Register packet analyser for Multicast mac address

Zeek
1

Hi,

I am trying to extend below spicy parser to support Profinet ptcp protocol.

profinet-parser

I have added PTCP frame like below . The packet which I am using is having multicast DMAC: 01:80:C2:00:00:0E and SMAC: unicast mac

It is having ether type 0X8892.

Then frame id : 0xff40.

I have added below part in spicy script and just trying to print the data in the zeek script

#spicy file changes

public type Packet = unit {
        frame_id:  uint16;
        ptcp_frame: PTCPFrame if ( 0xff40 <= self.frame_id && self.frame_id <= 0xff5f );
        rtc_frame: RTCFrame if ( 0x0100 <= self.frame_id && self.frame_id <= 0xfbff );
        dcp_frame: DCPFrame if ( 0xfefc <= self.frame_id && self.frame_id <= 0xfeff );
        data: bytes &eod;
};


public type PTCPFrame = unit() {
        data: bytes &eod;
};

#zeek file changes

module PacketAnalyzer::SPICY_PROFINETIO;

module ProfinetIO;

export {

        type PTCPHeader: record {
                ## PTCP data
                data:   string;
        };
}

event zeek_init()
        {
     
        if ( ! PacketAnalyzer::try_register_packet_analyzer_by_name("Ethernet", 0x8892, "spicy_ProfinetIO") )
                print "cannot register ProfinetIO analyzer";
        }

#evt file changes

on ProfinetIO::Packet::ptcp_frame -> event ProfinetIO::ptcp_message(self.data);

#zeek script changes
event ProfinetIO::ptcp_message(payload: string)
        {
        local ph = get_current_packet_header();
        local rec: ProfinetIO::PTCPInfo = [
                $ts = network_time(),
                $smac=ph$l2$src,
                $dmac=ph$l2$dst,
                $data = payload];

        print "Sending ptcp message data >>", rec;

        Log::write(ProfinetIO::LOG_PTCP, rec);
        }

However I am not getting anything for PTCP packets, whereas using the same parser and analyser I am getting all packets for DCP, RTC protocols
Please help me understand the issue.

Thanks & Regards

pn_pkts.pcapng (624 Bytes)

pn_pkts_1.pcapng (624 Bytes)

Biswa

2

Running your modified parser against your PCAP fails with parse errors.

$ HILTI_DEBUG=zeek:spicy zeek spicy-analyzer/ProfinetIO.hlto spicy-analyzer/ProfinetIO.zeek scripts -r pn_pkts.pcapng
[zeek] Registering TCP protocol analyzer Finger (scope 0x1) with Zeek
[zeek] Registering TCP protocol analyzer LDAP_TCP (scope 0x2) with Zeek
[zeek] Registering UDP protocol analyzer LDAP_UDP (scope 0x2) with Zeek
[zeek] Registering TCP protocol analyzer PostgreSQL (scope 0x3) with Zeek
[zeek] Registering UDP protocol analyzer QUIC (scope 0x4) with Zeek
[zeek] Registering TCP protocol analyzer Redis (scope 0x5) with Zeek
[zeek] Registering UDP protocol analyzer Syslog (scope 0x6) with Zeek
[zeek] Registering TCP protocol analyzer spicy::WebSocket (scope 0x7) with Zeek
[zeek] Registering packet analyzer spicy::ProfinetIO (scope 0x14b94755b2c98a8c) with Zeek
[zeek] Done with post-script initialization
[zeek] [SPICY_PROFINETIO] block: |\\x90\\x01\\x80\\x80\\x80\\x80\\x80\\x80\\x80\\x80\\x80p\\x00\\x08\\x05\\x03\\x00\\x06\\x00<\\xa4^\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00...|
[spicy] ProfinetIO::Packet
[spicy]   frame_id = 36865
[spicy]   ProfinetIO::RTCFrame
[zeek] [SPICY_PROFINETIO] expected 131 bytes (44 available) (.../zeek-profinet-analyzer/spicy-analyzer/ProfinetIO.spicy:48:2-48:34)
[zeek] [SPICY_PROFINETIO] error during parsing, triggering analyzer violation: expected 131 bytes (44 available) (.../zeek-profinet-analyzer/spicy-analyzer/ProfinetIO.spicy:48:2-48:34)
[zeek] [SPICY_PROFINETIO] block: |\\x90\\x02\\x80\\x80\\x80\\x80\\x80\\x80\\x80\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00...|
[spicy]     ProfinetIO::Packet
[spicy]       frame_id = 36866
[spicy]       ProfinetIO::RTCFrame
[zeek] [SPICY_PROFINETIO] expected 131 bytes (44 available) (.../zeek-profinet-analyzer/spicy-analyzer/ProfinetIO.spicy:48:2-48:34)
[zeek] [SPICY_PROFINETIO] error during parsing, triggering analyzer violation: expected 131 bytes (44 available) (.../zeek-profinet-analyzer/spicy-analyzer/ProfinetIO.spicy:48:2-48:34)
[zeek] Shutting down Spicy runtime

This shows that your parser still tries to parse the payload as RTCFrame and not as the PTCPFrame you added. As a note, PTCPFrame parses bytes &eod, so it consumes all input data and Packet.data will always be empty.

We have a section dedicated to debugging in our docs. It contains a lot of information needed when developing Zeek analyzers with Spicy.

1 Like
3

Thanks it’s solved by writing the frame structures properly.