Re: Extract IP Header Options

Jon Siwek <[email protected]>
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAMzgZ0+HkEX48XFiGRpBYCghr8qYiJt2eQXhLTL3L1iPY9gSHA@mail.gmail.com>
On Thu, Apr 4, 2019 at 1:48 PM Justin Mullins <[email protected]> wrote:

> I was wondering is there an existing way in Zeek to log IP Header Options?

Doesn't look like it, but you can try hacking it in.  For example, add
the Options data as a field to the ip4_hdr record:

https://github.com/zeek/zeek/blob/3f7bbf2784d094787e6c7cb32adb0fc658fb8a86/scripts/base/init-bare.bro#L1515-L1524

Add code to populate it here:

https://github.com/zeek/zeek/blob/3f7bbf2784d094787e6c7cb32adb0fc658fb8a86/src/IP.cc#L311-L322

Then consume the data via a new_packet event handler:

https://docs.zeek.org/en/latest/scripts/base/bif/event.bif.bro.html#id-new_packet

- Jon
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.