diff options
| -rw-r--r-- | src/include/ndpi_protocols.h | 1 | ||||
| -rw-r--r-- | src/lib/ndpi_main.c | 3 | ||||
| -rw-r--r-- | src/lib/protocols/zabbix.c | 63 | ||||
| -rw-r--r-- | tests/pcap/zabbix.pcap | bin | 0 -> 899 bytes | |||
| -rw-r--r-- | tests/result/zabbix.pcap.out | 3 |
5 files changed, 70 insertions, 0 deletions
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h index b42eff4c4..dd41be2a3 100644 --- a/src/include/ndpi_protocols.h +++ b/src/include/ndpi_protocols.h @@ -211,6 +211,7 @@ void init_nest_log_sink_dissector(struct ndpi_detection_module_struct *ndpi_stru void init_ookla_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_modbus_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_capwap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); +void init_zabbix_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_line_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_wireguard_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_targus_getdata_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index b28c2c331..ef231a68d 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -3372,6 +3372,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n /* CAPWAP */ init_capwap_dissector(ndpi_str, &a, detection_bitmask); + /* ZABBIX */ + init_zabbix_dissector(ndpi_str, &a, detection_bitmask); + /*** Put false-positive sensitive protocols at the end ***/ /* VIBER */ diff --git a/src/lib/protocols/zabbix.c b/src/lib/protocols/zabbix.c new file mode 100644 index 000000000..9e67a3159 --- /dev/null +++ b/src/lib/protocols/zabbix.c @@ -0,0 +1,63 @@ +/* + * zabbix.c + * + * Copyright (C) 2019 - ntop.org + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +#include "ndpi_protocol_ids.h" + +#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_ZABBIX + +#include "ndpi_api.h" + +/* *************************************************** */ + +static void ndpi_int_zabbix_add_connection(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow/* , */ + /* ndpi_protocol_type_t protocol_type */) { + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZABBIX, NDPI_PROTOCOL_UNKNOWN); +} + +/* *************************************************** */ + +void ndpi_search_zabbix(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) { + struct ndpi_packet_struct *packet = &flow->packet; + u_int8_t tomatch[] = { 'Z', 'B', 'X', 'D', 0x1 }; + + NDPI_LOG_DBG(ndpi_struct, "search Zabbix\n"); + + if((packet->payload_packet_len > 4) + && (memcmp(packet->payload, tomatch, 5) == 0)) + ndpi_int_zabbix_add_connection(ndpi_struct, flow); + else + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); +} + +/* *************************************************** */ + +void init_zabbix_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, + NDPI_PROTOCOL_BITMASK *detection_bitmask) { + ndpi_set_bitmask_protocol_detection("Zabbix", ndpi_struct, detection_bitmask, *id, + NDPI_PROTOCOL_ZABBIX, + ndpi_search_zabbix, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, + SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK); + + *id += 1; +} diff --git a/tests/pcap/zabbix.pcap b/tests/pcap/zabbix.pcap Binary files differnew file mode 100644 index 000000000..8e3d32f5e --- /dev/null +++ b/tests/pcap/zabbix.pcap diff --git a/tests/result/zabbix.pcap.out b/tests/result/zabbix.pcap.out new file mode 100644 index 000000000..a91ebe491 --- /dev/null +++ b/tests/result/zabbix.pcap.out @@ -0,0 +1,3 @@ +Zabbix 10 715 1 + + 1 TCP 192.168.67.98:57162 <-> 192.168.67.25:10050 [proto: 248/Zabbix][cat: Network/14][5 pkts/361 bytes <-> 5 pkts/354 bytes][bytes ratio: 0.010 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/1 1.2/1.7 4/4 1.6/1.7][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 72.2/70.8 89/82 9.0/6.4] |