Project

General

Profile

Actions

Feature #2174

open

Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET

Added by ajaxtpm ajaxtpm over 7 years ago. Updated over 5 years ago.

Status:
New
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET
For example:
ip_extract: <bytes to convert>, <offset> [, relative][, <endian>][, string], <comparator>
Where:
<bytes_to_convert>: Number of bytes to pick up from the packet. The allowed values are 7 to 15 when used against string. Should not be used if applied against binary data.
<offset>: Number of bytes into the payload to start processing
<relative>: Use an offset relative to last pattern match
<endian>: Endian type of the ip address being represented by binary data:
big - Process data as big endian (default)
little - Process data as little endian
<string>: IP address is stored in string format in packet
<comparator>: One of 4 values specifying what the extracted ip address should be compared to:
is_srcip - extracted ip address is checked whether it is equal to the source address of ip packet
is_dstip - extracted ip address is checked whether it is equal to the destination address of ip packet
is_external - extracted ip address is checked whether it is in $EXTERNAL_NET ip address space
is_home - extracted ip address is checked whether it is in $HOME_NET ip address space

I attached a screenshot of an example http session where I'd like to extract ip address and compare whether it is from $EXTERNAL_NET


Files

Снимок.PNG (21.5 KB) Снимок.PNG ajaxtpm ajaxtpm, 07/07/2017 11:25 AM
Actions

Also available in: Atom PDF