corelight/zeek-spicy-ospfA Zeek OSPF packet analyzer based on Spicy.
This is a Spicy based OSPF v2 & v3 packet analyzer for Zeek. You must install Spicy to use this package.
Links:
Testing PCAPs sources:
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path ospf
#open 2021-11-23-07-32-16
#fields ts ip_src ip_dst ospf_type version router_id area_id interface_id netmask desig_router backup_router neighbors lsa_type link_state_id advert_router routers link_id link_data link_type neighbor_router_id metrics fwd_addrs route_tags neighbor_interface_id prefix metric dest_router_id link_prefixes intra_prefixes
#types time addr addr string count addr addr count addr addr addr vector[addr] string addr addr vector[addr] addr addr string addr vector[count] vector[addr] vector[count] count subnet count addr set[subnet] set[subnet]
1220202735.459206 fe80::1 ff02::5 Hello 3 1.1.1.1 0.0.0.1 5 - 0.0.0.0 0.0.0.0 (empty) - - - - - - - - - - - - - - - - -
1220202740.303003 fe80::2 ff02::5 Hello 3 2.2.2.2 0.0.0.1 5 - 0.0.0.0 0.0.0.0 (empty) - - - - - - - - - - - - - - - - -
1220202745.479174 fe80::1 ff02::5 Hello 3 1.1.1.1 0.0.0.1 5 - 0.0.0.0 0.0.0.0 2.2.2.2 - - - - - - - - - - - - - - - - -
1220202750.294469 fe80::2 ff02::5 Hello 3 2.2.2.2 0.0.0.1 5 - 0.0.0.0 0.0.0.0 1.1.1.1 - - - - - - - - - - - - - - - - -
1220202755.486054 fe80::1 ff02::5 Hello 3 1.1.1.1 0.0.0.1 5 - 0.0.0.0 0.0.0.0 2.2.2.2 - - - - - - - - - - - - - - - - -
1220202760.293859 fe80::2 ff02::5 Hello 3 2.2.2.2 0.0.0.1 5 - 0.0.0.0 0.0.0.0 1.1.1.1 - - - - - - - - - - - - - - - - -
1220202765.457555 fe80::1 ff02::5 Hello 3 1.1.1.1 0.0.0.1 5 - 2.2.2.2 2.2.2.2 2.2.2.2 - - - - - - - - - - - - - - - - -
1220202770.289278 fe80::2 ff02::5 Hello 3 2.2.2.2 0.0.0.1 5 - 0.0.0.0 0.0.0.0 1.1.1.1 - - - - - - - - - - - - - - - - -
1220202775.477004 fe80::1 ff02::5 Hello 3 1.1.1.1 0.0.0.1 5 - 2.2.2.2 2.2.2.2 2.2.2.2 - - - - - - - - - - - - - - - - -
1220202780.292824 fe80::2 ff02::5 Hello 3 2.2.2.2 0.0.0.1 5 - 2.2.2.2 1.1.1.1 1.1.1.1 - - - - - - - - - - - - - - - - -
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - 0.0.0.0 - - - Network 0.0.0.5 2.2.2.2 2.2.2.2,1.1.1.1 - - - - - - - - - - - - -
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.4 2.2.2.2 - - - - - - - - - 2001:db8:0:3::/64 74 - - -
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.3 2.2.2.2 - - - - - - - - - 2001:db8:0:4::/64 84 - - -
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.2 2.2.2.2 - - - - - - - - - 2001:db8:0:34::/64 74 - - -
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.1 2.2.2.2 - - - - - - - - - 2001:db8::/64 64 - - -
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.8 1.1.1.1 - - - - - - - - - 2001:db8:0:3::/64 74 - - -
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.7 1.1.1.1 - - - - - - - - - 2001:db8:0:4::/64 84 - - -
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.6 1.1.1.1 - - - - - - - - - 2001:db8:0:34::/64 74 - - -
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.5 1.1.1.1 - - - - - - - - - 2001:db8::/64 64 - - -
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - Link 0.0.0.5 1.1.1.1 - - - - - - - - - - - - 2001:db8:0:12::/64 -
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IntraA Prefix 0.0.20.0 2.2.2.2 - - - - - - - - - - - - - 2001:db8:0:12::/64
1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IntraA Prefix 0.0.0.0 1.1.1.1 - - - - - - - - - - - - - 2001:db8:0:12::/64
1220202780.316781 fe80::2 fe80::1 Link State Update 3 2.2.2.2 0.0.0.1 - - - - - IA Prefix 0.0.0.8 2.2.2.2 - - - - - - - - - 2001:db8:0:3::/64 74 - - -