Keep the client and the server on tracked tcp sessions

unstable
James Lee 2012-05-08 16:38:12 -06:00
parent 88b35a32e5
commit 536fa39ae8
2 changed files with 7 additions and 7 deletions

View File

@ -162,8 +162,8 @@ class SnifferSMB < BaseProtocolParser
"\nNTHASH:#{s[:ntlmhash]}\n"
print_status(logmessage)
src_ip = s[:host]
dst_ip = s[:session].split("-")[1].split(":")[0]
src_ip = s[:client_host]
dst_ip = s[:host]
# know this is ugly , last code added :-/
smb_db_type_hash = case ntlm_ver
when "NTLMv1" then "smb_netv1_hash"

View File

@ -177,12 +177,12 @@ class BaseProtocolParser
sessions[sessionid][:mtime] = Time.now
else
# Create a new session entry along with the host/port from the id
if (sessionid =~ /^([^:]+):([^-]+)-/s)
if (sessionid =~ /^([^:]+):([^-]+)-([^:]+):(\d+)$/s)
sessions[sessionid] = {
:host => $1,
:target_host => $1,
:port => $2,
:target_port => $2,
:client_host => $1,
:client_port => $2,
:host => $3,
:port => $4,
:session => sessionid,
:ctime => Time.now,
:mtime => Time.now