Hi Zeek’s devs,
I am interested in an analyzer for the NTP protocol. I have seen that there is one in Zeek, but it doesn’t really parse all fields in details. Is anyone working on extending the present analyzer? Would it be of interest for the community to do so?
Is there any reason why the present analyzer is written in C++ rather than binpac?
Thanks,
Mauro
No one is working on it that I know of and it’s written in C++ because it’s older. I think at some point I rewrote it in binpac but I suspect that has been lost to the sands of time at this point. A couple of years ago I think some others were working on ntp related stuff but I don’t know if that went anywhere.
If you’re up for it, feel free to take on the ntp analyzer and rehab it!
.Seth
There’s some work in branch topic/vladg/ntp, but that’s incomplete and ~3 years old.
–Vlad
Ok, thanks for the feedback. I’ll have a look at that. I need to get something working soon. But I’ll keep everybody posted about what I can do about this analyzer.
Mauro
Inviato: domenica 26 maggio 2019 14:30