mirrors/tcpdump
0
0
Fork 0
mirror of https://github.com/the-tcpdump-group/tcpdump.git synced 2024-11-23 18:14:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

SMB: Disable the printer by default

Browse Source 
Like in 4.9.3 version.
This printer needs rework.

Move the tests with SMB packets in tests/smb.tests.
Add outputs files for the disabled case.
This commit is contained in:
Francois-Xavier Le Bail 2020-12-19 11:59:32 +01:00
parent e1c739a83d
commit 192db0a116
12 changed files with 697 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
configure vendored
View File

@ -676,6 +676,7 @@ infodir
docdir
oldincludedir
includedir
runstatedir
localstatedir
sharedstatedir
sysconfdir
@ -756,6 +757,7 @@ datadir='${datarootdir}'
sysconfdir='${prefix}/etc'
sharedstatedir='${prefix}/com'
localstatedir='${prefix}/var'
runstatedir='${localstatedir}/run'
includedir='${prefix}/include'
oldincludedir='/usr/include'
docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@ -1008,6 +1010,15 @@ do
| -silent | --silent | --silen | --sile | --sil)
silent=yes ;;
-runstatedir | --runstatedir | --runstatedi | --runstated \
| --runstate | --runstat | --runsta | --runst | --runs \
| --run | --ru | --r)
ac_prev=runstatedir ;;
-runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
| --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
| --run=* | --ru=* | --r=*)
runstatedir=$ac_optarg ;;
-sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
ac_prev=sbindir ;;
-sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@ -1145,7 +1156,7 @@ fi
for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \
datadir sysconfdir sharedstatedir localstatedir includedir \
oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
libdir localedir mandir
libdir localedir mandir runstatedir
do
eval ac_val=\$$ac_var
# Remove trailing slashes.
@ -1298,6 +1309,7 @@ Fine tuning of the installation directories:
--sysconfdir=DIR read-only single-machine data [PREFIX/etc]
--sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com]
--localstatedir=DIR modifiable single-machine data [PREFIX/var]
--runstatedir=DIR modifiable per-process data [LOCALSTATEDIR/run]
--libdir=DIR object code libraries [EPREFIX/lib]
--includedir=DIR C header files [PREFIX/include]
--oldincludedir=DIR C header files for non-gcc [/usr/include]
@ -1332,7 +1344,7 @@ Optional Features:
--disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no)
--enable-FEATURE[=ARG] include FEATURE [ARG=yes]
--disable-universal don't build universal on macOS
--enable-smb enable possibly-buggy SMB printer default=yes
--enable-smb enable possibly-buggy SMB printer default=no
--disable-smb disable possibly-buggy SMB printer
--disable-local-libpcap don't look for a local libpcap [default=check for a
local libpcap]
@ -4204,7 +4216,7 @@ $as_echo_n "checking whether to enable the possibly-buggy SMB printer... " >&6;
if test "${enable_smb+set}" = set; then :
enableval=$enable_smb;
else
enableval=yes
enableval=no
fi
case "$enableval" in

4
configure.ac
View File

@ -147,9 +147,9 @@ fi
AC_MSG_CHECKING([whether to enable the possibly-buggy SMB printer])
AC_ARG_ENABLE(smb,
[ --enable-smb enable possibly-buggy SMB printer [default=yes]
[ --enable-smb enable possibly-buggy SMB printer [default=no]
--disable-smb disable possibly-buggy SMB printer],,
enableval=yes)
enableval=no)
case "$enableval" in
yes) AC_MSG_RESULT(yes)
AC_DEFINE(ENABLE_SMB, 1,

15
tests/TESTLIST
View File

@ -49,8 +49,7 @@ dsa dsa.pcap dsa.out
dsa-e dsa.pcap dsa-e.out -e
# EAP tests
eapon1 eapon1.pcap eapon1.out
eapon1-v eapon1.pcap eapon1-v.out -v
# now in smb.tests
# Marvell DSA tag tests
edsa edsa.pcap edsa.out
@ -114,7 +113,7 @@ e1000g e1000g.pcap e1000g.out
e1000g-e e1000g.pcap e1000g-e.out -e
# IPX/Netware packets
ipx ipx.pcap ipx.out
# now in smb.tests
# IPX/Netware invalid
ipx-invalid-length ipx-invalid-length.pcap ipx-invalid-length.out
@ -573,7 +572,7 @@ slip-compressed_sl_print-oobr slip-compressed_sl_print-oobr.pcap slip-compressed
slip-sliplink_print-oobr slip-sliplink_print-oobr.pcap slip-sliplink_print-oobr.out -e
# bad packets from Otto Airamo and Antti Levomäki
nbns-valgrind nbns-valgrind.pcap nbns-valgrind.out -vvv -e
# one more in smb.tests
arp-oobr arp-oobr.pcap arp-oobr.out -vvv -e
icmp-cksum-oobr-1 icmp-cksum-oobr-1.pcap icmp-cksum-oobr-1.out -vvv -e
icmp-cksum-oobr-2 icmp-cksum-oobr-2.pcap icmp-cksum-oobr-2.out -vvv -e
@ -708,14 +707,14 @@ babel_update_oobr babel_update_oobr.pcap babel_update_oobr.out
ospf6_print_lshdr-oobr ospf6_print_lshdr-oobr.pcap ospf6_print_lshdr-oobr.out -vv
rpl-dao-oobr rpl-dao-oobr.pcap rpl-dao-oobr.out -vv
hncp_prefix-oobr hncp_prefix-oobr.pcap hncp_prefix-oobr.out -vvv
smb_print_trans-oobr1 smb_print_trans-oobr1.pcap smb_print_trans-oobr1.out -vv
# one more in smb.tests
# bad packets from Ryan Ackroyd
ieee802.11_meshhdr-oobr ieee802.11_meshhdr-oobr.pcap ieee802.11_meshhdr-oobr.out -H
dccp_options-oobr dccp_options-oobr.pcap dccp_options-oobr.out -vv
# bad packets from Philippe Antoine
smb_print_trans-oobr2 smb_print_trans-oobr2.pcap smb_print_trans-oobr2.out -vv
# now in smb.tests
# RTP tests
# fuzzed pcap
@ -809,8 +808,8 @@ huge-tipc-messages huge-tipc-messages.pcap huge-tipc-messages.out
# CVE-2018-10105 bad packets from Luis Rocha
sflow_print-segv sflow_print-segv.pcap sflow_print-segv.out -v
smb_data_print-oobr smb_data_print-oobr.pcapng smb_data_print-oobr.out -vv
smb_data_print-segv smb_data_print-segv.pcapng smb_data_print-segv.out -vv
# two more in smb.tests
#ptp tests
ptp ptp.pcap ptp.out
ptp_ethernet ptp_ethernet.pcap ptp_ethernet.out -e

114
tests/eapon1-nosmb.out Normal file
View File

@ -0,0 +1,114 @@
1 15:17:28.958610 IP 192.168.1.249.138 > 192.168.1.255.138: UDP, length 179
2 15:17:28.958708 IP 192.168.1.249.138 > 192.168.1.255.138: UDP, length 179
3 15:17:28.959360 IP 192.168.1.249.138 > 192.168.1.255.138: UDP, length 209
4 15:17:28.961018 IP 192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
5 15:17:29.710899 IP 192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
6 15:17:30.461235 IP 192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
7 15:17:30.798408 IP 192.168.1.249.138 > 192.168.1.255.138: UDP, length 201
8 15:17:33.464213 IP 192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
9 15:17:34.214302 IP 192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
10 15:17:34.964688 IP 192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
11 15:17:35.473290 ARP, Request who-has 192.168.1.1 tell 192.168.1.249, length 28
12 15:17:35.481559 ARP, Reply 192.168.1.1 is-at 00:0d:88:4f:25:91, length 46
13 15:17:35.481577 IP 192.168.1.249.68 > 192.168.1.1.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300
14 15:17:35.622870 EAP packet (0) v1, len 5
15 15:17:35.666378 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300
16 15:17:35.851486 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300
17 15:17:36.156548 EAPOL start (1) v1, len 0
18 15:17:36.158698 EAP packet (0) v1, len 5
19 15:17:37.766046 EAP packet (0) v1, len 45
20 15:17:37.790625 EAP packet (0) v1, len 20
21 15:17:37.830669 EAP packet (0) v1, len 76
22 15:17:37.848577 EAP packet (0) v1, len 80
23 15:17:38.661939 EAP packet (0) v1, len 28
24 15:17:38.685352 EAP packet (0) v1, len 4
25 15:17:38.686358 EAPOL key (3) v1, len 57
26 15:17:38.687182 EAPOL key (3) v1, len 44
27 15:17:39.852392 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300
28 15:17:46.852719 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300
29 15:18:02.852731 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300
30 15:18:08.689384 EAPOL start (1) v1, len 0
31 15:18:08.696826 EAP packet (0) v1, len 5
32 15:18:08.713116 EAP packet (0) v1, len 45
33 15:18:08.787664 EAP packet (0) v1, len 20
34 15:18:10.344628 EAP packet (0) v1, len 76
35 15:18:10.473292 EAP packet (0) v1, len 80
36 15:18:11.152435 EAP packet (0) v1, len 28
37 15:18:11.251425 EAP packet (0) v1, len 4
38 15:18:11.252509 EAPOL key (3) v1, len 57
39 15:18:11.253336 EAPOL key (3) v1, len 44
40 15:18:35.856823 ARP, Request who-has 169.254.67.194 tell 169.254.67.194, length 28
41 15:18:35.885105 ARP, Request who-has 169.254.67.194 tell 169.254.67.194, length 28
42 15:18:36.885304 ARP, Request who-has 169.254.67.194 tell 169.254.67.194, length 28
43 15:18:37.907817 IP 169.254.67.194.4299 > 239.255.255.250.1900: UDP, length 133
44 15:18:37.910524 IP 169.254.67.194 > 224.0.0.22: igmp v3 report, 1 group record(s)
45 15:18:37.964030 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
46 15:18:38.691974 IP 169.254.67.194 > 224.0.0.22: igmp v3 report, 1 group record(s)
47 15:18:38.714004 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
48 15:18:39.464435 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
49 15:18:39.898479 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300
50 15:18:40.214836 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
51 15:18:40.909196 IP 169.254.67.194.4299 > 239.255.255.250.1900: UDP, length 133
52 15:18:40.965632 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
53 15:18:41.254259 EAPOL start (1) v1, len 0
54 15:18:41.256353 EAP packet (0) v1, len 5
55 15:18:41.275901 EAP packet (0) v1, len 45
56 15:18:41.388857 EAP packet (0) v1, len 20
57 15:18:41.715620 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
58 15:18:42.466013 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
59 15:18:42.963175 EAP packet (0) v1, len 76
60 15:18:42.987906 EAP packet (0) v1, len 80
61 15:18:43.216408 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
62 15:18:43.675053 EAP packet (0) v1, len 28
63 15:18:43.695554 EAP packet (0) v1, len 4
64 15:18:43.696547 EAPOL key (3) v1, len 57
65 15:18:43.697368 EAPOL key (3) v1, len 44
66 15:18:43.899684 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300
67 15:18:43.909719 IP 169.254.67.194.4299 > 239.255.255.250.1900: UDP, length 133
68 15:18:43.967353 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
69 15:18:43.967896 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
70 15:18:44.717196 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
71 15:18:44.718161 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
72 15:18:45.467593 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
73 15:18:45.468557 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
74 15:18:46.217980 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
75 15:18:46.218950 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
76 15:18:46.969929 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
77 15:18:46.970205 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 201
78 15:18:48.470207 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
79 15:18:49.970986 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
80 15:18:51.471768 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
81 15:18:52.900388 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300
82 15:18:52.972547 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 191
83 15:18:53.972751 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 191
84 15:18:54.972939 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 191
85 15:18:55.973129 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 191
86 15:18:56.973475 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
87 15:18:57.723686 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
88 15:18:58.474079 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
89 15:18:59.224473 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
90 15:18:59.974983 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
91 15:19:00.725263 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
92 15:19:01.475654 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
93 15:19:02.226046 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
94 15:19:02.976511 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
95 15:19:02.976737 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
96 15:19:02.977520 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 209
97 15:19:02.979092 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
98 15:19:03.728840 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
99 15:19:04.479238 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
100 15:19:07.482218 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
101 15:19:08.232205 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
102 15:19:08.982597 IP 169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
103 15:19:09.900631 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300
104 15:19:13.696821 EAPOL start (1) v1, len 0
105 15:19:13.704581 EAP packet (0) v1, len 5
106 15:19:13.718221 EAP packet (0) v1, len 45
107 15:19:13.734974 EAP packet (0) v1, len 20
108 15:19:14.801245 IP 169.254.67.194.138 > 169.254.255.255.138: UDP, length 201
109 15:19:15.293800 EAP packet (0) v1, len 76
110 15:19:15.312531 EAP packet (0) v1, len 80
111 15:19:15.997763 EAP packet (0) v1, len 28
112 15:19:16.022323 EAP packet (0) v1, len 4
113 15:19:16.023335 EAPOL key (3) v1, len 57
114 15:19:16.024149 EAPOL key (3) v1, len 44

331
tests/eapon1-v-nosmb.out Normal file
View File

@ -0,0 +1,331 @@
1 15:17:28.958610 IP (tos 0x0, ttl 128, id 14471, offset 0, flags [none], proto UDP (17), length 207)
192.168.1.249.138 > 192.168.1.255.138: UDP, length 179
2 15:17:28.958708 IP (tos 0x0, ttl 128, id 14472, offset 0, flags [none], proto UDP (17), length 207)
192.168.1.249.138 > 192.168.1.255.138: UDP, length 179
3 15:17:28.959360 IP (tos 0x0, ttl 128, id 14473, offset 0, flags [none], proto UDP (17), length 237)
192.168.1.249.138 > 192.168.1.255.138: UDP, length 209
4 15:17:28.961018 IP (tos 0x0, ttl 128, id 14474, offset 0, flags [none], proto UDP (17), length 78)
192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
5 15:17:29.710899 IP (tos 0x0, ttl 128, id 14477, offset 0, flags [none], proto UDP (17), length 78)
192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
6 15:17:30.461235 IP (tos 0x0, ttl 128, id 14478, offset 0, flags [none], proto UDP (17), length 78)
192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
7 15:17:30.798408 IP (tos 0x0, ttl 128, id 14479, offset 0, flags [none], proto UDP (17), length 229)
192.168.1.249.138 > 192.168.1.255.138: UDP, length 201
8 15:17:33.464213 IP (tos 0x0, ttl 128, id 14484, offset 0, flags [none], proto UDP (17), length 78)
192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
9 15:17:34.214302 IP (tos 0x0, ttl 128, id 14485, offset 0, flags [none], proto UDP (17), length 78)
192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
10 15:17:34.964688 IP (tos 0x0, ttl 128, id 14486, offset 0, flags [none], proto UDP (17), length 78)
192.168.1.249.137 > 192.168.1.255.137: UDP, length 50
11 15:17:35.473290 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.1 tell 192.168.1.249, length 28
12 15:17:35.481559 ARP, Ethernet (len 6), IPv4 (len 4), Reply 192.168.1.1 is-at 00:0d:88:4f:25:91, length 46
13 15:17:35.481577 IP (tos 0x0, ttl 128, id 14487, offset 0, flags [none], proto UDP (17), length 328)
192.168.1.249.68 > 192.168.1.1.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300, xid 0xc82d253d, secs 36609, Flags [Broadcast]
Client-IP 192.168.1.249
Client-Ethernet-Address 00:04:23:57:a5:7a
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Release
Server-ID (54), length 4: 192.168.1.1
Client-ID (61), length 7: ether 00:04:23:57:a5:7a
14 15:17:35.622870 EAP packet (0) v1, len 5, Request (1), id 1, len 5
Type Identity (1)
15 15:17:35.666378 IP (tos 0x0, ttl 128, id 14495, offset 0, flags [none], proto UDP (17), length 328)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300, xid 0x9817873c, Flags [none]
Client-Ethernet-Address 00:04:23:57:a5:7a
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Discover
NOAUTO (116), length 1: Y
Client-ID (61), length 7: ether 00:04:23:57:a5:7a
Requested-IP (50), length 4: 192.168.1.249
Hostname (12), length 8: "DJP95S0J"
Vendor-Class (60), length 8: "MSFT 5.0"
Parameter-Request (55), length 11:
Subnet-Mask (1), Domain-Name (15), Default-Gateway (3), Domain-Name-Server (6)
Netbios-Name-Server (44), Netbios-Node (46), Netbios-Scope (47), Router-Discovery (31)
Static-Route (33), Classless-Static-Route-Microsoft (249), Vendor-Option (43)
16 15:17:35.851486 IP (tos 0x0, ttl 128, id 14497, offset 0, flags [none], proto UDP (17), length 328)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300, xid 0xd5037d2e, Flags [none]
Client-Ethernet-Address 00:04:23:57:a5:7a
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Discover
NOAUTO (116), length 1: Y
Client-ID (61), length 7: ether 00:04:23:57:a5:7a
Requested-IP (50), length 4: 192.168.1.249
Hostname (12), length 8: "DJP95S0J"
Vendor-Class (60), length 8: "MSFT 5.0"
Parameter-Request (55), length 11:
Subnet-Mask (1), Domain-Name (15), Default-Gateway (3), Domain-Name-Server (6)
Netbios-Name-Server (44), Netbios-Node (46), Netbios-Scope (47), Router-Discovery (31)
Static-Route (33), Classless-Static-Route-Microsoft (249), Vendor-Option (43)
17 15:17:36.156548 EAPOL start (1) v1, len 0
18 15:17:36.158698 EAP packet (0) v1, len 5, Request (1), id 2, len 5
Type Identity (1)
19 15:17:37.766046 EAP packet (0) v1, len 45, Response (2), id 2, len 45
Type Identity (1), Identity: 1295023820005391@mnc023.mcc295.owlan.org
20 15:17:37.790625 EAP packet (0) v1, len 20, Request (1), id 16, len 20
Type SIM (18) subtype [Start] 0x0a,
21 15:17:37.830669 EAP packet (0) v1, len 76, Response (2), id 16, len 76
Type SIM (18) subtype [Start] 0x0a,
22 15:17:37.848577 EAP packet (0) v1, len 80, Request (1), id 17, len 80
Type SIM (18) subtype [Challenge] 0x0b,
23 15:17:38.661939 EAP packet (0) v1, len 28, Response (2), id 17, len 28
Type SIM (18) subtype [Challenge] 0x0b,
24 15:17:38.685352 EAP packet (0) v1, len 4, Success (3), id 0, len 4
25 15:17:38.686358 EAPOL key (3) v1, len 57
26 15:17:38.687182 EAPOL key (3) v1, len 44
27 15:17:39.852392 IP (tos 0x0, ttl 128, id 14503, offset 0, flags [none], proto UDP (17), length 328)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300, xid 0xd5037d2e, secs 26881, Flags [none]
Client-Ethernet-Address 00:04:23:57:a5:7a
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Discover
NOAUTO (116), length 1: Y
Client-ID (61), length 7: ether 00:04:23:57:a5:7a
Requested-IP (50), length 4: 192.168.1.249
Hostname (12), length 8: "DJP95S0J"
Vendor-Class (60), length 8: "MSFT 5.0"
Parameter-Request (55), length 11:
Subnet-Mask (1), Domain-Name (15), Default-Gateway (3), Domain-Name-Server (6)
Netbios-Name-Server (44), Netbios-Node (46), Netbios-Scope (47), Router-Discovery (31)
Static-Route (33), Classless-Static-Route-Microsoft (249), Vendor-Option (43)
28 15:17:46.852719 IP (tos 0x0, ttl 128, id 14511, offset 0, flags [none], proto UDP (17), length 328)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300, xid 0xd5037d2e, secs 26881, Flags [none]
Client-Ethernet-Address 00:04:23:57:a5:7a
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Discover
NOAUTO (116), length 1: Y
Client-ID (61), length 7: ether 00:04:23:57:a5:7a
Requested-IP (50), length 4: 192.168.1.249
Hostname (12), length 8: "DJP95S0J"
Vendor-Class (60), length 8: "MSFT 5.0"
Parameter-Request (55), length 11:
Subnet-Mask (1), Domain-Name (15), Default-Gateway (3), Domain-Name-Server (6)
Netbios-Name-Server (44), Netbios-Node (46), Netbios-Scope (47), Router-Discovery (31)
Static-Route (33), Classless-Static-Route-Microsoft (249), Vendor-Option (43)
29 15:18:02.852731 IP (tos 0x0, ttl 128, id 14514, offset 0, flags [none], proto UDP (17), length 328)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300, xid 0xd5037d2e, secs 26881, Flags [none]
Client-Ethernet-Address 00:04:23:57:a5:7a
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Discover
NOAUTO (116), length 1: Y
Client-ID (61), length 7: ether 00:04:23:57:a5:7a
Requested-IP (50), length 4: 192.168.1.249
Hostname (12), length 8: "DJP95S0J"
Vendor-Class (60), length 8: "MSFT 5.0"
Parameter-Request (55), length 11:
Subnet-Mask (1), Domain-Name (15), Default-Gateway (3), Domain-Name-Server (6)
Netbios-Name-Server (44), Netbios-Node (46), Netbios-Scope (47), Router-Discovery (31)
Static-Route (33), Classless-Static-Route-Microsoft (249), Vendor-Option (43)
30 15:18:08.689384 EAPOL start (1) v1, len 0
31 15:18:08.696826 EAP packet (0) v1, len 5, Request (1), id 3, len 5
Type Identity (1)
32 15:18:08.713116 EAP packet (0) v1, len 45, Response (2), id 3, len 45
Type Identity (1), Identity: 1295023820005391@mnc023.mcc295.owlan.org
33 15:18:08.787664 EAP packet (0) v1, len 20, Request (1), id 47, len 20
Type SIM (18) subtype [Start] 0x0a,
34 15:18:10.344628 EAP packet (0) v1, len 76, Response (2), id 47, len 76
Type SIM (18) subtype [Start] 0x0a,
35 15:18:10.473292 EAP packet (0) v1, len 80, Request (1), id 48, len 80
Type SIM (18) subtype [Challenge] 0x0b,
36 15:18:11.152435 EAP packet (0) v1, len 28, Response (2), id 48, len 28
Type SIM (18) subtype [Challenge] 0x0b,
37 15:18:11.251425 EAP packet (0) v1, len 4, Success (3), id 0, len 4
38 15:18:11.252509 EAPOL key (3) v1, len 57
39 15:18:11.253336 EAPOL key (3) v1, len 44
40 15:18:35.856823 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 169.254.67.194 tell 169.254.67.194, length 28
41 15:18:35.885105 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 169.254.67.194 tell 169.254.67.194, length 28
42 15:18:36.885304 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 169.254.67.194 tell 169.254.67.194, length 28
43 15:18:37.907817 IP (tos 0x0, ttl 1, id 14526, offset 0, flags [none], proto UDP (17), length 161)
169.254.67.194.4299 > 239.255.255.250.1900: UDP, length 133
44 15:18:37.910524 IP (tos 0x0, ttl 1, id 14528, offset 0, flags [none], proto IGMP (2), length 40, options (RA))
169.254.67.194 > 224.0.0.22: igmp v3 report, 1 group record(s) [gaddr 239.255.255.250 to_ex, 0 source(s)]
45 15:18:37.964030 IP (tos 0x0, ttl 128, id 14530, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
46 15:18:38.691974 IP (tos 0x0, ttl 1, id 14532, offset 0, flags [none], proto IGMP (2), length 40, options (RA))
169.254.67.194 > 224.0.0.22: igmp v3 report, 1 group record(s) [gaddr 239.255.255.250 to_ex, 0 source(s)]
47 15:18:38.714004 IP (tos 0x0, ttl 128, id 14533, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
48 15:18:39.464435 IP (tos 0x0, ttl 128, id 14534, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
49 15:18:39.898479 IP (tos 0x0, ttl 128, id 14535, offset 0, flags [none], proto UDP (17), length 328)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300, xid 0x9245394e, Flags [Broadcast]
Client-Ethernet-Address 00:04:23:57:a5:7a
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Discover
NOAUTO (116), length 1: Y
Client-ID (61), length 7: ether 00:04:23:57:a5:7a
Requested-IP (50), length 4: 192.168.1.249
Hostname (12), length 8: "DJP95S0J"
Vendor-Class (60), length 8: "MSFT 5.0"
Parameter-Request (55), length 11:
Subnet-Mask (1), Domain-Name (15), Default-Gateway (3), Domain-Name-Server (6)
Netbios-Name-Server (44), Netbios-Node (46), Netbios-Scope (47), Router-Discovery (31)
Static-Route (33), Classless-Static-Route-Microsoft (249), Vendor-Option (43)
50 15:18:40.214836 IP (tos 0x0, ttl 128, id 14536, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
51 15:18:40.909196 IP (tos 0x0, ttl 1, id 14538, offset 0, flags [none], proto UDP (17), length 161)
169.254.67.194.4299 > 239.255.255.250.1900: UDP, length 133
52 15:18:40.965632 IP (tos 0x0, ttl 128, id 14540, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
53 15:18:41.254259 EAPOL start (1) v1, len 0
54 15:18:41.256353 EAP packet (0) v1, len 5, Request (1), id 4, len 5
Type Identity (1)
55 15:18:41.275901 EAP packet (0) v1, len 45, Response (2), id 4, len 45
Type Identity (1), Identity: 1295023820005391@mnc023.mcc295.owlan.org
56 15:18:41.388857 EAP packet (0) v1, len 20, Request (1), id 80, len 20
Type SIM (18) subtype [Start] 0x0a,
57 15:18:41.715620 IP (tos 0x0, ttl 128, id 14541, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
58 15:18:42.466013 IP (tos 0x0, ttl 128, id 14542, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
59 15:18:42.963175 EAP packet (0) v1, len 76, Response (2), id 80, len 76
Type SIM (18) subtype [Start] 0x0a,
60 15:18:42.987906 EAP packet (0) v1, len 80, Request (1), id 81, len 80
Type SIM (18) subtype [Challenge] 0x0b,
61 15:18:43.216408 IP (tos 0x0, ttl 128, id 14543, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
62 15:18:43.675053 EAP packet (0) v1, len 28, Response (2), id 81, len 28
Type SIM (18) subtype [Challenge] 0x0b,
63 15:18:43.695554 EAP packet (0) v1, len 4, Success (3), id 0, len 4
64 15:18:43.696547 EAPOL key (3) v1, len 57
65 15:18:43.697368 EAPOL key (3) v1, len 44
66 15:18:43.899684 IP (tos 0x0, ttl 128, id 14544, offset 0, flags [none], proto UDP (17), length 328)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300, xid 0x9245394e, secs 10497, Flags [Broadcast]
Client-Ethernet-Address 00:04:23:57:a5:7a
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Discover
NOAUTO (116), length 1: Y
Client-ID (61), length 7: ether 00:04:23:57:a5:7a
Requested-IP (50), length 4: 192.168.1.249
Hostname (12), length 8: "DJP95S0J"
Vendor-Class (60), length 8: "MSFT 5.0"
Parameter-Request (55), length 11:
Subnet-Mask (1), Domain-Name (15), Default-Gateway (3), Domain-Name-Server (6)
Netbios-Name-Server (44), Netbios-Node (46), Netbios-Scope (47), Router-Discovery (31)
Static-Route (33), Classless-Static-Route-Microsoft (249), Vendor-Option (43)
67 15:18:43.909719 IP (tos 0x0, ttl 1, id 14546, offset 0, flags [none], proto UDP (17), length 161)
169.254.67.194.4299 > 239.255.255.250.1900: UDP, length 133
68 15:18:43.967353 IP (tos 0x0, ttl 128, id 14548, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
69 15:18:43.967896 IP (tos 0x0, ttl 128, id 14549, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
70 15:18:44.717196 IP (tos 0x0, ttl 128, id 14552, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
71 15:18:44.718161 IP (tos 0x0, ttl 128, id 14553, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
72 15:18:45.467593 IP (tos 0x0, ttl 128, id 14554, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
73 15:18:45.468557 IP (tos 0x0, ttl 128, id 14555, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
74 15:18:46.217980 IP (tos 0x0, ttl 128, id 14556, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
75 15:18:46.218950 IP (tos 0x0, ttl 128, id 14557, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
76 15:18:46.969929 IP (tos 0x0, ttl 128, id 14563, offset 0, flags [none], proto UDP (17), length 207)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
77 15:18:46.970205 IP (tos 0x0, ttl 128, id 14564, offset 0, flags [none], proto UDP (17), length 229)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 201
78 15:18:48.470207 IP (tos 0x0, ttl 128, id 14566, offset 0, flags [none], proto UDP (17), length 207)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
79 15:18:49.970986 IP (tos 0x0, ttl 128, id 14567, offset 0, flags [none], proto UDP (17), length 207)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
80 15:18:51.471768 IP (tos 0x0, ttl 128, id 14568, offset 0, flags [none], proto UDP (17), length 207)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
81 15:18:52.900388 IP (tos 0x0, ttl 128, id 14569, offset 0, flags [none], proto UDP (17), length 328)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300, xid 0x9245394e, secs 10497, Flags [Broadcast]
Client-Ethernet-Address 00:04:23:57:a5:7a
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Discover
NOAUTO (116), length 1: Y
Client-ID (61), length 7: ether 00:04:23:57:a5:7a
Requested-IP (50), length 4: 192.168.1.249
Hostname (12), length 8: "DJP95S0J"
Vendor-Class (60), length 8: "MSFT 5.0"
Parameter-Request (55), length 11:
Subnet-Mask (1), Domain-Name (15), Default-Gateway (3), Domain-Name-Server (6)
Netbios-Name-Server (44), Netbios-Node (46), Netbios-Scope (47), Router-Discovery (31)
Static-Route (33), Classless-Static-Route-Microsoft (249), Vendor-Option (43)
82 15:18:52.972547 IP (tos 0x0, ttl 128, id 14570, offset 0, flags [none], proto UDP (17), length 219)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 191
83 15:18:53.972751 IP (tos 0x0, ttl 128, id 14571, offset 0, flags [none], proto UDP (17), length 219)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 191
84 15:18:54.972939 IP (tos 0x0, ttl 128, id 14572, offset 0, flags [none], proto UDP (17), length 219)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 191
85 15:18:55.973129 IP (tos 0x0, ttl 128, id 14573, offset 0, flags [none], proto UDP (17), length 219)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 191
86 15:18:56.973475 IP (tos 0x0, ttl 128, id 14574, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
87 15:18:57.723686 IP (tos 0x0, ttl 128, id 14575, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
88 15:18:58.474079 IP (tos 0x0, ttl 128, id 14576, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
89 15:18:59.224473 IP (tos 0x0, ttl 128, id 14579, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
90 15:18:59.974983 IP (tos 0x0, ttl 128, id 14580, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
91 15:19:00.725263 IP (tos 0x0, ttl 128, id 14581, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
92 15:19:01.475654 IP (tos 0x0, ttl 128, id 14582, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
93 15:19:02.226046 IP (tos 0x0, ttl 128, id 14583, offset 0, flags [none], proto UDP (17), length 96)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 68
94 15:19:02.976511 IP (tos 0x0, ttl 128, id 14584, offset 0, flags [none], proto UDP (17), length 207)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
95 15:19:02.976737 IP (tos 0x0, ttl 128, id 14585, offset 0, flags [none], proto UDP (17), length 207)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 179
96 15:19:02.977520 IP (tos 0x0, ttl 128, id 14586, offset 0, flags [none], proto UDP (17), length 237)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 209
97 15:19:02.979092 IP (tos 0x0, ttl 128, id 14587, offset 0, flags [none], proto UDP (17), length 78)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
98 15:19:03.728840 IP (tos 0x0, ttl 128, id 14588, offset 0, flags [none], proto UDP (17), length 78)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
99 15:19:04.479238 IP (tos 0x0, ttl 128, id 14589, offset 0, flags [none], proto UDP (17), length 78)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
100 15:19:07.482218 IP (tos 0x0, ttl 128, id 14593, offset 0, flags [none], proto UDP (17), length 78)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
101 15:19:08.232205 IP (tos 0x0, ttl 128, id 14594, offset 0, flags [none], proto UDP (17), length 78)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
102 15:19:08.982597 IP (tos 0x0, ttl 128, id 14596, offset 0, flags [none], proto UDP (17), length 78)
169.254.67.194.137 > 169.254.255.255.137: UDP, length 50
103 15:19:09.900631 IP (tos 0x0, ttl 128, id 14598, offset 0, flags [none], proto UDP (17), length 328)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:04:23:57:a5:7a, length 300, xid 0x9245394e, secs 10497, Flags [Broadcast]
Client-Ethernet-Address 00:04:23:57:a5:7a
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Discover
NOAUTO (116), length 1: Y
Client-ID (61), length 7: ether 00:04:23:57:a5:7a
Requested-IP (50), length 4: 192.168.1.249
Hostname (12), length 8: "DJP95S0J"
Vendor-Class (60), length 8: "MSFT 5.0"
Parameter-Request (55), length 11:
Subnet-Mask (1), Domain-Name (15), Default-Gateway (3), Domain-Name-Server (6)
Netbios-Name-Server (44), Netbios-Node (46), Netbios-Scope (47), Router-Discovery (31)
Static-Route (33), Classless-Static-Route-Microsoft (249), Vendor-Option (43)
104 15:19:13.696821 EAPOL start (1) v1, len 0
105 15:19:13.704581 EAP packet (0) v1, len 5, Request (1), id 5, len 5
Type Identity (1)
106 15:19:13.718221 EAP packet (0) v1, len 45, Response (2), id 5, len 45
Type Identity (1), Identity: 1295023820005391@mnc023.mcc295.owlan.org
107 15:19:13.734974 EAP packet (0) v1, len 20, Request (1), id 112, len 20
Type SIM (18) subtype [Start] 0x0a,
108 15:19:14.801245 IP (tos 0x0, ttl 128, id 14604, offset 0, flags [none], proto UDP (17), length 229)
169.254.67.194.138 > 169.254.255.255.138: UDP, length 201
109 15:19:15.293800 EAP packet (0) v1, len 76, Response (2), id 112, len 76
Type SIM (18) subtype [Start] 0x0a,
110 15:19:15.312531 EAP packet (0) v1, len 80, Request (1), id 113, len 80
Type SIM (18) subtype [Challenge] 0x0b,
111 15:19:15.997763 EAP packet (0) v1, len 28, Response (2), id 113, len 28
Type SIM (18) subtype [Challenge] 0x0b,
112 15:19:16.022323 EAP packet (0) v1, len 4, Success (3), id 0, len 4
113 15:19:16.023335 EAPOL key (3) v1, len 57
114 15:19:16.024149 EAPOL key (3) v1, len 44

64
tests/ipx-nosmb.out Normal file
View File

@ -0,0 +1,64 @@
1 10:06:29.360507 IPX a8f87967.00:00:00:00:00:01.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
2 10:06:30.201745 IPX a8f87967.00:00:00:00:00:01.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
3 10:06:31.042990 IPX a8f87967.00:00:00:00:00:01.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
4 10:06:31.884337 IPX a8f87967.00:00:00:00:00:01.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 162
5 10:06:37.582596 IPX 00000000.00:03:47:1b:c1:a8.0453 > 00000000.ff:ff:ff:ff:ff:ff.0453: ipx-rip-resp a8f87967/1.2
6 10:07:10.193661 IPX 00000000.00:30:c1:bf:57:55.0452 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 030c '0030C1BF575580D0NPIBF5755' addr 00000000.00:30:c1:bf:57:55
7 10:07:14.493808 IPX 00000000.00:14:85:ac:cd:ad.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'EKTA!!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:14:85:ac:cd:ad
8 10:07:15.678126 IPX 00000000.00:13:20:61:83:a3.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'AVESH!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:13:20:61:83:a3
9 10:07:37.591287 IPX 00000000.00:03:47:1b:c1:a8.0453 > 00000000.ff:ff:ff:ff:ff:ff.0453: ipx-rip-resp a8f87967/1.2
10 10:08:10.194090 IPX 00000000.00:30:c1:bf:57:55.0452 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 030c '0030C1BF575580D0NPIBF5755' addr 00000000.00:30:c1:bf:57:55
11 10:08:14.495094 IPX 00000000.00:14:85:ac:cd:ad.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'EKTA!!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:14:85:ac:cd:ad
12 10:08:15.680165 IPX 00000000.00:13:20:61:83:a3.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'AVESH!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:13:20:61:83:a3
13 10:08:37.599970 IPX 00000000.00:03:47:1b:c1:a8.0453 > 00000000.ff:ff:ff:ff:ff:ff.0453: ipx-rip-resp a8f87967/1.2
14 10:08:38.551958 IPX 00000000.00:13:20:61:83:a3.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
15 10:08:39.372318 IPX 00000000.00:13:20:61:83:a3.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
16 10:08:40.192665 IPX 00000000.00:13:20:61:83:a3.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
17 10:09:10.194823 IPX 00000000.00:30:c1:bf:57:55.0452 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 030c '0030C1BF575580D0NPIBF5755' addr 00000000.00:30:c1:bf:57:55
18 10:09:14.496475 IPX 00000000.00:14:85:ac:cd:ad.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'EKTA!!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:14:85:ac:cd:ad
19 10:09:15.682197 IPX 00000000.00:13:20:61:83:a3.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'AVESH!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:13:20:61:83:a3
20 10:09:37.608654 IPX 00000000.00:03:47:1b:c1:a8.0453 > 00000000.ff:ff:ff:ff:ff:ff.0453: ipx-rip-resp a8f87967/1.2
21 10:10:10.195140 IPX 00000000.00:30:c1:bf:57:55.0452 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 030c '0030C1BF575580D0NPIBF5755' addr 00000000.00:30:c1:bf:57:55
22 10:10:14.497849 IPX 00000000.00:14:85:ac:cd:ad.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'EKTA!!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:14:85:ac:cd:ad
23 10:10:15.684220 IPX 00000000.00:13:20:61:83:a3.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'AVESH!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:13:20:61:83:a3
24 10:10:37.617332 IPX 00000000.00:03:47:1b:c1:a8.0453 > 00000000.ff:ff:ff:ff:ff:ff.0453: ipx-rip-resp a8f87967/1.2
25 10:11:10.195573 IPX 00000000.00:30:c1:bf:57:55.0452 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 030c '0030C1BF575580D0NPIBF5755' addr 00000000.00:30:c1:bf:57:55
26 10:11:14.499230 IPX 00000000.00:14:85:ac:cd:ad.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'EKTA!!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:14:85:ac:cd:ad
27 10:11:15.686236 IPX 00000000.00:13:20:61:83:a3.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'AVESH!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:13:20:61:83:a3
28 10:11:32.018797 IPX 00000000.00:13:20:61:83:a3.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
29 10:11:32.839133 IPX 00000000.00:13:20:61:83:a3.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
30 10:11:33.659468 IPX 00000000.00:13:20:61:83:a3.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
31 10:11:34.479872 IPX 00000000.00:13:20:61:83:a3.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 158
32 10:11:37.612708 IPX 00000000.00:13:20:61:83:a3.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
33 10:11:37.625971 IPX 00000000.00:03:47:1b:c1:a8.0453 > 00000000.ff:ff:ff:ff:ff:ff.0453: ipx-rip-resp a8f87967/1.2
34 10:11:38.433061 IPX 00000000.00:13:20:61:83:a3.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
35 10:11:39.253404 IPX 00000000.00:13:20:61:83:a3.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
36 10:11:40.073983 IPX 00000000.00:13:20:61:83:a3.0553 > 00000000.ff:ff:ff:ff:ff:ff.0553: ipx-nwlink-dgm 187
37 10:12:10.196195 IPX 00000000.00:30:c1:bf:57:55.0452 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 030c '0030C1BF575580D0NPIBF5755' addr 00000000.00:30:c1:bf:57:55
38 10:12:14.500611 IPX 00000000.00:14:85:ac:cd:ad.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'EKTA!!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:14:85:ac:cd:ad
39 10:12:15.688284 IPX 00000000.00:13:20:61:83:a3.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'AVESH!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:13:20:61:83:a3
40 10:12:37.273549 IPX 00000000.00:14:85:ac:cd:ad.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
41 10:12:37.634677 IPX 00000000.00:03:47:1b:c1:a8.0453 > 00000000.ff:ff:ff:ff:ff:ff.0453: ipx-rip-resp a8f87967/1.2
42 10:12:38.052852 IPX 00000000.00:14:85:ac:cd:ad.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
43 10:12:38.832161 IPX 00000000.00:14:85:ac:cd:ad.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
44 10:12:39.611592 IPX 00000000.00:14:85:ac:cd:ad.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 157
45 10:13:07.039144 IPX 00000000.00:14:85:ac:cd:ad.0553 > 00000000.ff:ff:ff:ff:ff:ff.0553: ipx-nwlink-dgm 187
46 10:13:07.040801 IPX 00000000.00:14:85:ac:cd:ad.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
47 10:13:07.820138 IPX 00000000.00:14:85:ac:cd:ad.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
48 10:13:08.599456 IPX 00000000.00:14:85:ac:cd:ad.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
49 10:13:10.196429 IPX 00000000.00:30:c1:bf:57:55.0452 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 030c '0030C1BF575580D0NPIBF5755' addr 00000000.00:30:c1:bf:57:55
50 10:13:14.501998 IPX 00000000.00:14:85:ac:cd:ad.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'EKTA!!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:14:85:ac:cd:ad
51 10:13:15.690301 IPX 00000000.00:13:20:61:83:a3.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'AVESH!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:13:20:61:83:a3
52 10:13:37.643338 IPX 00000000.00:03:47:1b:c1:a8.0453 > 00000000.ff:ff:ff:ff:ff:ff.0453: ipx-rip-resp a8f87967/1.2
53 10:14:02.970836 IPX a8f87967.00:00:00:00:00:01.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
54 10:14:03.812078 IPX a8f87967.00:00:00:00:00:01.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
55 10:14:04.653327 IPX a8f87967.00:00:00:00:00:01.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
56 10:14:05.495223 IPX a8f87967.00:00:00:00:00:01.0553 > 00000000.ff:ff:ff:ff:ff:ff.0553: ipx-nwlink-dgm 187
57 10:14:10.197156 IPX 00000000.00:30:c1:bf:57:55.0452 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 030c '0030C1BF575580D0NPIBF5755' addr 00000000.00:30:c1:bf:57:55
58 10:14:14.503363 IPX 00000000.00:14:85:ac:cd:ad.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'EKTA!!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:14:85:ac:cd:ad
59 10:14:15.692322 IPX 00000000.00:13:20:61:83:a3.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'AVESH!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:13:20:61:83:a3
60 10:14:37.652060 IPX 00000000.00:03:47:1b:c1:a8.0453 > 00000000.ff:ff:ff:ff:ff:ff.0453: ipx-rip-resp a8f87967/1.2
61 10:15:10.197478 IPX 00000000.00:30:c1:bf:57:55.0452 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 030c '0030C1BF575580D0NPIBF5755' addr 00000000.00:30:c1:bf:57:55
62 10:15:14.504755 IPX 00000000.00:14:85:ac:cd:ad.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'EKTA!!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:14:85:ac:cd:ad
63 10:15:15.694341 IPX 00000000.00:13:20:61:83:a3.4008 > 00000000.ff:ff:ff:ff:ff:ff.0452: ipx-sap-resp 064e 'AVESH!!!!!!!!!!A5569B20ABE511CE9CA400004C762832' addr 00000000.00:13:20:61:83:a3
64 10:15:37.660716 IPX 00000000.00:03:47:1b:c1:a8.0453 > 00000000.ff:ff:ff:ff:ff:ff.0453: ipx-rip-resp a8f87967/1.2

2
tests/nbns-valgrind-nosmb.out Normal file
View File

@ -0,0 +1,2 @@
1 15:02:25.894083 00:0c:85:0e:a5:ff > 00:00:0c:07:ac:f0, ethertype IPv4 (0x0800), length 92: (tos 0x0, ttl 127, id 38615, offset 0, flags [none], proto UDP (17), length 78)
10.49.248.228.137 > 10.48.161.241.137: UDP, length 50

140
tests/smb.tests Normal file
View File

@ -0,0 +1,140 @@
# -*- perl -*-
# Only attempt OpenSSL-specific tests when compiled with the library.
# Reading the secret(s) from a file does not work with Capsicum.
$testlist = [
# EAP tests
{
config_set => 'ENABLE_SMB',
name => 'eapon1',
input => 'eapon1.pcap',
output => 'eapon1.out',
},
{
config_unset => 'ENABLE_SMB',
name => 'eapon1-nosmb',
input => 'eapon1.pcap',
output => 'eapon1-nosmb.out',
},
{
config_set => 'ENABLE_SMB',
name => 'eapon1-v',
input => 'eapon1.pcap',
output => 'eapon1-v.out',
args => '-v'
},
{
config_unset => 'ENABLE_SMB',
name => 'eapon1-v-nosmb',
input => 'eapon1.pcap',
output => 'eapon1-v-nosmb.out',
args => '-v'
},
# IPX/Netware packets
{
config_set => 'ENABLE_SMB',
name => 'ipx',
input => 'ipx.pcap',
output => 'ipx.out',
},
{
config_unset => 'ENABLE_SMB',
name => 'ipx-nosmb',
input => 'ipx.pcap',
output => 'ipx-nosmb.out',
},
# bad packets from Otto Airamo and Antti Levomäki
{
config_set => 'ENABLE_SMB',
name => 'nbns-valgrind',
input => 'nbns-valgrind.pcap',
output => 'nbns-valgrind.out',
args => '-vvv -e',
},
{
config_unset => 'ENABLE_SMB',
name => 'nbns-valgrind-nosmb',
input => 'nbns-valgrind.pcap',
output => 'nbns-valgrind-nosmb.out',
args => '-vvv -e',
},
# bad packets from Junjie Wang
{
config_set => 'ENABLE_SMB',
name => 'smb_print_trans-oobr1',
input => 'smb_print_trans-oobr1.pcap',
output => 'smb_print_trans-oobr1.out',
args => '-vv',
},
{
config_unset => 'ENABLE_SMB',
name => 'smb_print_trans-oobr1-nosmb',
input => 'smb_print_trans-oobr1.pcap',
output => 'smb_print_trans-oobr1-nosmb.out',
args => '-vv',
},
# bad packets from Philippe Antoine
{
config_set => 'ENABLE_SMB',
name => 'smb_print_trans-oobr2',
input => 'smb_print_trans-oobr2.pcap',
output => 'smb_print_trans-oobr2.out',
args => '-vv',
},
{
config_unset => 'ENABLE_SMB',
name => 'smb_print_trans-oobr2-nosmb',
input => 'smb_print_trans-oobr2.pcap',
output => 'smb_print_trans-oobr2-nosmb.out',
args => '-vv',
},
# bad packets from Luis Rocha
{
config_set => 'ENABLE_SMB',
name => 'smb_data_print-oobr',
input => 'smb_data_print-oobr.pcapng',
output => 'smb_data_print-oobr.out',
args => '-vv',
},
{
config_unset => 'ENABLE_SMB',
name => 'smb_data_print-oobr-nosmb',
input => 'smb_data_print-oobr.pcapng',
output => 'smb_data_print-oobr-nosmb.out',
args => '-vv',
},
{
config_set => 'ENABLE_SMB',
name => 'smb_data_print-segv',
input => 'smb_data_print-segv.pcapng',
output => 'smb_data_print-segv.out',
args => '-vv',
},
{
config_unset => 'ENABLE_SMB',
name => 'smb_data_print-segv-nosmb',
input => 'smb_data_print-segv.pcapng',
output => 'smb_data_print-segv-nosmb.out',
args => '-vv',
},
];
1;

8
tests/smb_data_print-oobr-nosmb.out Normal file
View File

@ -0,0 +1,8 @@
1 15:35:08.640523 IP (tos 0x0, ttl 128, id 376, offset 0, flags [DF], proto TCP (6), length 128)
192.168.56.55.445 > 192.168.56.119.49199: Flags [P.], cksum 0x3e2f (incorrect -> 0x3e31), seq 4267808374:4267808462, ack 628292694, win 63102, length 88
2 15:35:08.640906 IP (tos 0x0, ttl 128, id 632, offset 0, flags [DF], proto TCP (6), length 114)
192.168.56.119.49199 > 192.168.56.55.445: Flags [P.], cksum 0x2437 (correct), seq 1:75, ack 88, win 254, length 74
3 15:35:08.641033 IP (tos 0x0, ttl 128, id 377, offset 0, flags [DF], proto TCP (6), length 120)
192.168.56.55.445 > 192.168.56.119.49199: Flags [P.], cksum 0x00fb (incorrect -> 0x11f5), seq 88:168, ack 75, win 62978, length 80
4 15:35:08.641358 IP (tos 0x0, ttl 128, id 633, offset 0, flags [DF], proto TCP (6), length 116)
192.168.56.119.49199 > 192.168.56.55.445: Flags [P.], cksum 0x2253 (correct), seq 75:151, ack 168, win 253, length 76

8
tests/smb_data_print-segv-nosmb.out Normal file
View File

@ -0,0 +1,8 @@
1 15:35:08.640523 IP (tos 0x0, ttl 128, id 376, offset 0, flags [DF], proto TCP (6), length 128)
192.168.56.55.445 > 192.168.56.119.49199: Flags [P.], cksum 0x3e2f (incorrect -> 0x3d49), seq 4267808374:4267808462, ack 628292694, win 63102, length 88
2 15:35:08.640906 IP (tos 0x0, ttl 128, id 632, offset 0, flags [DF], proto TCP (6), length 114)
192.168.56.119.49199 > 192.168.56.55.445: Flags [P.], cksum 0x2437 (correct), seq 1:75, ack 88, win 254, length 74
3 15:35:08.641033 IP (tos 0x0, ttl 128, id 377, offset 0, flags [DF], proto TCP (6), length 120)
192.168.56.55.445 > 192.168.56.119.49199: Flags [P.], cksum 0xf1fb (incorrect -> 0x1559), seq 88:168, ack 75, win 63028, length 80
4 [Error converting time] IP (tos 0x0, ttl 128, id 633, offset 0, flags [DF], proto TCP (6), length 116)
192.168.56.119.49199 > 192.168.56.55.445: Flags [P.], cksum 0x2253 (incorrect -> 0x229b), seq 75:151, ack 168, win 253, length 76

4
tests/smb_print_trans-oobr1-nosmb.out Normal file
View File

@ -0,0 +1,4 @@
1 10:06:29.360507 IPX a8f87967.00:00:00:00:00:01.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
2 10:06:30.201745 IPX a8f87967.00:00:00:00:00:01.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
3 10:06:31.042990 IPX a8f87967.00:00:00:ff:ff:ff.7f55 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50
4 10:06:31.884337 IPX a855000b.41:44:4d:49:4e:54.4553 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 162

2
tests/smb_print_trans-oobr2-nosmb.out Normal file
View File

@ -0,0 +1,2 @@
1 15:17:28.958610 IP (tos 0x0, ttl 128, id 14471, offset 0, flags [none], proto UDP (17), length 207)
192.168.1.249.138 > 192.168.1.255.138: UDP, length 179