Expand description
This crate allows to easily develop Rust plugins for Tranalyzer2, a network traffic analysis tool.
An example Rust plugin for Tranalyzer2 using this crate can be found here: https://github.com/Tranalyzer/rustExample
Create a new plugin
-
Use
t2plugin
to create a new plugin based on the rustTemplate.cd $T2HOME/plugins t2plugin --rust -c myPluginName cd myPluginName
-
Optional: change the
PLUGINORDER
at the top ofautogen.sh
. -
Fill the different methods of the
T2Plugin
trait implementation insrc/lib.rs
.
Modules
- Contains the definition of a
Flow
. - Contains the definition of the different protocol headers (IP, TCP, UDP, …).
- Contains the definition of a
Packet
. - Contains the
SliceReader
which allows to easily read integers and strings from a byte slice.
Macros
- This macro transforms a
struct
implementing theT2Plugin
trait into a plugin which can be loaded by Tranalyzer2.
Structs
- This structure represents the output header of this plugin.
Enums
- Types of values which can be outputted in Tranalyzer2 flow files.
- Rust opaque representation of
binary_value_t
struct from Tranalyzer2 - Rust opaque representation of
outputBuffer_t
struct from Tranalyzer2
Constants
- Consequtive duplicate IP ID
- Flow duration limit, same findex for all subflows
- Flow timeout instead of protocol termination
- pcapd and PD_ALARM=1: if set dumps the packets from this flow to a new pcap
- IPv4 packet
- IPv6 packet
- A packet had a priority tag (VLAN tag with ID 0)
flow_index
value representing a non-existingFlow
.- Header description overrun
- IPv4 fragmentation present
- IPv4 fragmentation Error (detailed err s. tcpFlags plugin)
- IPv4 1. fragment out of sequence or missing
- Packet fragmentation pending / fragmentation sequence not completed when flow timeouts
- IPv4 header length < 20 bytes
- IPv4/6 payload length > framing length
- Acquired packet length < minimal L2 datagram
- ARP present
- Encapsulated Remote Switch Packet ANalysis (ERSPAN)
- Pure L2 Flow
- GRE v1/2 present
- IPv4 packets present
- IPv6 packets present
- L2TP v2/3 present
- Link Layer Discovery Protocol (LLDP)
- MPLS multicast present
- MPLS unicast present
- No Ethernet header
- PPP header present after L2TP or GRE
- Point to Point Protocol over Ethernet Discovery (PPPoED)
- Point to Point Protocol over Ethernet Service (PPPoES)
- Reverse ARP present
- VLANs present
- Cisco Web Cache Communication Protocol (WCCP)
- Inverted flow, did not initiate connection
- Acquired packet length < minimal L3 Header
- Acquired packet length < packet length in L3 header
- Anything in Anything (AYIYA) Tunnel
- Control And Provisioning of Wireless Access Points (CAPWAP), Lightweight Access Point Protocol (LWAPP)
- Ethernet via IP
- Generic Network Virtualization Encapsulation (GENEVE)
- GPRS Tunneling Protocol (GTP)
- IPv4/6 in IPv4/6
- IPsec Authentication Header (AH)
- IPsec Encapsulating Security Payload (ESP)
- IPvX bogus packets present
- Teredo Tunnel
- Virtual eXtensible Local Area Network (VXLAN)
- Acquired packet length < minimal L4 Header
- Stream Control Transmission Flows
- SSDP/UPnP
- SIP/RTP
- Same src IP && dst IP and src port && dst port
- LAPD flow
- PCAP packet length > MAX_MTU in ioBuffer.h, caplen reduced
- PPPL3 header not readable, compressed
- Alarm mode: remove this flow instantly
- Autopilot: Flow removed to free space in main hash map
- Stop dissecting
- Subnet tested for that flow
- Time slip possibly due to NTP operations on the capture machine
- Tor address detected
- RESERVED, do not use
Traits
- Trait to tranform a per flow
struct
into a Tranalyzer2 plugin.
Functions
- Returns the
flow::Flow
structure of the flow withflow_index=index
. - Returns the number of flows that Tranalyzer2 can store in its internal hashtable.
- Appends bytes to Tranalyzer2 output buffer.
- Appends an IP address to Tranalyzer2 output buffer.
- Appends a number (integer or float) to Tranalyzer2 output buffer.
- Appends a list of numbers (integers or floats) to Tranalyzer2 output buffer.
- Appends a string to Tranalyzer2 output buffer.
- Appends a list of strings to Tranalyzer2 output buffer.
Type Definitions
unsigned long
in C:u32
on 32-bit systems andu64
on 64-bit systems.