class Unified2::Constructor::Construct

Unified2 Construction

Public Instance Methods

padding_length() click to toggle source

Sometimes the data needs extra padding

# File lib/unified2/constructor/construct.rb, line 117
def padding_length
  if header.u2length > data.num_bytes
    header.u2length - data.num_bytes
  else
    0
  end
end
type_selection() click to toggle source

Type Selection

Deterime and call data type based on the unified2 type attribute

SNORT DEFINES Long time ago… define UNIFIED2_EVENT 1

CURRENT define UNIFIED2_PACKET 2 define UNIFIED2_IDS_EVENT 7 define UNIFIED2_IDS_EVENT_IPV6 72 define UNIFIED2_IDS_EVENT_MPLS 99 define UNIFIED2_IDS_EVENT_IPV6_MPLS 100 define UNIFIED2_IDS_EVENT_VLAN 104 define UNIFIED2_IDS_EVENT_IPV6_VLAN 105 define UNIFIED2_EXTRA_DATA 110

# File lib/unified2/constructor/construct.rb, line 71
def type_selection
  case header.u2type.to_i
  when 1
    # LEGACY
    # define UNIFIED2_EVENT 1
  when 2
    # define UNIFIED2_PACKET 2
    "packet"
  when 7
    # define UNIFIED2_IDS_EVENT 7
    "lev4"
  when 66
    # LEGACY
    # define UNIFIED2_EVENT_EXTENDED 66
  when 67
    # LEGACY
    # define UNIFIED2_PERFORMANCE 67
  when 68
    # LEGACY
    # define UNIFIED2_PORTSCAN 68
  when 72
    # define UNIFIED2_IDS_EVENT_IPV6 72
    "lev6"
  when 99
    # define UNIFIED2_IDS_EVENT_MPLS 99
    puts "99"
  when 100
    # define UNIFIED2_IDS_EVENT_IPV6_MPLS
    puts "100"
  when 104 
    # define UNIFIED2_IDS_EVENT_VLAN 104
    "ev4"
  when 105
    # define UNIFIED2_IDS_EVENT_IPV6_VLAN 105
    "ev6"
  when 110
    # define UNIFIED2_EXTRA_DATA 110
    "extra_data"
  else
    raise "unknown type #{header.u2type}"
  end
end