Zeek-Parser-SSDP-COM
English is here
æ¦è¦
Zeek-Parser-SSDP-COMã¨ã¯SSDP(Simple Service Discovery Protocol)ãè§£æã§ããZeekãã©ã°ã¤ã³ã§ãã
ã¤ã³ã¹ãã¼ã«
ããã±ã¼ã¸ããã¼ã¸ã£ã¼ã«ããã¤ã³ã¹ãã¼ã«
ãã®ãã©ã°ã¤ã³ã¯Zeek Package Mangerç¨ã®ããã±ã¼ã¸ã¨ãã¦æä¾ããã¦ãã¾ãã
以ä¸ã®ã³ãã³ããå®è¡ãããã¨ã§ãæ¬ãã©ã°ã¤ã³ã¯å©ç¨å¯è½ã«ãªãã¾ãã
zkg refresh
zkg install zeek-parser-SSDP-COM
ããã¥ã¢ã«ã¤ã³ã¹ãã¼ã«
æ¬ãã©ã°ã¤ã³ãå©ç¨ããåã«ãZeek, Spicyãã¤ã³ã¹ãã¼ã«ããã¦ãããã¨ã確èªãã¾ãã
# Zeekã®ãã§ãã¯
~$ zeek -version
zeek version 5.0.0
# Spicyã®ãã§ãã¯
~$ spicyz -version
1.3.16
~$ spicyc -version
spicyc v1.5.0 (d0bc6053)
# æ¬ããã¥ã¢ã«ã§ã¯Zeekã®ãã¹ã以ä¸ã§ãããã¨ãåæã¨ãã¦ãã¾ãã
~$ which zeek
/usr/local/zeek/bin/zeek
æ¬ãªãã¸ããªããã¼ã«ã«ç°å¢ã« git clone
ãã¾ãã
~$ git clone https://github.com/nttcom/zeek-parser-SSDP-COM.git
ä½¿ãæ¹
ããã±ã¼ã¸ããã¼ã¸ã£ã¼ã«ããã¤ã³ã¹ãã¼ã«ã®å ´å
以ä¸ã®ããã«æ¬ãã©ã°ã¤ã³ã使ããã¨ã§ mydhcp.log
ãçæããã¾ãã
zeek -Cr /usr/local/zeek/var/lib/zkg/clones/package/zeek-parser-SSDP-COM/testing/Traces/test.pcap zeek-parser-SSDP-COM
ããã¥ã¢ã«ã¤ã³ã¹ãã¼ã«ã®å ´å
ã½ã¼ã¹ã³ã¼ããã³ã³ãã¤ã«ãã¦ããªãã¸ã§ã¯ããã¡ã¤ã«ã以ä¸ã®ãã¹ã«ã³ãã¼ãã¾ãã
~$ cd ~/zeek-parser-SSDP-COM/analyzer
~$ spicyz -o ssdp.hlto ssdp.spicy ssdp.evt
# ssdp.hltoãçæããã¾ã
~$ cp ssdp.hlto /usr/local/zeek/lib/zeek-spicy/modules/
åæ§ã«Zeekãã¡ã¤ã«ã以ä¸ã®ãã¹ã«ã³ãã¼ãã¾ãã
~$ cd ~/zeek-parser-SSDP-COM/scripts/
~$ cp main.zeek /usr/local/zeek/share/zeek/site/SSDP.zeek
æå¾ã«Zeekãã©ã°ã¤ã³ãã¤ã³ãã¼ããã¾ãã
~$ tail /usr/local/zeek/share/zeek/site/local.zeek
...çç¥...
@load SSDP
æ¬ãã©ã°ã¤ã³ã使ããã¨ã§ ssdp.log
ãçæããã¾ãã
~$ cd ~/zeek-parser-SSDP-COM/testing/Traces
~$ zeek -Cr test.pcap /usr/local/zeek/share/zeek/site/SSDP.zeek
ãã°ã®ã¿ã¤ãã¨èª¬æ
æ¬ãã©ã°ã¤ã³ã¯ssdpã®å
¨ã¦ã®é¢æ°ãç£è¦ãã¦ssdp.log
ã¨ãã¦åºåãã¾ãã
ãã£ã¼ã«ã | ã¿ã¤ã | 説æ |
---|---|---|
ts | time | éä¿¡ããæã®ã¿ã¤ã ã¹ã¿ã³ã |
SrcIP | addr | éä¿¡å IPã¢ãã¬ã¹ |
SrcMAC | string | éä¿¡å MACã¢ãã¬ã¹ |
Method | string | ãªã¯ã¨ã¹ãã¡ã½ããã«é¢ããæ å ± |
SERVER_or_USER_AGENT | string | ããã¤ã¹ããµã¼ãã¹ã®è奿 å ±ã詳細ãªãã¼ã¸ã§ã³æ å ± |
ssdp.log
ã®ä¾ã¯ä»¥ä¸ã®ã¨ããã§ãã
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path ssdp
#open 2023-09-13-04-35-24
#fields ts SrcIP SrcMAC Method SERVER_or_USER_AGENT
#types time addr string string string
1668040655.960467 192.168.1.131 dc:72:23:56:9a:d1 NOTIFY Linux/4.14.76+ UPnP/1.0 CyberLinkJava/1.8
1668040683.179186 192.168.1.130 14:da:e9:cd:9f:0c M-SEARCH Request -
1668040683.884088 192.168.1.130 14:da:e9:cd:9f:0c M-SEARCH Request Google Chrome/106.0.5249.119 Linux
#close 2023-09-13-04-35-24
é¢é£ã½ããã¦ã§ã¢
æ¬ãã©ã°ã¤ã³ã¯OsecTã§å©ç¨ããã¦ãã¾ãã