class Unified2::Constructor::Construct
Unified2
Construction
Public Instance Methods
padding_length()
click to toggle source
Sometimes the data needs extra padding
# File lib/unified2/constructor/construct.rb, line 117 def padding_length if header.u2length > data.num_bytes header.u2length - data.num_bytes else 0 end end
type_selection()
click to toggle source
Type Selection
Deterime and call data type based on the unified2 type attribute
SNORT DEFINES Long time ago… define UNIFIED2_EVENT 1
CURRENT define UNIFIED2_PACKET 2 define UNIFIED2_IDS_EVENT 7 define UNIFIED2_IDS_EVENT_IPV6 72 define UNIFIED2_IDS_EVENT_MPLS 99 define UNIFIED2_IDS_EVENT_IPV6_MPLS 100 define UNIFIED2_IDS_EVENT_VLAN 104 define UNIFIED2_IDS_EVENT_IPV6_VLAN 105 define UNIFIED2_EXTRA_DATA 110
# File lib/unified2/constructor/construct.rb, line 71 def type_selection case header.u2type.to_i when 1 # LEGACY # define UNIFIED2_EVENT 1 when 2 # define UNIFIED2_PACKET 2 "packet" when 7 # define UNIFIED2_IDS_EVENT 7 "lev4" when 66 # LEGACY # define UNIFIED2_EVENT_EXTENDED 66 when 67 # LEGACY # define UNIFIED2_PERFORMANCE 67 when 68 # LEGACY # define UNIFIED2_PORTSCAN 68 when 72 # define UNIFIED2_IDS_EVENT_IPV6 72 "lev6" when 99 # define UNIFIED2_IDS_EVENT_MPLS 99 puts "99" when 100 # define UNIFIED2_IDS_EVENT_IPV6_MPLS puts "100" when 104 # define UNIFIED2_IDS_EVENT_VLAN 104 "ev4" when 105 # define UNIFIED2_IDS_EVENT_IPV6_VLAN 105 "ev6" when 110 # define UNIFIED2_EXTRA_DATA 110 "extra_data" else raise "unknown type #{header.u2type}" end end