R: ntp protocol analyzer
Palumbo Mauro <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
Ok, thanks for the feedback. I’ll have a look at that. I need to get something working soon. But I’ll keep everybody posted about what I can do about this analyzer. Mauro Da: Vlad Grigorescu [mailto:[email protected]] Inviato: domenica 26 maggio 2019 14:30 A: Seth Hall <[email protected]> Cc: Palumbo Mauro <[email protected]>; [email protected] Oggetto: Re: [Zeek] ntp protocol analyzer There's some work in branch topic/vladg/ntp<https://github.com/zeek/zeek/compare/topic/vladg/ntp>, but that's incomplete and ~3 years old. --Vlad On Sat, May 25, 2019 at 4:26 AM Seth Hall <[email protected]<mailto:[email protected]>> wrote: No one is working on it that I know of and it's written in C++ because it's older. I think at some point I rewrote it in binpac but I suspect that has been lost to the sands of time at this point. A couple of years ago I think some others were working on ntp related stuff but I don't know if that went anywhere. If you're up for it, feel free to take on the ntp analyzer and rehab it! .Seth -- Seth Hall * Corelight, Inc * www.corelight.com<http://www.corelight.com> On May 24, 2019, at 4:29 AM, Palumbo Mauro <[email protected]<mailto:[email protected]>> wrote: Hi Zeek’s devs, I am interested in an analyzer for the NTP protocol. I have seen that there is one in Zeek, but it doesn’t really parse all fields in details. Is anyone working on extending the present analyzer? Would it be of interest for the community to do so? Is there any reason why the present analyzer is written in C++ rather than binpac? Thanks, Mauro _______________________________________________ Zeek mailing list [email protected]<mailto:[email protected]> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected]<mailto:[email protected]> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek