diff --git a/.gitignore b/.gitignore deleted file mode 100644 index ea8c4bf..0000000 --- a/.gitignore +++ /dev/null @@ -1 +0,0 @@ -/target diff --git a/pcaps/NTP_sync.pcap b/pcaps/NTP_sync.pcap deleted file mode 100644 index 997d9fb..0000000 Binary files a/pcaps/NTP_sync.pcap and /dev/null differ diff --git a/pcaps/SSHv2.cap b/pcaps/SSHv2.cap deleted file mode 100644 index b682bb8..0000000 Binary files a/pcaps/SSHv2.cap and /dev/null differ diff --git a/pcaps/http.cap b/pcaps/http.cap deleted file mode 100644 index 54f6f29..0000000 Binary files a/pcaps/http.cap and /dev/null differ diff --git a/pcaps/http_image.cap b/pcaps/http_image.cap deleted file mode 100644 index 0908f59..0000000 Binary files a/pcaps/http_image.cap and /dev/null differ diff --git a/pcaps/http_redirects.pcapng b/pcaps/http_redirects.pcapng deleted file mode 100644 index cd8958d..0000000 Binary files a/pcaps/http_redirects.pcapng and /dev/null differ diff --git a/pcaps/telnet-cooked.pcap b/pcaps/telnet-cooked.pcap deleted file mode 100644 index 34515d4..0000000 Binary files a/pcaps/telnet-cooked.pcap and /dev/null differ diff --git a/src/main.rs b/src/main.rs index 59be6ff..a6835e0 100644 --- a/src/main.rs +++ b/src/main.rs @@ -31,8 +31,8 @@ fn main() { Some(pf) => Capture::from_file(pf).expect("Invalid pcap file provided"), None => { warn!("Using example.pcap as no pcap was provided"); - Capture::from_file(PathBuf::from("./pcaps/dns.cap")) - .expect("./pcaps/dns.cap does not exist") + Capture::from_file(PathBuf::from("./pcaps/ssh_test.pcap")) + .expect("./pcaps/ssh_test.pcap does not exist") } }; info!("Pcap loaded"); @@ -57,9 +57,6 @@ fn main() { stats.known_packets += 1; trace!("Known packet type found: {:?}", x); let extracted = extract_info(x, sliced.payload.to_vec()); - if extracted.is_some() { - stats.analyzed += 1; - } if opt.print_analysis { info!("{:?}", extracted); } diff --git a/src/protocols/dns.rs b/src/protocols/dns.rs index 8ed11a2..ad8a45e 100644 --- a/src/protocols/dns.rs +++ b/src/protocols/dns.rs @@ -1,4 +1,4 @@ -use crate::{util::*, ExtractedInfo, KnownProtocol, ProtocolType}; +use crate::util::*; use nom::{ bytes::complete::{tag, take}, combinator::map, @@ -15,22 +15,6 @@ pub enum DNSType { Response, } -impl KnownProtocol for DNSType { - fn extract_info(&self, payload: Vec) -> ExtractedInfo { - ExtractedInfo::DNSQuery(analyse_dns_query(payload)) - } - - fn classify_proto(payload: Vec) -> Result { - if is_dns_query(&payload) { - return Ok(ProtocolType::DNS(DNSType::Query)); - } - if is_dns_response(&payload) { - return Ok(ProtocolType::DNS(DNSType::Response)); - } - Err(()) - } -} - #[derive(Debug, PartialEq, Eq)] pub struct DNSValue { pub txid: u16, diff --git a/src/protocols/mod.rs b/src/protocols/mod.rs index f44671e..fd85658 100644 --- a/src/protocols/mod.rs +++ b/src/protocols/mod.rs @@ -1,12 +1,6 @@ use dns::{DNSType, DNSValue}; mod dns; -mod ssh; - -pub trait KnownProtocol { - fn classify_proto(payload: Vec) -> Result; - fn extract_info(&self, payload: Vec) -> ExtractedInfo; -} #[derive(Debug)] pub enum ProtocolType { @@ -30,8 +24,9 @@ pub fn extract_info(ptype: ProtocolType, payload: Vec) -> Option) -> Result { - if let Ok(x) = dns::is_dns(payload) { - return Ok(ProtocolType::DNS(x)); + match dns::is_dns(payload) { + Ok(x) => return Ok(ProtocolType::DNS(x)), + Err(_) => {} }; - Err(()) + return Err(()); } diff --git a/src/protocols/ssh.rs b/src/protocols/ssh.rs index 7599008..8b13789 100644 --- a/src/protocols/ssh.rs +++ b/src/protocols/ssh.rs @@ -1,4 +1 @@ -pub fn is_ssh(payload: Vec) -> bool { - // Check for ASCII "SSH" - payload[0] == 0x53 && payload[1] == 0x53 && payload[2] == 0x48 -} + diff --git a/src/util.rs b/src/util.rs index cbcf991..3e87538 100644 --- a/src/util.rs +++ b/src/util.rs @@ -11,7 +11,6 @@ pub struct Stats { pub unknown_packets: usize, pub errored_packets: usize, pub empty_payload: usize, - pub analyzed: usize, } impl Stats { @@ -22,7 +21,6 @@ impl Stats { unknown_packets: 0, errored_packets: 0, empty_payload: 0, - analyzed: 0, } } @@ -39,10 +37,9 @@ impl Display for Stats { fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { write!( f, - "Total: {}\nKnown/Analyzed: {}({})\nUnknown: {}\nErrored: {}\nEmpty: {}", + "Total: {}\nKnown: {}\nUnknown: {}\nErrored: {}\nEmpty: {}", self.total_packets, self.known_packets, - self.analyzed, self.unknown_packets, self.errored_packets, self.empty_payload