Added EthernetIP dissector

5 files changed, 87 insertions, 0 deletions

diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index e5c4e06f5..d825ade52 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -306,6 +306,7 @@ typedef enum {
   NDPI_PROTOCOL_CRASHLYSTICS          = 275,
   NDPI_PROTOCOL_MICROSOFT_AZURE       = 276,
   NDPI_PROTOCOL_ICLOUD_PRIVATE_RELAY  = 277,
+  NDPI_PROTOCOL_ETHERNET_IP           = 278,
 
 #ifdef CUSTOM_NDPI_PROTOCOLS
 #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index b6e346d14..cbd875eef 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1449,6 +1449,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			  "WSD", NDPI_PROTOCOL_CATEGORY_NETWORK,
 			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
 			  ndpi_build_default_ports(ports_b, 3702, 0, 0, 0, 0) /* UDP */);
+  ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_ETHERNET_IP,
+			  "EthernetIP", NDPI_PROTOCOL_CATEGORY_NETWORK,
+			  ndpi_build_default_ports(ports_a, 44818, 0, 0, 0, 0) /* TCP */,
+			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
   ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TELEGRAM,
 			  "Telegram", NDPI_PROTOCOL_CATEGORY_CHAT,
 			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
diff --git a/src/lib/protocols/ethernet_ip.c b/src/lib/protocols/ethernet_ip.c
new file mode 100644
index 000000000..b11a05d95
--- /dev/null
+++ b/src/lib/protocols/ethernet_ip.c
@@ -0,0 +1,71 @@
+/*
+ * zmq.c
+ *
+ * Copyright (C) 2016-22 - ntop.org
+ *
+ * nDPI is free software: you can zmqtribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_ETHERNET_IP
+
+#include "ndpi_api.h"
+
+static void ndpi_int_ethernet_ip_add_connection(struct ndpi_detection_module_struct
+						*ndpi_struct, struct ndpi_flow_struct *flow) {
+  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ETHERNET_IP,
+			     NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+}
+
+
+void ndpi_search_ethernet_ip(struct ndpi_detection_module_struct *ndpi_struct,
+			     struct ndpi_flow_struct *flow) {
+  struct ndpi_packet_struct *packet = &ndpi_struct->packet;
+  
+  NDPI_LOG_DBG(ndpi_struct, "search for ETHERNET_IP\n");
+
+  if(packet->tcp != NULL) {
+    NDPI_LOG_DBG2(ndpi_struct, "calculating ETHERNET_IP over tcp\n");
+  
+    if(packet->payload_packet_len >= 24) {
+      u_int16_t eth_ip_port = ntohs(44818);
+
+      if((packet->tcp->source == eth_ip_port) || (packet->tcp->dest == eth_ip_port)) {
+	u_int16_t len = *((u_int16_t*)&packet->payload[2]); /* Little endian */
+	
+	if((len+24) == packet->payload_packet_len) {	
+	  NDPI_LOG_INFO(ndpi_struct, "found ethernet_ip\n");
+	  ndpi_int_ethernet_ip_add_connection(ndpi_struct, flow);
+	  return;
+	}
+      }
+    }
+  }
+  
+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow); /* No luck this time */
+}
+  
+
+void init_ethernet_ip_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+				u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) {
+  ndpi_set_bitmask_protocol_detection("EthernetIP", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_ETHERNET_IP,
+				      ndpi_search_ethernet_ip,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
+  *id += 1;
+}
diff --git a/tests/pcap/ethernetIP.pcap b/tests/pcap/ethernetIP.pcap
new file mode 100644
index 000000000..6eb10fd9c
--- /dev/null
+++ b/tests/pcap/ethernetIP.pcap
diff --git a/tests/result/ethernetIP.pcap.out b/tests/result/ethernetIP.pcap.out
new file mode 100644
index 000000000..50f7bd1b8
--- /dev/null
+++ b/tests/result/ethernetIP.pcap.out
@@ -0,0 +1,11 @@
+Guessed flow protos:	4
+
+DPI Packets (TCP):	100	(25.00 pkts/flow)
+Confidence Match by port    : 4 (flows)
+
+EthernetIP	100	17384	4
+
+	1	TCP 141.81.0.10:50275 <-> 141.81.0.83:44818 [proto: 278/EthernetIP][ClearText][Confidence: Match by port][cat: Network/14][12 pkts/2716 bytes <-> 16 pkts/2580 bytes][Goodput ratio: 76/66][0.70 sec][bytes ratio: 0.026 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 72/38 231/232 96/75][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 226/161 1258/406 330/99][PLAIN TEXT (99999999359)][Plen Bins: 0,20,45,0,10,0,0,5,0,5,0,5,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0]
+	2	TCP 141.81.0.63:44818 <-> 141.81.0.10:52593 [proto: 278/EthernetIP][ClearText][Confidence: Match by port][cat: Network/14][16 pkts/2150 bytes <-> 13 pkts/2566 bytes][Goodput ratio: 58/73][0.78 sec][bytes ratio: -0.088 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1 30/60 190/197 55/74][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 134/197 406/528 92/158][PLAIN TEXT (99999999356)][Plen Bins: 0,15,43,0,5,0,10,5,0,0,5,5,5,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	3	TCP 141.81.0.10:52594 <-> 141.81.0.43:44818 [proto: 278/EthernetIP][ClearText][Confidence: Match by port][cat: Network/14][9 pkts/1978 bytes <-> 12 pkts/1784 bytes][Goodput ratio: 75/62][0.66 sec][bytes ratio: 0.052 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 61/33 196/185 73/56][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 220/149 528/406 163/113][PLAIN TEXT (rWKIm.)][Plen Bins: 0,14,35,0,7,0,14,0,0,7,0,7,7,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	4	TCP 141.81.0.10:62717 <-> 141.81.0.23:44818 [proto: 278/EthernetIP][ClearText][Confidence: Match by port][cat: Network/14][11 pkts/2132 bytes <-> 11 pkts/1478 bytes][Goodput ratio: 72/58][0.65 sec][bytes ratio: 0.181 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 52/48 202/242 68/82][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 194/134 528/406 156/96][PLAIN TEXT (DISABLE)][Plen Bins: 0,20,41,0,6,0,13,0,0,0,0,6,6,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]