[tcpdump-workers] [tcpdump] Feature request: conditional run dissector on traffic (#495)
anders.broman at ericsson.com
Wed Dec 16 14:32:59 EST 2015
Skickat från min Sony Xperia™-smartphone
---- Michael Richardson skrev ----
> > It has been mentioned briefly in #471: with the option -T radius it is
> > possible to dissect traffic over non-RADIUS ports as RADIUS, but this
> > means all traffic will be dissected as RADIUS
> > A short use case as an example: FreeRADIUS has the possibility to use a
> > RESTful server for authorization My RESTful daemon will send a
> > CoA/Disconnect if this user still has another session, and my NAS
> > requires that I send it to port 1700 instead of the standard port I
> > want to see all the traffic that is relevant, which means UDP port 1812
> > for RADIUS authentication, TCP port 80 for the RESTful traffic and UDP
> > port 1700 for RADIUS CoA/Disconnect
> > Until yesterday, UDP port 1700 was not marked as RADIUS, which means
> > that would not be dissected If I use -T radius, all traffic would be
> > dissected as RADIUS, so the HTTP traffic would be mangled
> > It would be nice if there was a possibility to conditionally mark
> > traffic as a certain protocol, like saying -T "udp port 1700 = radius,
> > tcp port 4080 = http"
> Being able to dynamically map ports -> protocols in TCPDUMP would indeed be a
> nice thing to have. I think that squishing it all into -T is too hard.
> I'd rather have a file that describes the mapping, and just bake a file like
> that in as the default. As for a syntax...
> I was thinking that maybe we could use pcap filters as the matchers.
Having port maping in a pcap-ng block might be a nice feature too which might be worth considering when designing the format.
> ] Never tell me the odds! | ipv6 mesh networks [
> ] Michael Richardson, Sandelman Software Works | network architect [
> ] mcr at sandelman.ca http://www.sandelman.ca/ | ruby on rails [
> tcpdump-workers mailing list
> tcpdump-workers at lists.tcpdump.org
More information about the tcpdump-workers