Feature #2174
openNeed a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET
Description
Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET
For example:
ip_extract: <bytes to convert>, <offset> [, relative][, <endian>][, string], <comparator>
Where:
<bytes_to_convert>: Number of bytes to pick up from the packet. The allowed values are 7 to 15 when used against string. Should not be used if applied against binary data.
<offset>: Number of bytes into the payload to start processing
<relative>: Use an offset relative to last pattern match
<endian>: Endian type of the ip address being represented by binary data:
big - Process data as big endian (default)
little - Process data as little endian
<string>: IP address is stored in string format in packet
<comparator>: One of 4 values specifying what the extracted ip address should be compared to:
is_srcip - extracted ip address is checked whether it is equal to the source address of ip packet
is_dstip - extracted ip address is checked whether it is equal to the destination address of ip packet
is_external - extracted ip address is checked whether it is in $EXTERNAL_NET ip address space
is_home - extracted ip address is checked whether it is in $HOME_NET ip address space
I attached a screenshot of an example http session where I'd like to extract ip address and compare whether it is from $EXTERNAL_NET
Files
Updated by ajaxtpm ajaxtpm over 7 years ago
I'm sorry, of course there must not be any <bytes_to_convert> parameter because ip address takes 4 bytes in binary representation and from 7 to 15 bytes as a string and we do not know exact ip string size before extraction. So, no <bytes_to_convert> there. Also it may be useful to skip trailing spaces after <offset> bytes in case of string ip representation.
And of course all of this is about IPv4 and it may be better to name it "ipv4_extract".
Updated by Andreas Herz over 7 years ago
- Assignee set to Anonymous
- Target version set to TBD