| | 1 | {{{ |
| | 2 | #!NetPDL |
| | 3 | <protocol name="defaultproto" longname="Other data" comment="Generic protocol that is called when no other protocols are available" showsumtemplate="defaultproto"> |
| | 4 | <execute-code> |
| | 5 | <before when="($L4proto == #tcp)"> |
| | 6 | <!-- Since both sides of the connection are stored in the table, we can just check for one of them --> |
| | 7 | <if expr="not updatelookuptable($unknownprotosessiontable, $firstip, $secondip, $firstport, $secondport)"> |
| | 8 | <if-true> |
| | 9 | <assign-variable name="$session_hit" value="1"/> |
| | 10 | <update-lookuptable name="$unknownprotosessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300"> |
| | 11 | <lookupkey value="$firstip"/> |
| | 12 | <lookupkey value="$secondip"/> |
| | 13 | <lookupkey value="$firstport"/> |
| | 14 | <lookupkey value="$secondport"/> |
| | 15 | </update-lookuptable> |
| | 16 | </if-true> |
| | 17 | </if> |
| | 18 | </before> |
| | 19 | |
| | 20 | <before when="($L4proto == #udp)"> |
| | 21 | <!-- Since both sides of the connection are stored in the table, we can just check for one of them --> |
| | 22 | <if expr="not updatelookuptable($unknownprotosessiontable, $ipsrc, $ipdst, $portsrc, $portdst)"> |
| | 23 | <if-true> |
| | 24 | <assign-variable name="$session_hit" value="1"/> |
| | 25 | <update-lookuptable name="$unknownprotosessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300"> |
| | 26 | <lookupkey value="$ipsrc"/> |
| | 27 | <lookupkey value="$ipdst"/> |
| | 28 | <lookupkey value="$portsrc"/> |
| | 29 | <lookupkey value="$portdst"/> |
| | 30 | </update-lookuptable> |
| | 31 | <update-lookuptable name="$unknownprotosessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300"> |
| | 32 | <lookupkey value="$ipdst"/> |
| | 33 | <lookupkey value="$ipsrc"/> |
| | 34 | <lookupkey value="$portdst"/> |
| | 35 | <lookupkey value="$portsrc"/> |
| | 36 | </update-lookuptable> |
| | 37 | </if-true> |
| | 38 | </if> |
| | 39 | </before> |
| | 40 | </execute-code> |
| | 41 | <format> |
| | 42 | <fields> |
| | 43 | <field type="variable" name="payload" longname="Data payload" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/> |
| | 44 | </fields> |
| | 45 | </format> |
| | 46 | |
| | 47 | <visualization> |
| | 48 | <showsumtemplate name="defaultproto"> |
| | 49 | <section name="L7"/> |
| | 50 | <text value="Generic Data"/> |
| | 51 | </showsumtemplate> |
| | 52 | </visualization> |
| | 53 | </protocol> |
| | 54 | |
| | 55 | }}} |
