781 lines
21 KiB
Ruby
Executable File
781 lines
21 KiB
Ruby
Executable File
#!/usr/bin/env ruby
|
|
# Copyright (C) 2007 Sylvain SARMEJEANNE
|
|
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; version 2.
|
|
|
|
# This program is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
# General Public License for more details.
|
|
|
|
module Scruby
|
|
|
|
# Track dissectors
|
|
@@dissectors = {}
|
|
|
|
def Scruby.register_dissector(cls)
|
|
@@dissectors[cls.to_s.split('::')[-1]] = cls
|
|
end
|
|
|
|
def Scruby.dissectors
|
|
@@dissectors
|
|
end
|
|
|
|
def Scruby.get_dissector(d)
|
|
|
|
if(@@dissectors[d])
|
|
return @@dissectors[d]
|
|
end
|
|
|
|
d = d.split('::')[-1]
|
|
@@dissectors[d]
|
|
end
|
|
|
|
|
|
# Dissector for Ethernet
|
|
class Ether<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :dst, :src, :type
|
|
|
|
def init
|
|
@protocol = 'Ethernet'
|
|
@fields_desc = [ MACField('dst', '00:00:00:00:00:00'),
|
|
MACField('src', '00:00:00:00:00:00'),
|
|
XShortField('type', ETHERTYPE_IPv4) ]
|
|
end
|
|
|
|
end
|
|
|
|
# Dissector for IPv4
|
|
class IP<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :version, :ihl, :tos, :len, :id, :flags, :frag
|
|
attr_accessor :ttl, :proto, :chksum, :src, :dst
|
|
|
|
def init
|
|
@protocol = 'IPv4'
|
|
@fields_desc = [ BitField("version", 4, 4),
|
|
BitField("ihl", 5, 4),
|
|
XByteField('tos', 0),
|
|
ShortField('len', 20),
|
|
XShortField('id', 0),
|
|
BitField('flags', 0, 3),
|
|
BitField('frag', 0, 13),
|
|
ByteField('ttl', 64),
|
|
ByteEnumField('proto', IPPROTO_TCP, IPPROTO_ALL),
|
|
XShortField('chksum', 0),
|
|
IPField('src', '127.0.0.1'),
|
|
IPField('dst', '127.0.0.1') ]
|
|
end
|
|
|
|
def pre_send(underlayer, payload)
|
|
# Total length
|
|
self.len = 20 + payload.length
|
|
|
|
# Checksum
|
|
self.chksum = 0
|
|
self.chksum = Layer.checksum(self.to_net())
|
|
end
|
|
|
|
end
|
|
|
|
# Dissector for ICMP
|
|
class ICMP<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :type, :code, :chksum, :id, :seq
|
|
|
|
def init
|
|
@protocol = 'ICMP'
|
|
@fields_desc = [ ByteField('type', ICMPTYPE_ECHO),
|
|
ByteField('code', 0),
|
|
XShortField('chksum', 0),
|
|
XShortField('id', 0),
|
|
XShortField('seq', 0) ]
|
|
end
|
|
|
|
def pre_send(underlayer, payload)
|
|
# Checksum
|
|
self.chksum = 0
|
|
self.chksum = Layer.checksum(self.to_net() + payload)
|
|
end
|
|
|
|
end
|
|
|
|
# Dissector for Raw
|
|
class Raw<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :load
|
|
|
|
def init
|
|
@protocol = 'Raw data'
|
|
@fields_desc = [ StrField('load', '') ]
|
|
end
|
|
|
|
end
|
|
|
|
# Dissector for TCP
|
|
class TCP<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :sport, :dport, :seq, :ack, :dataofs, :reserved
|
|
attr_accessor :flags, :window, :chksum, :urgptr
|
|
|
|
def init
|
|
@protocol = 'TCP'
|
|
@fields_desc = [ ShortField('sport', 1024),
|
|
ShortField('dport', 80),
|
|
IntField('seq', 0),
|
|
IntField('ack', 0),
|
|
BitField("dataofs", 5, 4),
|
|
BitField("reserved", 0, 4),
|
|
XByteField('flags', 0x2),
|
|
ShortField('window', 8192),
|
|
XShortField('chksum', 0),
|
|
ShortField('urgptr', 0) ]
|
|
end
|
|
|
|
def pre_send(underlayer, payload)
|
|
|
|
# To compute the TCP checksum, the IP underlayer is needed.
|
|
# Otherwise, the chksum field is left equal to 0.
|
|
if underlayer.is_a?(IP)
|
|
|
|
# Getting IP addresses from the IPFields
|
|
ip_src = underlayer.fields_desc[10].to_net(underlayer.fields_desc[10])
|
|
ip_dst = underlayer.fields_desc[11].to_net(underlayer.fields_desc[11])
|
|
|
|
this_packet = self.to_net()
|
|
|
|
pseudo_header = [ip_src,
|
|
ip_dst,
|
|
underlayer.proto,
|
|
(this_packet + payload).length
|
|
].pack("a4a4nn")
|
|
|
|
self.chksum = 0
|
|
self.chksum = Layer.checksum(pseudo_header + this_packet + payload)
|
|
end
|
|
end
|
|
|
|
end
|
|
|
|
# Dissector for UDP
|
|
class UDP<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :sport, :dport, :len, :chksum
|
|
|
|
def init
|
|
@protocol = 'UDP'
|
|
@fields_desc = [ ShortField('sport', 53),
|
|
ShortField('dport', 53),
|
|
ShortField('len', 8),
|
|
XShortField('chksum', 0) ]
|
|
end
|
|
|
|
# Almost the same as TCP
|
|
def pre_send(underlayer, payload)
|
|
|
|
# Total length
|
|
self.len = 8 + payload.length
|
|
|
|
# To compute the UDP checksum, the IP underlayer is needed.
|
|
# Otherwise, the chksum field is left equal to 0.
|
|
if underlayer.is_a?(IP)
|
|
|
|
# Getting IP addresses from the IPFields
|
|
ip_src = underlayer.fields_desc[10].to_net(underlayer.fields_desc[10])
|
|
ip_dst = underlayer.fields_desc[11].to_net(underlayer.fields_desc[11])
|
|
|
|
this_packet = self.to_net()
|
|
|
|
pseudo_header = [ip_src,
|
|
ip_dst,
|
|
underlayer.proto,
|
|
(this_packet + payload).length
|
|
].pack("a4a4nn")
|
|
|
|
self.chksum = 0
|
|
self.chksum = Layer.checksum(pseudo_header + this_packet + payload)
|
|
end
|
|
end
|
|
|
|
end
|
|
|
|
# Dissector for the classic BSD loopback header (NetBSD, FreeBSD and Mac OS X)
|
|
class ClassicBSDLoopback<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :header
|
|
|
|
def init
|
|
@protocol = 'Classic BSD loopback'
|
|
@fields_desc = [ HostOrderIntField('header', BSDLOOPBACKTYPE_IPv4) ]
|
|
end
|
|
|
|
end
|
|
|
|
# Dissector for the OpenBSD loopback header
|
|
class OpenBSDLoopback<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :header
|
|
|
|
def init
|
|
@protocol = 'OpenBSD loopback'
|
|
@fields_desc = [ LEIntField('header', BSDLOOPBACKTYPE_IPv4) ]
|
|
end
|
|
|
|
end
|
|
|
|
|
|
# Dissector for the Prism header
|
|
class Prism<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :header
|
|
|
|
def init
|
|
@protocol = 'Prism'
|
|
@fields_desc = [
|
|
LEIntField("msgcode",68),
|
|
LEIntField("len",144),
|
|
StrFixedLenField("dev","",16),
|
|
LEIntField("hosttime_did",0),
|
|
LEShortField("hosttime_status",0),
|
|
LEShortField("hosttime_len",0),
|
|
LEIntField("hosttime",0),
|
|
LEIntField("mactime_did",0),
|
|
LEShortField("mactime_status",0),
|
|
LEShortField("mactime_len",0),
|
|
LEIntField("mactime",0),
|
|
LEIntField("channel_did",0),
|
|
LEShortField("channel_status",0),
|
|
LEShortField("channel_len",0),
|
|
LEIntField("channel",0),
|
|
LEIntField("rssi_did",0),
|
|
LEShortField("rssi_status",0),
|
|
LEShortField("rssi_len",0),
|
|
LEIntField("rssi",0),
|
|
LEIntField("sq_did",0),
|
|
LEShortField("sq_status",0),
|
|
LEShortField("sq_len",0),
|
|
LEIntField("sq",0),
|
|
LEIntField("signal_did",0),
|
|
LEShortField("signal_status",0),
|
|
LEShortField("signal_len",0),
|
|
LESignedIntField("signal",0),
|
|
LEIntField("noise_did",0),
|
|
LEShortField("noise_status",0),
|
|
LEShortField("noise_len",0),
|
|
LEIntField("noise",0),
|
|
LEIntField("rate_did",0),
|
|
LEShortField("rate_status",0),
|
|
LEShortField("rate_len",0),
|
|
LEIntField("rate",0),
|
|
LEIntField("istx_did",0),
|
|
LEShortField("istx_status",0),
|
|
LEShortField("istx_len",0),
|
|
LEIntField("istx",0),
|
|
LEIntField("frmlen_did",0),
|
|
LEShortField("frmlen_status",0),
|
|
LEShortField("frmlen_len",0),
|
|
LEIntField("frmlen",0)
|
|
]
|
|
end
|
|
|
|
end
|
|
|
|
=begin
|
|
class Dot11<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :header
|
|
|
|
def init
|
|
@protocol = '802.11'
|
|
@fields_desc = [
|
|
BitField("subtype", 0, 4),
|
|
BitEnumField("type", 0, 2, ["Management", "Control", "Data", "Reserved"]),
|
|
BitField("proto", 0, 2),
|
|
FlagsField("FCfield", 0, 8, ["to-DS", "from-DS", "MF", "retry", "pw-mgt", "MD", "wep", "order"]),
|
|
ShortField("ID",0),
|
|
MACField("addr1", ETHER_ANY),
|
|
Dot11Addr2MACField("addr2", ETHER_ANY),
|
|
Dot11Addr3MACField("addr3", ETHER_ANY),
|
|
Dot11SCField("SC", 0),
|
|
Dot11Addr4MACField("addr4", ETHER_ANY)
|
|
]
|
|
end
|
|
|
|
end
|
|
=end
|
|
|
|
# Dissector for RIFF file format header
|
|
class RIFF<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :id, :size
|
|
|
|
def init
|
|
@protocol = 'RIFF chunk'
|
|
@fields_desc = [ StrFixedLenField('id', 'RIFF', 4),
|
|
LEIntField('size', 0),
|
|
StrFixedLenField('headerid', 'ACON', 4) ]
|
|
end
|
|
|
|
end
|
|
|
|
# Dissector for ANI header chunk format
|
|
class ANI<Layer
|
|
Scruby.register_dissector(self)
|
|
def method_missing(method, *args)
|
|
return Scruby.field(method, *args)
|
|
end
|
|
|
|
attr_accessor :headersize, :frames, :steps, :width, :height, :bitcount, :planes
|
|
attr_accessor :displayrate, :reserved, :sequence, :icon
|
|
|
|
def init
|
|
@protocol = 'ANI chunk'
|
|
@fields_desc = [ StrFixedLenField('id', 'anih', 4),
|
|
LEIntField('size', 36),
|
|
LEIntField('headersize', 36),
|
|
LEIntField('frames', 2),
|
|
LEIntField('steps', 0),
|
|
LEIntField('width', 0),
|
|
LEIntField('height', 0),
|
|
LEIntField('bitcount', 0),
|
|
LEIntField('planes', 0),
|
|
LEIntField('displayrate', 0),
|
|
BitField('icon', 0, 1),
|
|
BitField('sequence', 0, 1),
|
|
BitField('reserved', 0, 30) ]
|
|
end
|
|
|
|
end
|
|
|
|
# Layer bounds
|
|
@@layer_bounds =
|
|
{
|
|
'Ether' =>
|
|
[
|
|
['type', ETHERTYPE_IPv4, IP]
|
|
],
|
|
|
|
'ClassicBSDLoopback' =>
|
|
[
|
|
['header', BSDLOOPBACKTYPE_IPv4, IP]
|
|
],
|
|
|
|
'OpenBSDLoopback' =>
|
|
[
|
|
['header', BSDLOOPBACKTYPE_IPv4, IP]
|
|
],
|
|
|
|
'IP' =>
|
|
[
|
|
['proto', IPPROTO_ICMP, ICMP],
|
|
['proto', IPPROTO_TCP, TCP],
|
|
['proto', IPPROTO_UDP, UDP]
|
|
],
|
|
}
|
|
|
|
def self.layer_bounds
|
|
@@layer_bounds
|
|
end
|
|
|
|
|
|
def Scruby.linklayer_dissector(datalink, pkt)
|
|
case datalink
|
|
when Pcap::DLT_EN10MB
|
|
Ether(pkt)
|
|
when Pcap::DLT_NULL
|
|
ClassicBSDLoopback(pkt)
|
|
when Pcap::DLT_RAW
|
|
OpenBSDLoopback(pkt)
|
|
when Pcap::DLT_PRISM_HEADER
|
|
Prism(pkt)
|
|
when 101,
|
|
IP(pkt)
|
|
else
|
|
nil
|
|
end
|
|
end
|
|
|
|
end
|
|
|
|
=begin
|
|
|
|
Scruby packet dissectors/types:
|
|
===============================
|
|
ANI
|
|
ClassicBSDLoopback
|
|
Ether
|
|
ICMP
|
|
IP
|
|
OpenBSDLoopback
|
|
RIFF
|
|
Raw
|
|
TCP
|
|
UDP
|
|
|
|
Scapy (1.2.0.1) packet dissectors/types:
|
|
========================================
|
|
Raw
|
|
Padding
|
|
Ether
|
|
PPPoE
|
|
PPPoED
|
|
Dot3
|
|
LLC
|
|
CookedLinux
|
|
SNAP
|
|
Dot1Q
|
|
RadioTap
|
|
STP
|
|
EAPOL
|
|
EAP
|
|
ARP
|
|
IP
|
|
TCP
|
|
UDP
|
|
ICMP
|
|
IPerror
|
|
TCPerror
|
|
UDPerror
|
|
ICMPerror
|
|
IPv6
|
|
_IPv6OptionHeader
|
|
PPP
|
|
DNS
|
|
DNSQR
|
|
DNSRR
|
|
BOOTP
|
|
DHCPOptionsField
|
|
DHCP
|
|
Dot11
|
|
Dot11Beacon
|
|
Dot11Elt
|
|
Dot11ATIM
|
|
Dot11Disas
|
|
Dot11AssoReq
|
|
Dot11AssoResp
|
|
Dot11ReassoReq
|
|
Dot11ReassoResp
|
|
Dot11ProbeReq
|
|
Dot11ProbeResp
|
|
Dot11Auth
|
|
Dot11Deauth
|
|
Dot11WEP
|
|
PrismHeader
|
|
HSRP
|
|
NTP
|
|
GRE
|
|
Radius
|
|
RIP
|
|
RIPEntry
|
|
ISAKMP_class
|
|
ISAKMP
|
|
ISAKMP_payload_Transform
|
|
ISAKMP_payload_Proposal
|
|
ISAKMP_payload
|
|
ISAKMP_payload_VendorID
|
|
ISAKMP_payload_SA
|
|
ISAKMP_payload_Nonce
|
|
ISAKMP_payload_KE
|
|
ISAKMP_payload_ID
|
|
ISAKMP_payload_Hash
|
|
Skinny
|
|
RTP
|
|
SebekHead
|
|
SebekV1
|
|
SebekV3
|
|
SebekV2
|
|
SebekV3Sock
|
|
SebekV2Sock
|
|
MGCP
|
|
GPRS
|
|
HCI_Hdr
|
|
HCI_ACL_Hdr
|
|
L2CAP_Hdr
|
|
L2CAP_CmdHdr
|
|
L2CAP_ConnReq
|
|
L2CAP_ConnResp
|
|
L2CAP_CmdRej
|
|
L2CAP_ConfReq
|
|
L2CAP_ConfResp
|
|
L2CAP_DisconnReq
|
|
L2CAP_DisconnResp
|
|
L2CAP_InfoReq
|
|
L2CAP_InfoResp
|
|
NetBIOS_DS
|
|
IrLAPHead
|
|
IrLAPCommand
|
|
IrLMP
|
|
NBNSQueryRequest
|
|
NBNSRequest
|
|
NBNSQueryResponse
|
|
NBNSQueryResponseNegative
|
|
NBNSNodeStatusResponse
|
|
NBNSNodeStatusResponseService
|
|
NBNSNodeStatusResponseEnd
|
|
NBNSWackResponse
|
|
NBTDatagram
|
|
NBTSession
|
|
SMBNetlogon_Protocol_Response_Header
|
|
SMBMailSlot
|
|
SMBNetlogon_Protocol_Response_Tail_SAM
|
|
SMBNetlogon_Protocol_Response_Tail_LM20
|
|
SMBNegociate_Protocol_Request_Header
|
|
SMBNegociate_Protocol_Request_Tail
|
|
SMBNegociate_Protocol_Response_Advanced_Security
|
|
SMBNegociate_Protocol_Response_No_Security
|
|
SMBNegociate_Protocol_Response_No_Security_No_Key
|
|
SMBSession_Setup_AndX_Request
|
|
SMBSession_Setup_AndX_Response
|
|
MobileIP
|
|
MobileIPRRQ
|
|
MobileIPRRP
|
|
MobileIPTunnelData
|
|
NetflowHeader
|
|
NetflowHeaderV1
|
|
NetflowRecordV1
|
|
TFTP
|
|
TFTP_RRQ
|
|
TFTP_WRQ
|
|
TFTP_DATA
|
|
TFTP_Option
|
|
TFTP_Options
|
|
TFTP_ACK
|
|
TFTP_ERROR
|
|
TFTP_OACK
|
|
ASN1_Class_SNMP
|
|
ASN1_SNMP_PDU_GET
|
|
ASN1_SNMP_PDU_NEXT
|
|
ASN1_SNMP_PDU_RESPONSE
|
|
ASN1_SNMP_PDU_SET
|
|
ASN1_SNMP_PDU_TRAPv1
|
|
ASN1_SNMP_PDU_BULK
|
|
ASN1_SNMP_PDU_INFORM
|
|
ASN1_SNMP_PDU_TRAPv2
|
|
BERcodec_SNMP_PDU_GET
|
|
BERcodec_SNMP_PDU_NEXT
|
|
BERcodec_SNMP_PDU_RESPONSE
|
|
BERcodec_SNMP_PDU_SET
|
|
BERcodec_SNMP_PDU_TRAPv1
|
|
BERcodec_SNMP_PDU_BULK
|
|
BERcodec_SNMP_PDU_INFORM
|
|
BERcodec_SNMP_PDU_TRAPv2
|
|
ASN1F_SNMP_PDU_GET
|
|
ASN1F_SNMP_PDU_NEXT
|
|
ASN1F_SNMP_PDU_RESPONSE
|
|
ASN1F_SNMP_PDU_SET
|
|
ASN1F_SNMP_PDU_TRAPv1
|
|
ASN1F_SNMP_PDU_BULK
|
|
ASN1F_SNMP_PDU_INFORM
|
|
ASN1F_SNMP_PDU_TRAPv2
|
|
SNMPvarbind
|
|
SNMPget
|
|
SNMPnext
|
|
SNMPresponse
|
|
SNMPset
|
|
SNMPtrapv1
|
|
SNMPbulk
|
|
SNMPinform
|
|
SNMPtrapv2
|
|
SNMP
|
|
|
|
Scapy layer binding:
|
|
====================
|
|
|
|
bind_layers( Dot3, LLC, )
|
|
bind_layers( GPRS, IP, )
|
|
bind_layers( PrismHeader, Dot11, )
|
|
bind_layers( RadioTap, Dot11, )
|
|
bind_layers( Dot11, LLC, type=2)
|
|
bind_layers( PPP, IP, proto=33)
|
|
bind_layers( Ether, LLC, type=122)
|
|
bind_layers( Ether, Dot1Q, type=33024)
|
|
bind_layers( Ether, Ether, type=1)
|
|
bind_layers( Ether, ARP, type=2054)
|
|
bind_layers( Ether, IP, type=2048)
|
|
bind_layers( Ether, EAPOL, type=34958)
|
|
bind_layers( Ether, EAPOL, dst='01:80:c2:00:00:03', type=34958)
|
|
bind_layers( Ether, PPPoED, type=34915)
|
|
bind_layers( Ether, PPPoE, type=34916)
|
|
bind_layers( CookedLinux, LLC, proto=122)
|
|
bind_layers( CookedLinux, Dot1Q, proto=33024)
|
|
bind_layers( CookedLinux, Ether, proto=1)
|
|
bind_layers( CookedLinux, ARP, proto=2054)
|
|
bind_layers( CookedLinux, IP, proto=2048)
|
|
bind_layers( CookedLinux, EAPOL, proto=34958)
|
|
bind_layers( CookedLinux, PPPoED, proto=34915)
|
|
bind_layers( CookedLinux, PPPoE, proto=34916)
|
|
bind_layers( GRE, LLC, proto=122)
|
|
bind_layers( GRE, Dot1Q, proto=33024)
|
|
bind_layers( GRE, Ether, proto=1)
|
|
bind_layers( GRE, ARP, proto=2054)
|
|
bind_layers( GRE, IP, proto=2048)
|
|
bind_layers( GRE, EAPOL, proto=34958)
|
|
bind_layers( PPPoE, PPP, code=0)
|
|
bind_layers( EAPOL, EAP, type=0)
|
|
bind_layers( LLC, STP, dsap=66, ssap=66, ctrl=3)
|
|
bind_layers( LLC, SNAP, dsap=170, ssap=170, ctrl=3)
|
|
bind_layers( SNAP, Dot1Q, code=33024)
|
|
bind_layers( SNAP, Ether, code=1)
|
|
bind_layers( SNAP, ARP, code=2054)
|
|
bind_layers( SNAP, IP, code=2048)
|
|
bind_layers( SNAP, EAPOL, code=34958)
|
|
bind_layers( SNAP, STP, code=267)
|
|
bind_layers( IPerror, IPerror, frag=0, proto=4)
|
|
bind_layers( IPerror, ICMPerror, frag=0, proto=1)
|
|
bind_layers( IPerror, TCPerror, frag=0, proto=6)
|
|
bind_layers( IPerror, UDPerror, frag=0, proto=17)
|
|
bind_layers( IP, IP, frag=0, proto=4)
|
|
bind_layers( IP, ICMP, frag=0, proto=1)
|
|
bind_layers( IP, TCP, frag=0, proto=6)
|
|
bind_layers( IP, UDP, frag=0, proto=17)
|
|
bind_layers( IP, GRE, frag=0, proto=47)
|
|
bind_layers( UDP, SNMP, sport=161)
|
|
bind_layers( UDP, SNMP, dport=161)
|
|
bind_layers( UDP, MGCP, dport=2727)
|
|
bind_layers( UDP, MGCP, sport=2727)
|
|
bind_layers( UDP, DNS, dport=53)
|
|
bind_layers( UDP, DNS, sport=53)
|
|
bind_layers( UDP, ISAKMP, dport=500, sport=500)
|
|
bind_layers( UDP, HSRP, dport=1985, sport=1985)
|
|
bind_layers( UDP, NTP, dport=123, sport=123)
|
|
bind_layers( UDP, BOOTP, dport=67, sport=68)
|
|
bind_layers( UDP, BOOTP, dport=68, sport=67)
|
|
bind_layers( BOOTP, DHCP, options='c\x82Sc')
|
|
bind_layers( UDP, RIP, sport=520)
|
|
bind_layers( UDP, RIP, dport=520)
|
|
bind_layers( RIP, RIPEntry, )
|
|
bind_layers( RIPEntry, RIPEntry, )
|
|
bind_layers( Dot11, Dot11AssoReq, subtype=0, type=0)
|
|
bind_layers( Dot11, Dot11AssoResp, subtype=1, type=0)
|
|
bind_layers( Dot11, Dot11ReassoReq, subtype=2, type=0)
|
|
bind_layers( Dot11, Dot11ReassoResp, subtype=3, type=0)
|
|
bind_layers( Dot11, Dot11ProbeReq, subtype=4, type=0)
|
|
bind_layers( Dot11, Dot11ProbeResp, subtype=5, type=0)
|
|
bind_layers( Dot11, Dot11Beacon, subtype=8, type=0)
|
|
bind_layers( Dot11, Dot11ATIM, subtype=9, type=0)
|
|
bind_layers( Dot11, Dot11Disas, subtype=10, type=0)
|
|
bind_layers( Dot11, Dot11Auth, subtype=11, type=0)
|
|
bind_layers( Dot11, Dot11Deauth, subtype=12, type=0)
|
|
bind_layers( Dot11Beacon, Dot11Elt, )
|
|
bind_layers( Dot11AssoReq, Dot11Elt, )
|
|
bind_layers( Dot11AssoResp, Dot11Elt, )
|
|
bind_layers( Dot11ReassoReq, Dot11Elt, )
|
|
bind_layers( Dot11ReassoResp, Dot11Elt, )
|
|
bind_layers( Dot11ProbeReq, Dot11Elt, )
|
|
bind_layers( Dot11ProbeResp, Dot11Elt, )
|
|
bind_layers( Dot11Auth, Dot11Elt, )
|
|
bind_layers( Dot11Elt, Dot11Elt, )
|
|
bind_layers( TCP, Skinny, dport=2000)
|
|
bind_layers( TCP, Skinny, sport=2000)
|
|
bind_layers( UDP, SebekHead, sport=1101)
|
|
bind_layers( UDP, SebekHead, dport=1101)
|
|
bind_layers( UDP, SebekHead, dport=1101, sport=1101)
|
|
bind_layers( SebekHead, SebekV1, version=1)
|
|
bind_layers( SebekHead, SebekV2Sock, version=2, type=2)
|
|
bind_layers( SebekHead, SebekV2, version=2)
|
|
bind_layers( SebekHead, SebekV3Sock, version=3, type=2)
|
|
bind_layers( SebekHead, SebekV3, version=3)
|
|
bind_layers( CookedLinux, IrLAPHead, proto=23)
|
|
bind_layers( IrLAPHead, IrLAPCommand, Type=1)
|
|
bind_layers( IrLAPCommand, IrLMP, )
|
|
bind_layers( UDP, NBNSQueryRequest, dport=137)
|
|
bind_layers( UDP, NBNSRequest, dport=137)
|
|
bind_layers( UDP, NBNSQueryResponse, sport=137)
|
|
bind_layers( UDP, NBNSQueryResponseNegative, sport=137)
|
|
bind_layers( UDP, NBNSNodeStatusResponse, sport=137)
|
|
bind_layers( NBNSNodeStatusResponse, NBNSNodeStatusResponseService, )
|
|
bind_layers( NBNSNodeStatusResponse, NBNSNodeStatusResponseService, )
|
|
bind_layers( NBNSNodeStatusResponseService, NBNSNodeStatusResponseService, )
|
|
bind_layers( NBNSNodeStatusResponseService, NBNSNodeStatusResponseEnd, )
|
|
bind_layers( UDP, NBNSWackResponse, sport=137)
|
|
bind_layers( UDP, NBTDatagram, dport=138)
|
|
bind_layers( TCP, NBTSession, dport=139)
|
|
bind_layers( NBTSession, SMBNegociate_Protocol_Request_Header, )
|
|
bind_layers( SMBNegociate_Protocol_Request_Header, SMBNegociate_Protocol_Request_Tail, )
|
|
bind_layers( SMBNegociate_Protocol_Request_Tail, SMBNegociate_Protocol_Request_Tail, )
|
|
bind_layers( NBTSession, SMBNegociate_Protocol_Response_Advanced_Security, ExtendedSecurity=1)
|
|
bind_layers( NBTSession, SMBNegociate_Protocol_Response_No_Security, ExtendedSecurity=0, EncryptionKeyLength=8)
|
|
bind_layers( NBTSession, SMBNegociate_Protocol_Response_No_Security_No_Key, ExtendedSecurity=0, EncryptionKeyLength=0)
|
|
bind_layers( NBTSession, SMBSession_Setup_AndX_Request, )
|
|
bind_layers( NBTSession, SMBSession_Setup_AndX_Response, )
|
|
bind_layers( HCI_Hdr, HCI_ACL_Hdr, type=2)
|
|
bind_layers( HCI_Hdr, Raw, )
|
|
bind_layers( HCI_ACL_Hdr, L2CAP_Hdr, )
|
|
bind_layers( L2CAP_Hdr, L2CAP_CmdHdr, cid=1)
|
|
bind_layers( L2CAP_CmdHdr, L2CAP_CmdRej, code=1)
|
|
bind_layers( L2CAP_CmdHdr, L2CAP_ConnReq, code=2)
|
|
bind_layers( L2CAP_CmdHdr, L2CAP_ConnResp, code=3)
|
|
bind_layers( L2CAP_CmdHdr, L2CAP_ConfReq, code=4)
|
|
bind_layers( L2CAP_CmdHdr, L2CAP_ConfResp, code=5)
|
|
bind_layers( L2CAP_CmdHdr, L2CAP_DisconnReq, code=6)
|
|
bind_layers( L2CAP_CmdHdr, L2CAP_DisconnResp, code=7)
|
|
bind_layers( L2CAP_CmdHdr, L2CAP_InfoReq, code=10)
|
|
bind_layers( L2CAP_CmdHdr, L2CAP_InfoResp, code=11)
|
|
bind_layers( UDP, MobileIP, sport=434)
|
|
bind_layers( UDP, MobileIP, dport=434)
|
|
bind_layers( MobileIP, MobileIPRRQ, type=1)
|
|
bind_layers( MobileIP, MobileIPRRP, type=3)
|
|
bind_layers( MobileIP, MobileIPTunnelData, type=4)
|
|
bind_layers( MobileIPTunnelData, IP, nexthdr=4)
|
|
bind_layers( NetflowHeader, NetflowHeaderV1, version=1)
|
|
bind_layers( NetflowHeaderV1, NetflowRecordV1, )
|
|
|
|
bind_layers(UDP, TFTP, dport=69)
|
|
bind_layers(TFTP, TFTP_RRQ, op=1)
|
|
bind_layers(TFTP, TFTP_WRQ, op=2)
|
|
bind_layers(TFTP, TFTP_DATA, op=3)
|
|
bind_layers(TFTP, TFTP_ACK, op=4)
|
|
bind_layers(TFTP, TFTP_ERROR, op=5)
|
|
bind_layers(TFTP, TFTP_OACK, op=6)
|
|
bind_layers(TFTP_RRQ, TFTP_Options)
|
|
bind_layers(TFTP_WRQ, TFTP_Options)
|
|
bind_layers(TFTP_OACK, TFTP_Options)
|
|
=end
|