Zeek-Parser-DHCPv6-COM
English is here
æ¦è¦
Zeek-Parser-DHCPv6-COMã¨ã¯DHCPv6(Dynamic Host Configuration Protocol for IPv6)ãè§£æã§ããZeekãã©ã°ã¤ã³ã§ãã
ã¤ã³ã¹ãã¼ã«
ããã±ã¼ã¸ããã¼ã¸ã£ã¼ã«ããã¤ã³ã¹ãã¼ã«
ãã®ãã©ã°ã¤ã³ã¯Zeek Package Mangerç¨ã®ããã±ã¼ã¸ã¨ãã¦æä¾ããã¦ãã¾ãã
以ä¸ã®ã³ãã³ããå®è¡ãããã¨ã§ãæ¬ãã©ã°ã¤ã³ã¯å©ç¨å¯è½ã«ãªãã¾ãã
zkg refresh
zkg install zeek-parser-DHCPv6-COM
ããã¥ã¢ã«ã¤ã³ã¹ãã¼ã«
æ¬ãã©ã°ã¤ã³ãå©ç¨ããåã«ãZeek, Spicyãã¤ã³ã¹ãã¼ã«ããã¦ãããã¨ã確èªãã¾ãã
# Zeekã®ãã§ãã¯
~$ zeek -version
zeek version 5.0.0
# Spicyã®ãã§ãã¯
~$ spicyz -version
1.3.16
~$ spicyc -version
spicyc v1.5.0 (d0bc6053)
# æ¬ããã¥ã¢ã«ã§ã¯Zeekã®ãã¹ã以ä¸ã§ãããã¨ãåæã¨ãã¦ãã¾ãã
~$ which zeek
/usr/local/zeek/bin/zeek
æ¬ãªãã¸ããªããã¼ã«ã«ç°å¢ã« git clone
ãã¾ãã
~$ git clone https://github.com/nttcom/zeek-parser-DHCPV6-COM.git
ä½¿ãæ¹
ããã±ã¼ã¸ããã¼ã¸ã£ã¼ã«ããã¤ã³ã¹ãã¼ã«ã®å ´å
以ä¸ã®ããã«æ¬ãã©ã°ã¤ã³ã使ããã¨ã§ dhcpv6.log
ãçæããã¾ãã
zeek -Cr /usr/local/zeek/var/lib/zkg/clones/package/zeek-parser-DHCPv6-COM/testing/Traces/test.pcap zeek-parser-DHCPv6-COM
ããã¥ã¢ã«ã¤ã³ã¹ãã¼ã«ã®å ´å
ã½ã¼ã¹ã³ã¼ããã³ã³ãã¤ã«ãã¦ããªãã¸ã§ã¯ããã¡ã¤ã«ã以ä¸ã®ãã¹ã«ã³ãã¼ãã¾ãã
~$ cd ~/zeek-parser-DHCPV6-COM/analyzer
~$ spicyz -o dhcpv6.hlto dhcpv6.spicy zeek_dhcpv6.spicy dhcpv6.evt
# dhcpv6.hltoãçæããã¾ã
~$ cp dhcpv6.hlto /usr/local/zeek/lib/zeek-spicy/modules/
åæ§ã«Zeekãã¡ã¤ã«ã以ä¸ã®ãã¹ã«ã³ãã¼ãã¾ãã
~$ cd ~/zeek-parser-DHCPV6-COM/scripts/
~$ cp main.zeek /usr/local/zeek/share/zeek/site/DHCPV6.zeek
æå¾ã«Zeekãã©ã°ã¤ã³ãã¤ã³ãã¼ããã¾ãã
~$ tail /usr/local/zeek/share/zeek/site/local.zeek
...çç¥...
@load DHCPV6
æ¬ãã©ã°ã¤ã³ã使ããã¨ã§ dhcpv6.log
ãçæããã¾ãã
~$ cd ~/zeek-parser-DHCPV6-COM/testing/Traces
~$ zeek -Cr test.pcap /usr/local/zeek/share/zeek/site/DHCPV6.zeek
ãã°ã®ã¿ã¤ãã¨èª¬æ
æ¬ãã©ã°ã¤ã³ã¯dhcpv6ã®å
¨ã¦ã®é¢æ°ãç£è¦ãã¦dhcpv6.log
ã¨ãã¦åºåãã¾ãã
ãã£ã¼ã«ã | ã¿ã¤ã | 説æ |
---|---|---|
ts | time | éä¿¡ããæã®ã¿ã¤ã ã¹ã¿ã³ã |
SrcIP | addr | éä¿¡å IPã¢ãã¬ã¹ |
SrcMAC | string | éä¿¡å MACã¢ãã¬ã¹ |
Hostname | string | ãã¹ãã®åå |
FingerPrint | vector[count] | ç¹å®ã®ã³ã³ãã¥ã¼ã¿ã¼ããµã¼ãã¼ãä»®æ³ãã·ã³ãã·ã¹ãã ãã¢ããªã±ã¼ã·ã§ã³ããã¼ã«ã¾ãã¯ç°å¢ã®èå¥å |
EnterpriseNumber | count | 伿¥ã¾ãã¯çµç¹ã®èå¥çªå·ã®åºç¾åæ° |
VendorClass | string | ãã³ãã¼ãæä¾ããã¯ã©ã¤ã¢ã³ãã½ããã¦ã§ã¢ãããã¤ã¹ã®ã¿ã¤ãããã¼ã¸ã§ã³æ å ± |
dhcpv6.log
ã®ä¾ã¯ä»¥ä¸ã®ã¨ããã§ãã
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path dhcpv6
#open 2023-09-13-05-06-45
#fields ts SrcIP SrcMAC Hostname FingerPrint EnterpriseNumber VendorClass
#types time addr string string vector[count] count string
1547129924.510607 fe80::8882:5cf6:f2eb:c8b9 00:0c:29:71:12:2e vagrant-2008R2happycrazy 311,24,23,17,39 311 MSFT 5.0
1547129962.336912 fe80::28e4:bf15:6f67:5024 00:0c:29:c2:25:f9 WIN7-CLIENT-01happycrazy 311,24,23,17,39 311 MSFT 5.0
1547129987.504802 fe80::8882:5cf6:f2eb:c8b9 00:0c:29:71:12:2e vagrant-2008R2happycrazy 311,24,23,17,39 311 MSFT 5.0
#close 2023-09-13-05-06-45
é¢é£ã½ããã¦ã§ã¢
æ¬ãã©ã°ã¤ã³ã¯OsecTã§å©ç¨ããã¦ãã¾ãã