
Un analyseur de paquets OSPF pour Zeek basé sur Spicy.
Ceci est un analyseur de paquets OSPF v2 et v3 basé sur Spicy pour Zeek. Vous devez installer Spicy pour utiliser ce paquet.
Liens :
Sources des PCAP de test :
#separator \x09 #set_separator , #empty_field (empty) #unset_field - #path ospf #open 2021-11-23-07-32-16 #fields ts ip_src ip_dst ospf_type version router_id area_id interface_id netmask desig_router backup_router neighbors lsa_type link_state_id advert_router routers link_id link_data link_type neighbor_router_id metrics fwd_addrs route_tags neighbor_interface_id prefix metric dest_router_id link_prefixes intra_prefixes #types time addr addr string count addr addr count addr addr addr vector[addr] string addr addr vector[addr] addr addr string addr vector[count] vector[addr] vector[count] count subnet count addr set[subnet] set[subnet] 1220202735.459206 fe80::1 ff02::5 Hello 3 1.1.1.1 0.0.0.1 5 - 0.0.0.0 0.0.0.0 (empty) - - - - - - - - - - - - - - - - - 1220202740.303003 fe80::2 ff02::5 Hello 3 2.2.2.2 0.0.0.1 5 - 0.0.0.0 0.0.0.0 (empty) - - - - - - - - - - - - - - - - - 1220202745.479174 fe80::1 ff02::5 Hello 3 1.1.1.1 0.0.0.1 5 - 0.0.0.0 0.0.0.0 2.2.2.2 - - - - - - - - - - - - - - - - - 1220202750.294469 fe80::2 ff02::5 Hello 3 2.2.2.2 0.0.0.1 5 - 0.0.0.0 0.0.0.0 1.1.1.1 - - - - - - - - - - - - - - - - - 1220202755.486054 fe80::1 ff02::5 Hello 3 1.1.1.1 0.0.0.1 5 - 0.0.0.0 0.0.0.0 2.2.2.2 - - - - - - - - - - - - - - - - - 1220202760.293859 fe80::2 ff02::5 Hello 3 2.2.2.2 0.0.0.1 5 - 0.0.0.0 0.0.0.0 1.1.1.1 - - - - - - - - - - - - - - - - - 1220202765.457555 fe80::1 ff02::5 Hello 3 1.1.1.1 0.0.0.1 5 - 2.2.2.2 2.2.2.2 2.2.2.2 - - - - - - - - - - - - - - - - - 1220202770.289278 fe80::2 ff02::5 Hello 3 2.2.2.2 0.0.0.1 5 - 0.0.0.0 0.0.0.0 1.1.1.1 - - - - - - - - - - - - - - - - - 1220202775.477004 fe80::1 ff02::5 Hello 3 1.1.1.1 0.0.0.1 5 - 2.2.2.2 2.2.2.2 2.2.2.2 - - - - - - - - - - - - - - - - - 1220202780.292824 fe80::2 ff02::5 Hello 3 2.2.2.2 0.0.0.1 5 - 2.2.2.2 1.1.1.1 1.1.1.1 - - - - - - - - - - - - - - - - - 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - 0.0.0.0 - - - Network 0.0.0.5 2.2.2.2 2.2.2.2,1.1.1.1 - - - - - - - - - - - - - 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.4 2.2.2.2 - - - - - - - - - 2001:db8:0:3::/64 74 - - - 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.3 2.2.2.2 - - - - - - - - - 2001:db8:0:4::/64 84 - - - 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.2 2.2.2.2 - - - - - - - - - 2001:db8:0:34::/64 74 - - - 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.1 2.2.2.2 - - - - - - - - - 2001:db8::/64 64 - - - 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.8 1.1.1.1 - - - - - - - - - 2001:db8:0:3::/64 74 - - - 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.7 1.1.1.1 - - - - - - - - - 2001:db8:0:4::/64 84 - - - 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.6 1.1.1.1 - - - - - - - - - 2001:db8:0:34::/64 74 - - - 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IA Prefix 0.0.0.5 1.1.1.1 - - - - - - - - - 2001:db8::/64 64 - - - 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - Link 0.0.0.5 1.1.1.1 - - - - - - - - - - - - 2001:db8:0:12::/64 - 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IntraA Prefix 0.0.20.0 2.2.2.2 - - - - - - - - - - - - - 2001:db8:0:12::/64 1220202780.312726 fe80::1 fe80::2 Link State Update 3 1.1.1.1 0.0.0.1 - - - - - IntraA Prefix 0.0.0.0 1.1.1.1 - - - - - - - - - - - - - 2001:db8:0:12::/64 1220202780.316781 fe80::2 fe80::1 Link State Update 3 2.2.2.2 0.0.0.1 - - - - - IA Prefix 0.0.0.8 2.2.2.2 - - - - - - - - - 2001:db8:0:3::/64 74 - - -