Changeset 1661

Timestamp:

11/13/06 23:47:34 (2 years ago)

Author:

mbr

Message:

started on integrating IP protocol reporting, bugfix for signature matching on IP direction, bugfix to correctly build HOME_NET string

Files:

• psad/branches/sigdevel/psad (modified) (9 diffs)

psad/branches/sigdevel/psad

@@ -1186 +1186 @@
-                {$pkt{'chain'}}{$pkt{'log_prefix'}}++;
-
-unless ($pkt{'proto'} eq 'icm
+if ($pkt{'proto'} eq 'tcp' or $pkt{'proto'} eq 'ud
-            ### initialize the start and end port for the scanned port range
-            if (not defined $curr_scan{$pkt{'src'}}{$pkt{'dst'}}{$pkt{'proto'}}{'strtp'}) {
@@ -1692 +1692 @@
-                $dl = $dl_tmp if $dl_tmp > $dl;
-
-{'curr_sig'}
-$pkt_hr->{'sid'}
+
+'curr_sig'}{$sid
-                    {$pkt_hr->{'dp'}}++;
-
-{'curr_sig'}
-$pkt_hr->{'sid'}
+
+'curr_sig'}{$sid
-                    {$pkt_hr->{'dp'}} = $pkt_hr->{'flags'};
-
@@ -1707 +1707 @@
-                $dl = $dl_tmp if $dl_tmp > $dl;
-
-{'curr_sig'}
-$pkt_hr->{'sid'}
+
+'curr_sig'}{$sid
-                    {$pkt_hr->{'dp'}}++;
-            }
@@ -1845 +1845 @@
-                "$sig_hr->{'sid'} (psad_id: $sig_hr->{'psad_id'})\n";
-        }
+
+        $scan{$pkt_hr->{'src'}}{$pkt_hr->{'dst'}}{'ip'}{'curr_sig'}
+            {$sig_hr->{'sid'}}{$pkt_hr->{'chain'}}{'pkts'}++;
+
-        return $sig_hr->{'dl'}
-    }
@@ -1874 +1878 @@
-
-    if ($sig_ip =~ m|$ip_re/\d+|) {
-pkt_ip, $sig
+sig_ip, $pkt
-    } elsif ($sig_ip =~ m|$ip_re|) {
-        return 1 if $pkt_ip eq $sig_ip;
-    }
+
-    return 0;
-}
@@ -2565 +2570 @@
-
-        my $connected_str = '';
-
-
-
+
+
-
-        $config{'HOME_NET'} = $connected_str;
@@ -4258 +4262 @@
-
-    for my $fh (@print_fh) {
-
+ ip
-            next unless defined $scan{$src}{$dst}{$proto};
-            my $href = $scan{$src}{$dst}{$proto};
@@ -4349 +4353 @@
-                                        print $fh "   \"$msg\"\n",
-                                            "        sid=$sid chain=$chain packets=$pkts dp=$dp flags=[$flags] ",
-**
+[*]
-                                    } else {
-                                        print $fh "   \"$msg\"\n",
-                                            "        sid=$sid chain=$chain packets=$pkts dp=$dp ",
-**
+[*]
-                                    }
-                                } else {
@@ -4377 +4381 @@
-                        }
-                    } else {
-'icmp'
+$proto
-                            {'curr_sig'}{$sid}{$chain}{'pkts'};
-                        print $fh qq(   "$msg" sid=$sid chain=$chain packets=$pkts\n);