Attribution for pcaps

.gitignore

@@ -1 +1,2 @@
 /target
+/result

pcaps/sources.md

@@ -0,0 +1,8 @@
+- http.cap | wireshark
+- http_image.cap | wireshark
+- dns.cap | wireshark
+- NTP_syc | wireshark
+- telnet-cooked | wireshark
+- SSHv2 | packetlife
+- bro_ssh | try-bro
+- godpi_ssh | go-dpi

src/main.rs

@@ -61,7 +61,7 @@ fn main() {
                                 stats.analyzed += 1;
                             }
                             if opt.print_analysis {
-                                info!("{:?}", extracted);
+                                println!("{:?}", extracted);
                             }
                         }
                         Err(_) => stats.unknown_packets += 1,

src/protocols/mod.rs

@@ -1,4 +1,6 @@
 use dns::{DNSType, DNSValue};
+use log::info;
+use ssh::SSHType;
 
 mod dns;
 mod ssh;
@@ -11,6 +13,7 @@ pub trait KnownProtocol {
 #[derive(Debug)]
 pub enum ProtocolType {
     DNS(DNSType),
+    SSH,
 }
 
 #[derive(Debug)]
@@ -21,17 +24,22 @@ pub enum ExtractedInfo {
 pub fn extract_info(ptype: ProtocolType, payload: Vec<u8>) -> Option<ExtractedInfo> {
     match ptype {
         ProtocolType::DNS(x) => match x {
-            DNSType::Query => {
+            //DNSType::Query => Some(ExtractedInfo::DNSQuery(dns::analyse_dns_query(payload))),
-                return Some(ExtractedInfo::DNSQuery(dns::analyse_dns_query(payload)));
+            DNSType::Query => Some(x.extract_info(payload)),
+            DNSType::Response => {
+                info!("DNS Response processing not handled yet!");
+                None
             }
-            DNSType::Response => return None,
         },
+        ProtocolType::SSH => {
+            todo!()
+        }
     }
 }
 
 pub fn match_protocol(payload: Vec<u8>) -> Result<ProtocolType, ()> {
-    if let Ok(x) = dns::is_dns(payload) {
+    if let Ok(x) = dns::DNSType::classify_proto(payload) {
-        return Ok(ProtocolType::DNS(x));
+        return Ok(x);
-    };
+    }
     Err(())
 }

src/protocols/ssh.rs

@@ -1,4 +1,17 @@
-pub fn is_ssh(payload: Vec<u8>) -> bool {
+use crate::{util::*, ExtractedInfo, KnownProtocol, ProtocolType};
-    // Check for ASCII "SSH"
+
-    payload[0] == 0x53 && payload[1] == 0x53 && payload[2] == 0x48
+pub type SSHType = ();
+
+impl KnownProtocol for SSHType {
+    fn classify_proto(payload: Vec<u8>) -> Result<ProtocolType, ()> {
+        if payload[0] == 0x53 && payload[1] == 0x53 && payload[2] == 0x48 {
+            Ok(ProtocolType::SSH)
+        } else {
+            Err(())
+        }
+    }
+
+    fn extract_info(&self, payload: Vec<u8>) -> ExtractedInfo {
+        todo!()
+    }
 }