";
    ProtPeiComponent(&peic);

    peic.abbrev = "ftype";
    peic.desc = "File type";
    ProtPeiComponent(&peic);
    
    dig_type_dim = 0;
    dig_tbl = NULL;
#if GRB_DIG_ENABLE
    enable_dig = TRUE;
#else
    enable_dig = FALSE;
#endif

    /* load config file data */
    if (CfgParamStr(file_cfg, TCP_GRB_CFG_FILE, cfg, TCP_GRB_FILENAME_PATH_SIZE) == 0)
        TcpGrbCfg(cfg);

    if (CfgParamInt(file_cfg, TCP_GRB_PKT_LIMIT_CFG, &limit_pkts) != 0)
        limit_pkts = TCP_GRB_PKT_LIMIT;
    if (enable_dig == FALSE)
        dig_type_dim = 0;
    
    /* dissectors subdissectors registration */
    ProtDissectors(NULL, TcpGrbDissector, NULL, NULL);

    return 0;
}
Exemplo n.º 3
0
Arquivo: sdp.c Projeto: Cbrdiv/xplico
int DissecRegist(const char *file_cfg)
{
    /* protocol name */
    ProtName("Session Description Protocol", "sdp");

    /* dissectors registration */
    ProtDissectors(SdpDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 4
0
int DissecRegist(const char *file_cfg)
{
    proto_info info;
    proto_dep dep;

    memset(&info, 0, sizeof(proto_info));
    memset(&dep, 0, sizeof(proto_dep));

    /* protocol name */
    ProtName("PPP-over-Ethernet Session", "pppoe");
    
    /* Type */
    info.name = "Type";
    info.abbrev = "pppoe.type";
    info.type = FT_UINT8;
    type_id = ProtInfo(&info);
    
    /* Code */
    info.name = "Code";
    info.abbrev = "pppoe.code";
    info.type = FT_UINT8;
    code_id = ProtInfo(&info);

    /* Session ID */
    info.name = "Session ID";
    info.abbrev = "pppoe.session_id";
    info.type = FT_UINT16;
    ses_id = ProtInfo(&info);
    
    /* ethernet dependence */
    dep.name = "eth";
    dep.attr = "eth.type";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_PPPOES;
    ProtDep(&dep);
    
    /* vlan dependence */
    dep.name = "vlan";
    dep.attr = "vlan.type";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_PPPOES;
    ProtDep(&dep);

    /* rule */
    /*ProtAddRule("(pppoe.session_id == pkt.pppoe.session_id)");*/
#warning "deadlock"

    /* dissectors registration */
    ProtDissectors(PppoeDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 5
0
int DissecRegist(const char *file_cfg)
{
    proto_dep dep;
    pei_cmpt peic;
    bool hins;
    
    insert_http = FALSE;
    if (file_cfg != NULL) {
        if (CfgParamBool(file_cfg, "HTTPFD_HTTP_INSERT", &hins) == 0) {
            if (hins) {
                insert_http = TRUE;
            }
        }
    }

    memset(&dep, 0, sizeof(proto_dep));
    memset(&peic, 0, sizeof(pei_cmpt));

    /* protocol name */
    ProtName("Http file download", "httpfd");

    /* http dependence */
    dep.name = "http";
    dep.attr = "http.content_range";
    dep.type = FT_STRING;
    dep.op = FT_OP_CNTD;
    dep.val.str =  DMemMalloc(2);
    strcpy(dep.val.str, "-");
    ProtDep(&dep);

    peic.abbrev = "url";
    peic.desc = "Uniform Resource Locator";
    ProtPeiComponent(&peic);

    peic.abbrev = "file";
    peic.desc = "File";
    ProtPeiComponent(&peic);

    peic.abbrev = "range";
    peic.desc = "File range";
    ProtPeiComponent(&peic);

    peic.abbrev = "content_type";
    peic.desc = "Content Type";
    ProtPeiComponent(&peic);

    /* dissectors registration */
    ProtDissectors(HttpFdDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 6
0
Arquivo: arp.c Projeto: Cbrdiv/xplico
int DissecRegist(const char *file_cfg)
{
    proto_dep dep;
    pei_cmpt peic;

    memset(&dep, 0, sizeof(proto_dep));

    /* protocol name */
    ProtName("Address Resolution Protocol", "arp");

    /* ethernet dependence */
    dep.name = "eth";
    dep.attr = "eth.type";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_ARP;
    ProtDep(&dep);

    dep.name = "eth";
    dep.attr = "eth.type";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_REVARP;
    ProtDep(&dep);

    /* vlan dependence */
    dep.name = "vlan";
    dep.attr = "vlan.type";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_ARP;
    ProtDep(&dep);

    dep.name = "vlan";
    dep.attr = "vlan.type";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_REVARP;
    ProtDep(&dep);

    /* PEI components */
    peic.abbrev = "mac";
    peic.desc = "MAC address";
    ProtPeiComponent(&peic);

    peic.abbrev = "ip";
    peic.desc = "IP address";
    ProtPeiComponent(&peic);

    /* dissectors registration */
    ProtDissectors(ArpDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 7
0
int DissecRegist(const char *file_cfg)
{
    proto_heury_dep hdep;
    proto_dep dep;
    pei_cmpt peic;

    memset(&hdep, 0, sizeof(proto_heury_dep));
    memset(&dep, 0, sizeof(proto_dep));
    memset(&peic, 0, sizeof(pei_cmpt));

    /* protocol name */
    ProtName("Telnet", "telnet");

    /* hdep: tcp */
    hdep.name = "tcp";
    hdep.ProtCheck = TelnetCheck;
    hdep.pktlim = TELNET_PKT_LIMIT;
    ProtHeuDep(&hdep);

    /* dep: tcp */
    dep.name = "tcp";
    dep.attr = "tcp.dstport";
    dep.type = FT_UINT16;
    dep.val.uint16 = TCP_PORT_TELNET;
    dep.ProtCheck = TelnetVerify;
    dep.pktlim = TELNET_PKT_LIMIT;
    ProtDep(&dep);

    /* PEI components */
    peic.abbrev = "host";
    peic.desc = "Host name or IP";
    ProtPeiComponent(&peic);

    peic.abbrev = "user";
    peic.desc = "User name";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "password";
    peic.desc = "Password";
    ProtPeiComponent(&peic);

    peic.abbrev = "cmd";
    peic.desc = "Commands";
    ProtPeiComponent(&peic);

    /* dissectors subdissectors registration */
    ProtDissectors(NULL, TelnetDissector, NULL, NULL);

    return 0;
}
Exemplo n.º 8
0
Arquivo: eth.c Projeto: Cbrdiv/xplico
int DissecRegist(const char *file_cfg)
{
    proto_info info;
    proto_dep dep;

    memset(&info, 0, sizeof(proto_info));
    memset(&dep, 0, sizeof(proto_dep));

    /* protocol name */
    ProtName("Ethernet", "eth");
    
    /* Ethertype */
    info.name = "Source Hardware Address";
    info.abbrev = "eth.src";
    info.type = FT_ETHER;
    mac_src_id = ProtInfo(&info);

    /* Ethertype */
    info.name = "Ethertype";
    info.abbrev = "eth.type";
    info.type = FT_UINT16;
    etype_id = ProtInfo(&info);
    
    /* pcapf */
    dep.name = "pcapf";
    dep.attr = "pcapf.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_EN10MB;
    ProtDep(&dep);
    
    /* pol */
    dep.name = "pol";
    dep.attr = "pol.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_EN10MB;
    ProtDep(&dep);

    /* llc dependence */
    dep.name = "llc";
    dep.attr = "llc.type";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_EN10MB;
    ProtDep(&dep);

    /* dissectors registration */
    ProtDissectors(EthDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 9
0
Arquivo: mms.c Projeto: Cbrdiv/xplico
int DissecRegist(const char *file_cfg)
{
    proto_dep dep;
    pei_cmpt peic;

    memset(&dep, 0, sizeof(proto_dep));
    memset(&peic, 0, sizeof(pei_cmpt));

    /* protocol name */
    ProtName("MMS Message Encapsulation", "mms");

    /* http dependence */
    dep.name = "http";
    dep.attr = "http.content_type";
    dep.type = FT_STRING;
    dep.op = FT_OP_CNTD;
    dep.val.str =  DMemMalloc(32);
    strcpy(dep.val.str, "application/vnd.wap.mms-message");
    ProtDep(&dep);

    /* PEI components */
    peic.abbrev = "url";
    peic.desc = "Uniform Resource Locator";
    ProtPeiComponent(&peic);
    peic.abbrev = "from";
    peic.desc = "Source telephon number";
    ProtPeiComponent(&peic);
    peic.abbrev = "to";
    peic.desc = "Destinaton telephon number";
    ProtPeiComponent(&peic);
    peic.abbrev = "cc";
    peic.desc = "Destinaton telephon number (cc)";
    ProtPeiComponent(&peic);
    peic.abbrev = "bcc";
    peic.desc = "Destinaton telephon number (bcc)";
    ProtPeiComponent(&peic);
    peic.abbrev = "part";
    peic.desc = "Content part";
    ProtPeiComponent(&peic);
    peic.abbrev = "raw";
    peic.desc = "Binary raw fromat";
    ProtPeiComponent(&peic);

    /* dissectors registration */
    ProtDissectors(MmsDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 10
0
int DissecRegist(const char *file_cfg)
{
    proto_info info;
    proto_dep dep;

    memset(&info, 0, sizeof(proto_info));
    memset(&dep, 0, sizeof(proto_dep));

    /* protocol name */
    ProtName("IEEE 802.11 wireless LAN", "wlan");
    
    /* BSS ID */
    info.name = "BSS Id";
    info.abbrev = "wlan.bssid";
    info.type = FT_ETHER;
    bss_id = ProtInfo(&info);
    
    /* dep: pcapf */
    dep.name = "pcapf";
    dep.attr = "pcapf.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_IEEE802_11;
    ProtDep(&dep);
    
    /* dep: pol */
    dep.name = "pol";
    dep.attr = "pol.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_IEEE802_11;
    ProtDep(&dep);
    
    /* dep: ppi */
    dep.name = "ppi";
    dep.attr = "ppi.dlt";
    dep.type = FT_UINT32;
    dep.val.uint16 = DLT_IEEE802_11;
    ProtDep(&dep);

    /* dissectors registration */
    ProtDissectors(Ieee80211Dissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 11
0
Arquivo: vlan.c Projeto: Cbrdiv/xplico
int DissecRegist(const char *file_cfg)
{
    proto_info info;
    proto_dep dep;

    memset(&info, 0, sizeof(proto_info));
    memset(&dep, 0, sizeof(proto_dep));

    /* protocol name */
    ProtName("802.1Q Virtual LAN", "vlan");
    
    /* Tunnel ID */
    info.name = "Vlan ID";
    info.abbrev = "vlan.id";
    info.type = FT_UINT16;
    vid_id = ProtInfo(&info);

    /* protocol */
    info.name = "Ethertype";
    info.abbrev = "vlan.type";
    info.type = FT_UINT16;
    proto_id = ProtInfo(&info);

    /* dep: udp */
    dep.name = "eth";
    dep.attr = "eth.type";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_VLAN;
    ProtDep(&dep);

    /* rule */
    /*ProtAddRule("(vlan.id == pkt.vlan.id)");*/
#warning "deadlock"

    /* dissectors registration */
    ProtDissectors(VlanDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 12
0
Arquivo: ipp.c Projeto: Cbrdiv/xplico
int DissecRegist(const char *file_cfg)
{
    proto_dep dep;
    pei_cmpt peic;

    memset(&dep, 0, sizeof(proto_dep));
    memset(&peic, 0, sizeof(pei_cmpt));

    /* protocol name */
    ProtName("Internet Printing Protocol", "ipp");

    /* http dependence */
    dep.name = "http";
    dep.attr = "http.content_type";
    dep.type = FT_STRING;
    dep.op = FT_OP_CNTD;
    dep.val.str =  DMemMalloc(16);
    strcpy(dep.val.str, "application/ipp");
    ProtDep(&dep);

    /* PEI components */
    peic.abbrev = "url";
    peic.desc = "Uniform Resource Locator";
    ProtPeiComponent(&peic);

    peic.abbrev = "pdf";
    peic.desc = "pdf file";
    ProtPeiComponent(&peic);

    peic.abbrev = "pcl";
    peic.desc = "pcl file";
    ProtPeiComponent(&peic);

    /* dissectors registration */
    ProtDissectors(IppDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 13
0
static int GtpDissecRegist(void)
{
    proto_info info;
    proto_dep dep;

    memset(&info, 0, sizeof(proto_info));
    memset(&dep, 0, sizeof(proto_dep));

    /* protocol name */
    ProtName("GPRS Tunneling Protocol", "gtp");
    
    /* tunnel endpoint identifier (TEID) */
    info.name = "Tunnel endpoint identifier";
    info.abbrev = "gtp.teid";
    info.type = FT_UINT32;
    tunnel_id = ProtInfo(&info);

    /* message type */
    info.name = "Message Type";
    info.abbrev = "gtp.msg";
    info.type = FT_UINT8;
    proto_id = ProtInfo(&info);

    /* dep: udp */
    dep.name = "udp";
    dep.attr = "udp.dstport";
    dep.type = FT_UINT16;
    dep.val.uint16 = UDP_PORT_GTPv1U;
    ProtDep(&dep);

    /* rule (gtp is a node) */
    //ProtAddRule("gtp.teid == pkt.gtp.teid");
    
    /* dissectors registration */
    ProtDissectors(GtpDissector, NULL, NULL, NULL);
    
    return 0;
}
Exemplo n.º 14
0
Arquivo: null.c Projeto: Cbrdiv/xplico
int DissecRegist(const char *file_cfg)
{
    proto_info info;
    proto_dep dep;

    memset(&info, 0, sizeof(proto_info));
    memset(&dep, 0, sizeof(proto_dep));
    family_id = -1;
    
    /* protocol name */
    ProtName("Null/Loopback", "null");
   
    /* protocol */
    info.name = "family type";
    info.abbrev = "null.family";
    info.type = FT_UINT32;
    family_id = ProtInfo(&info);

    /* pcapf dependence */
    dep.name = "pcapf";
    dep.attr = "pcapf.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_NULL;
    ProtDep(&dep);

    /* pol dependence */
    dep.name = "pol";
    dep.attr = "pol.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_NULL;
    ProtDep(&dep);

    /* dissectors registration */
    ProtDissectors(NullDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 15
0
int DissecRegist(const char *file_cfg)
{
    proto_info info;
    proto_dep dep;

    memset(&info, 0, sizeof(proto_info));
    memset(&dep, 0, sizeof(proto_dep));

    /* protocol name */
    ProtName("Cisco HDLC", "chdlc");
    
    /* Protocol */
    info.name = "Protocol";
    info.abbrev = "chdlc.protocol";
    info.type = FT_UINT16;
    proto_id = ProtInfo(&info);
    
    /* dep: pcapf */
    dep.name = "pcapf";
    dep.attr = "pcapf.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_CHDLC;
    ProtDep(&dep);
    
    /* dep: pol */
    dep.name = "pol";
    dep.attr = "pol.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_CHDLC;
    ProtDep(&dep);

    /* dissectors registration */
    ProtDissectors(ChdlcDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 16
0
int DissecRegist(const char *file_cfg)
{
    proto_heury_dep hdep;
    pei_cmpt peic;
    proto_info info;

    memset(&info, 0, sizeof(proto_info));
    memset(&hdep, 0, sizeof(proto_heury_dep));
    memset(&peic, 0, sizeof(pei_cmpt));

    /* protocol name */
    ProtName("Real time Transport Protocol", "rtp");

    /* info: version */
    info.name = "Version";
    info.abbrev = "rtp.ver";
    info.type = FT_UINT8;
    ver_id = ProtInfo(&info);

    /* info: payload type */
    info.name = "Payload type";
    info.abbrev = "rtp.pt";
    info.type = FT_UINT8;
    pt_id = ProtInfo(&info);

    /* info: sequence number */
    info.name = "Sequence number";
    info.abbrev = "rtp.seq";
    info.type = FT_UINT16;
    seq_id = ProtInfo(&info);

    /* info: timestamp */
    info.name = "Timestamp";
    info.abbrev = "rtp.ts";
    info.type = FT_UINT32;
    ts_id = ProtInfo(&info);

    /* info: synchronization source */
    info.name = "Synchronization source";
    info.abbrev = "rtp.sync";
    info.type = FT_UINT32;
    sync_id = ProtInfo(&info);

    /* hdep: udp */
    hdep.name = "udp";
    hdep.ProtCheck = RtpCheck;
    hdep.pktlim = RTP_PKT_VER_LIMIT;
    ProtHeuDep(&hdep);
    
    /* PEI components */
    peic.abbrev = "from";
    peic.desc = "Caller";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "to";
    peic.desc = "Called";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "audio_from";
    peic.desc = "Caller audio file";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "audio_to";
    peic.desc = "Called audio file";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "audio_mix";
    peic.desc = "Caller and Called";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "duration";
    peic.desc = "Call duration";
    ProtPeiComponent(&peic);

    /* group protocol (master flow) */
    ProtGrpEnable();

    /* dissectors registration */
    ProtDissectors(RtpPktDissector, RtpDissector, NULL, NULL);

    return 0;
}
Exemplo n.º 17
0
int DissecRegist(const char *file_cfg)
{
    proto_heury_dep hdep;
    pei_cmpt peic;
    long tmp;
    
    pthrs_dim = TCP_CA_DEFUALT_PARAL_THR;
    grpdis = TRUE;
    
    memset(&hdep, 0, sizeof(proto_heury_dep));
    memset(&peic, 0, sizeof(pei_cmpt));

    /* threads parallel */
    if (file_cfg != NULL) {
        if (CfgParamInt(file_cfg, TCP_CA_CFG_PARAL_THR, &tmp) == 0) {
            if (tmp > 0)
                pthrs_dim = tmp;
            else
                grpdis = FALSE;
        }
    }
    
    /* protocol name */
    ProtName("TCP Analysis", "tcp-ca");

    /* dep: tcp */
    hdep.name = "tcp";
    if (grpdis == TRUE)
        hdep.ProtCheck = TcpCaCheckGrp;
    else
        hdep.ProtCheck = TcpCaCheck;
    ProtHeuDep(&hdep);

    /* PEI components */
    peic.abbrev = "ip.src";
    peic.desc = "IP source";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "ip.dst";
    peic.desc = "IP destination";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "dns";
    peic.desc = "dns name request";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "port.src";
    peic.desc = "Port source";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "port.dst";
    peic.desc = "Port destination";
    ProtPeiComponent(&peic);

    peic.abbrev = "l7prot";
    peic.desc = "L7 protocol march";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "lat";
    peic.desc = "Latitude";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "long";
    peic.desc = "Longitude";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "country_code";
    peic.desc = "Country Code";
    ProtPeiComponent(&peic);

    peic.abbrev = "byte.sent";
    peic.desc = "Byte sent";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "byte.receiv";
    peic.desc = "Byte received";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "byte.lost.sent";
    peic.desc = "Lost bytes sent";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "byte.lost.receiv";
    peic.desc = "Lost bytes received";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "pkt.sent";
    peic.desc = "Packet sent";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "pkt.receiv";
    peic.desc = "Packet received";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "trace.sent";
    peic.desc = "Trace sent";
    ProtPeiComponent(&peic);
    
    peic.abbrev = "trace.receiv";
    peic.desc = "Trace recived";
    ProtPeiComponent(&peic);

    peic.abbrev = "trace.img";
    peic.desc = "Trace the bytes with an image";
    ProtPeiComponent(&peic);

    peic.abbrev = "metadata";
    peic.desc = "Metadata: JSON file with metadata";
    ProtPeiComponent(&peic);

    limit_pkts = TCP_CA_PKT_LIMIT;
    
    /* dissectors subdissectors registration */
    if (grpdis == TRUE) {
        ProtDissectors(NULL, TcpCaDissectorGrp, NULL, NULL);
    }
    else {
        ProtDissectors(NULL, TcpCaDissector, NULL, NULL);
    }

    return 0;
}
Exemplo n.º 18
0
Arquivo: sll.c Projeto: Cbrdiv/xplico
int DissecRegist(const char *file_cfg)
{
    proto_info info;
    proto_dep dep;

    memset(&info, 0, sizeof(proto_info));
    memset(&dep, 0, sizeof(proto_dep));
    pkttype_id = -1;
    hatype_id = -1;
    halen_id = -1;
    protocol_id = -1;
    
    /* protocol name */
    ProtName("Linux cooked-mode capture", "sll");
    
#if 0
    /* packet type  */
    info.name = "Packet type";
    info.abbrev = "sll.pkttype";
    info.type = FT_UINT16;
    pkttype_id = ProtInfo(&info);

    /* link-layer address type */
    info.name = "Link-layer address type";
    info.abbrev = "sll.hatype";
    info.type = FT_UINT16;
    hatype_id = ProtInfo(&info);

    /* link-layer address length */
    info.name = "Link-layer address length";
    info.abbrev = "sll.halen";
    info.type = FT_UINT16;
    halen_id = ProtInfo(&info);

    /* link-layer address */
#endif

    /* protocol */
    info.name = "Protocol type";
    info.abbrev = "sll.protocol";
    info.type = FT_UINT16;
    protocol_id = ProtInfo(&info);

    /* pcapf dependence */
    dep.name = "pcapf";
    dep.attr = "pcapf.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_LINUX_SLL;
    ProtDep(&dep);

    /* pol dependence */
    dep.name = "pol";
    dep.attr = "pol.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_LINUX_SLL;
    ProtDep(&dep);

    /* dissectors registration */
    ProtDissectors(SllDissector, NULL, NULL, NULL);

    return 0;
}
Exemplo n.º 19
0
int DissecRegist(const char *file_cfg)
{
    proto_info info;
    proto_dep dep;

    memset(&info, 0, sizeof(proto_info));
    memset(&dep, 0, sizeof(proto_dep));

    /* protocol name */
    ProtName("Internet Protocol", "ip");
    
    /* protocol */
    info.name = "Protocol";
    info.abbrev = "ip.proto";
    info.type = FT_UINT8;
    proto_id = ProtInfo(&info);

    /* source */
    info.name = "Source";
    info.abbrev = "ip.src";
    info.type = FT_IPv4;
    src_id = ProtInfo(&info);

    /* destination */
    info.name = "Destination";
    info.abbrev = "ip.dst";
    info.type = FT_IPv4;
    dst_id = ProtInfo(&info);

    /* packet offset */
    info.name = "Packet Offset";
    info.abbrev = "ip.offset";
    info.type = FT_UINT32;
    offset_id = ProtInfo(&info);

#if SNIFFER_EVASION
    /* time to live */
    info.name = "Time To Live";
    info.abbrev = "ip.ttl";
    info.type = FT_UINT8;
    ttl_id = ProtInfo(&info);

    /* identification */
    info.name = "Identification";
    info.abbrev = "ip.id";
    info.type = FT_UINT16;
    id_id = ProtInfo(&info);
#endif

    /* ethernet dependence */
    dep.name = "eth";
    dep.attr = "eth.type";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_IP;
    ProtDep(&dep);

    /* llc dependence */
    dep.name = "llc";
    dep.attr = "llc.type";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_IP;
    ProtDep(&dep);

    /* sll dependence */
    dep.name = "sll";
    dep.attr = "sll.protocol";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_IP;
    ProtDep(&dep);

    /* ppp dependence */
    dep.name = "ppp";
    dep.attr = "ppp.protocol";
    dep.type = FT_UINT16;
    dep.val.uint16 = PPP_IP;
    ProtDep(&dep);

    dep.name = "ppp";
    dep.attr = "ppp.protocol";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_IP;
    ProtDep(&dep);

    /* pcapf dependence */
    dep.name = "pcapf";
    dep.attr = "pcapf.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_RAW;
    ProtDep(&dep);
    dep.val.uint16 = DLT_IPV4;
    ProtDep(&dep);
    
    /* pol dependence */
    dep.name = "pol";
    dep.attr = "pol.layer1";
    dep.type = FT_UINT16;
    dep.val.uint16 = DLT_RAW;
    ProtDep(&dep);
    dep.val.uint16 = DLT_IPV4;
    ProtDep(&dep);

    /* vlan dependence */
    dep.name = "vlan";
    dep.attr = "vlan.type";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_IP;
    ProtDep(&dep);

    /* chdlc dependence */
    dep.name = "chdlc";
    dep.attr = "chdlc.protocol";
    dep.type = FT_UINT16;
    dep.val.uint16 = ETHERTYPE_IP;
    ProtDep(&dep);

    /* GTP dependence */
    dep.name = "gtp";
    dep.attr = "gtp.msg";
    dep.type = FT_UINT8;
    dep.val.uint8 = GTP_MSG_TPDU;
    ProtDep(&dep);
    
    /* dissectors registration */
    ProtDissectors(IpDissector, NULL, NULL, NULL);

    return 0;
}