-
Notifications
You must be signed in to change notification settings - Fork 160
/
netcap.proto
2001 lines (1836 loc) · 54.7 KB
/
netcap.proto
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
//
// / |
// _______ ______ _10 |_ _______ ______ ______
// / / \ / / \ / 01/ | / / | / / \ / / \
// 0010100 /|/011010 /|101010/ /0101010/ 001010 |/100110 |
// 01 | 00 |00 00 | 10 | __ 00 | / 10 |00 | 01 |
// 10 | 01 |01001010/ 00 |/ |01 \_____ /0101000 |00 |__10/|
// 10 | 00 |00/ / | 10 00/ 00/ / |00 00 |00/ 00/
// 00/ 10/ 0101000/ 0010/ 0010010/ 0010100/ 1010100/
// 00 |
// 00 |
// 00/
// NETCAP - Traffic Analysis Framework
// Copyright (c) 2017 Philipp Mieden <dreadl0ck [at] protonmail [dot] ch>
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
//
// netcap uses proto v3 syntax
syntax = "proto3";
// generated protocol buffer code will be put into the "types" package
package types;
option go_package = "types";
option java_multiple_files = true;
option java_outer_classname = "NetcapProto";
option java_package = "com.types";
// Caveats:
// - there are no uint8 and uint16 types in protobuf:
// The non-fixed integer types use variable length encoding
// use int32 for 16 bit and 8 bit integers and let the variable-length-encoding part take care of not sending the bytes you're not using
// –> the mu type is too short
// - strings have to be encoded in utf-8, otherwise encoding to proto will fail
//
// * Enums for Netcap Types
// * Due to the C++ scoping implemented by the proto compiler,
// * enum names cannot be the same as the corresponding message type.
// * Solution: add NC_ Prefix to each entry. NC stands for NetCap.
// * Constants will follow this naming scheme Type_NC_<Record>
// * Example: Type_NC_TCP
//
enum Type {
NC_Header = 0;
NC_Batch = 1;
NC_Connection = 3;
NC_Ethernet = 7;
NC_ARP = 8;
NC_Dot1Q = 9;
NC_Dot11 = 10;
NC_Dot11QOS = 11;
NC_Dot11HTControl = 12;
NC_Dot11HTControlVHT = 13;
NC_Dot11HTControlHT = 14;
NC_Dot11HTControlMFB = 15;
NC_Dot11LinkAdapationControl = 16;
NC_Dot11ASEL = 17;
NC_LinkLayerDiscovery = 18;
NC_LLDPChassisID = 19;
NC_LLDPPortID = 20;
NC_LinkLayerDiscoveryValue = 21;
NC_EthernetCTP = 22;
NC_EthernetCTPReply = 23;
NC_LinkLayerDiscoveryInfo = 24;
NC_LLDPSysCapabilities = 25;
NC_LLDPCapabilities = 26;
NC_LLDPMgmtAddress = 27;
NC_LLDPOrgSpecificTLV = 28;
NC_IPv4 = 29;
NC_IPv4Option = 30;
NC_IPv6 = 31;
NC_ICMPv4 = 32;
NC_ICMPv6 = 33;
NC_ICMPv6NeighborAdvertisement = 34;
NC_ICMPv6RouterAdvertisement = 35;
NC_ICMPv6Option = 36;
NC_UDP = 37;
NC_TCP = 38;
NC_TCPOption = 39;
NC_SCTP = 40;
NC_DNS = 41;
NC_DNSResourceRecord = 42;
NC_DNSSOA = 43;
NC_DNSSRV = 44;
NC_DNSMX = 45;
NC_DNSQuestion = 46;
NC_DHCPv4 = 47;
NC_DHCPOption = 48;
NC_DHCPv6 = 49;
NC_DHCPv6Option = 50;
NC_LLC = 51;
NC_NTP = 52;
NC_SIP = 53;
NC_IGMP = 54;
NC_IGMPv3GroupRecord = 55;
NC_IPv6HopByHop = 56;
NC_IPv6HopByHopOption = 57;
NC_IPv6HopByHopOptionAlignment = 58;
NC_SNAP = 59;
NC_ICMPv6Echo = 60;
NC_ICMPv6NeighborSolicitation = 61;
NC_ICMPv6RouterSolicitation = 62;
NC_HTTP = 63;
NC_TLSClientHello = 64;
NC_IPSecAH = 65;
NC_IPSecESP = 66;
NC_Geneve = 67;
NC_IPv6Fragment = 68;
NC_VXLAN = 69;
NC_USB = 70;
NC_LCM = 71;
NC_MPLS = 72;
NC_Modbus = 73;
NC_OSPFv2 = 74;
NC_OSPFv3 = 75;
NC_BFD = 76;
NC_GRE = 77;
NC_FDDI = 78;
NC_EAP = 79;
NC_VRRPv2 = 80;
NC_EAPOL = 81;
NC_EAPOLKey = 82;
NC_CiscoDiscovery = 83;
NC_CiscoDiscoveryInfo = 84;
NC_USBRequestBlockSetup = 85;
NC_NortelDiscovery = 86;
NC_CIP = 87;
NC_ENIP = 88;
NC_DeviceProfile = 89;
NC_File = 90;
NC_SMTP = 91;
NC_Diameter = 92;
NC_POP3 = 93;
NC_TLSServerHello = 94;
NC_Software = 95;
NC_Service = 96;
NC_Credentials = 97;
NC_SSH = 98;
NC_Vulnerability = 99;
NC_Exploit = 100;
NC_IPProfile = 101;
NC_Mail = 102;
NC_Alert = 103;
}
//
// * Netcap File Header
// * First Record in every .ncap file
// * Stores meta information
//
message Header {
int64 Created = 1; // Timestamp of creation date
string InputSource = 2; // interface name or name of dumpfile
Type Type = 3; // netcap data type
string Version = 4; // Netcap version string
bool ContainsPayloads = 5;
}
//
// * Data Batch
// * Used for sending data from sensor to collector
//
message Batch {
string ClientID = 1; // unique client identifier
Type MessageType = 2; // netcap data type
int32 TotalSize = 3; // data size in bytes
bytes Data = 4; // actual data, (serialized protocol buffers)
bool ContainsPayloads = 5; // does the batch contain audit records with payload data?
}
//
// * Utils
// *
// * PacketContext allows to preserve context of the original packet
// * for audit records that would loose such information because they describe a layer without this info
// * this is used to add flow information to Transport and Application Layer Types
//
message PacketContext {
string SrcIP = 1;
string DstIP = 2;
int32 SrcPort = 3;
int32 DstPort = 4;
}
// a connection has the following attributes:
// Mac <-> Mac bidirectional Mac
// IP <-> IP bidirectional IP
// Port <-> Port bidirectional Port
message Connection {
int64 TimestampFirst = 1;
string LinkProto = 2;
string NetworkProto = 3;
string TransportProto = 4;
string ApplicationProto = 5;
string SrcMAC = 6;
string DstMAC = 7;
string SrcIP = 8;
string SrcPort = 9;
string DstIP = 10;
string DstPort = 11;
int32 TotalSize = 12; // total bytes transferred
int32 AppPayloadSize = 13; // size of application layer payload
int32 NumPackets = 14;
string UID = 15;
int64 TimestampLast = 16;
int64 Duration = 17;
int64 BytesServerToClient = 18;
int64 BytesClientToServer = 19;
// tcp flags
int32 NumFINFlags = 20;
int32 NumRSTFlags = 21;
int32 NumACKFlags = 22;
int32 NumSYNFlags = 23;
int32 NumURGFlags = 24;
int32 NumECEFlags = 25;
int32 NumPSHFlags = 26;
int32 NumCWRFlags = 27;
int32 NumNSFlags = 28;
// tcp window size
int32 MeanWindowSize = 29;
}
//
// * Protocols
// * ---------
//
//
// * Link Layer
//
// Ethernet is a family of computer networking technologies commonly used in local area networks (LAN), metropolitan area networks (MAN) and wide area networks (WAN).
// It was commercially introduced in 1980 and first standardized in 1983 as IEEE 802.3.
// Ethernet has since retained a good deal of backward compatibility and has been refined to support higher bit rates, a greater number of nodes, and longer link distances.
// Over time, Ethernet has largely replaced competing wired LAN technologies such as Token Ring, FDDI and ARCNET.
message Ethernet {
int64 Timestamp = 1;
string SrcMAC = 2;
string DstMAC = 3;
int32 EthernetType = 4;
double PayloadEntropy = 5;
int32 PayloadSize = 6;
}
// The Address Resolution Protocol (ARP) is a communication protocol used for discovering the link layer address,
// such as a MAC address, associated with a given internet layer address, typically an IPv4 address.
message ARP {
int64 Timestamp = 1;
int32 AddrType = 2;
int32 Protocol = 3;
int32 HwAddressSize = 4;
int32 ProtocolAddressSize = 5;
int32 Operation = 6;
string SrcHwAddress = 7;
// Sender Protocol Address: The IP address of the device sending this message
string SrcProtocolAddress = 8;
string DstHwAddress = 9;
string DstProtocolAddress = 10;
}
// Dot1Q is the packet layer for 802.1Q VLAN headers.
message Dot1Q {
int64 Timestamp = 1;
int32 Priority = 2;
bool DropEligible = 3;
int32 VLANIdentifier = 4;
int32 Type = 5;
}
// Dot11 provides an IEEE 802.11 base packet header.
// See http://standards.ieee.org/findstds/standard/802.11-2012.html for excruciating detail.
message Dot11 {
int64 Timestamp = 1;
int32 Type = 2;
int32 Proto = 3;
int32 Flags = 4;
int32 DurationID = 5;
string Address1 = 6;
string Address2 = 7;
string Address3 = 8;
string Address4 = 9;
int32 SequenceNumber = 10;
int32 FragmentNumber = 11;
uint32 Checksum = 12;
Dot11QOS QOS = 13;
Dot11HTControl HTControl = 14;
}
message Dot11QOS {
int32 TID = 1; // Traffic IDentifier
bool EOSP = 2; // End of service period
int32 AckPolicy = 3;
int32 TXOP = 4;
}
message Dot11HTControl {
bool ACConstraint = 1;
bool RDGMorePPDU = 2;
Dot11HTControlVHT VHT = 3;
Dot11HTControlHT HT = 4;
}
message Dot11HTControlVHT {
bool MRQ = 1;
bool UnsolicitedMFB = 2;
int32 MSI = 3;
Dot11HTControlMFB MFB = 4;
int32 CompressedMSI = 5;
bool STBCIndication = 6;
int32 MFSI = 7;
int32 GID = 8;
int32 CodingType = 9;
bool FbTXBeamformed = 10;
}
message Dot11HTControlHT {
Dot11LinkAdapationControl LinkAdapationControl = 1;
int32 CalibrationPosition = 2;
int32 CalibrationSequence = 3;
int32 CSISteering = 4;
bool NDPAnnouncement = 5;
bool DEI = 6;
}
message Dot11HTControlMFB {
int32 NumSTS = 1;
int32 VHTMCS = 2;
int32 BW = 3;
int32 SNR = 4;
}
message Dot11LinkAdapationControl {
bool TRQ = 1;
bool MRQ = 2;
int32 MSI = 3;
int32 MFSI = 4;
int32 MFB = 6;
Dot11ASEL ASEL = 5;
}
message Dot11ASEL {
int32 Command = 1;
int32 Data = 2;
}
// The Link Layer Discovery Protocol (LLDP) is a vendor-neutral link layer protocol
// used by network devices for advertising their identity, capabilities, and neighbors
// on a local area network based on IEEE 802 technology, principally wired Ethernet.
// The protocol is formally referred to by the IEEE as Station and Media Access Control Connectivity
// Discovery specified in IEEE 802.1AB and IEEE 802.3 section 6 clause 79.
// LLDP performs functions similar to several proprietary protocols, such as Cisco Discovery Protocol, Foundry Discovery Protocol, Nortel Discovery Protocol and Link Layer Topology Discovery.
message LinkLayerDiscovery {
int64 Timestamp = 1;
LLDPChassisID ChassisID = 2;
LLDPPortID PortID = 3;
int32 TTL = 4;
repeated LinkLayerDiscoveryValue Values = 5;
}
message LLDPChassisID {
int32 Subtype = 1; // byte
bytes ID = 2;
}
message LLDPPortID {
int32 Subtype = 1; // byte
bytes ID = 2;
}
message LinkLayerDiscoveryValue {
int32 Type = 1; // byte
int32 Length = 2;
bytes Value = 3;
}
message EthernetCTP {
int64 Timestamp = 1;
int32 SkipCount = 2;
}
message EthernetCTPReply {
int64 Timestamp = 1;
int32 Function = 2;
int32 ReceiptNumber = 3;
bytes Data = 4;
}
message LinkLayerDiscoveryInfo {
int64 Timestamp = 1;
string PortDescription = 2;
string SysName = 3;
string SysDescription = 4;
LLDPSysCapabilities SysCapabilities = 5;
LLDPMgmtAddress MgmtAddress = 6;
repeated LLDPOrgSpecificTLV OrgTLVs = 7; // Private TLVs
repeated LinkLayerDiscoveryValue Unknown = 8; // undecoded TLVs
}
message LLDPSysCapabilities {
LLDPCapabilities SystemCap = 1;
LLDPCapabilities EnabledCap = 2;
}
message LLDPCapabilities {
bool Other = 1;
bool Repeater = 2;
bool Bridge = 3;
bool WLANAP = 4;
bool Router = 5;
bool Phone = 6;
bool DocSis = 7;
bool StationOnly = 8;
bool CVLAN = 9;
bool SVLAN = 10;
bool TMPR = 11;
}
message LLDPMgmtAddress {
int32 Subtype = 1; // byte
bytes Address = 2;
int32 InterfaceSubtype = 3; // byte
uint32 InterfaceNumber = 4;
string OID = 5;
}
message LLDPOrgSpecificTLV {
uint32 OUI = 1;
int32 SubType = 2;
bytes Info = 3;
}
//
// * Network Layer
//
// Internet Protocol version 4 (IPv4) is the fourth version of the Internet Protocol (IP).
// It is one of the core protocols of standards-based internetworking methods in the Internet and other packet-switched networks.
// IPv4 was the first version deployed for production in the ARPANET in 1983.
// It still routes most Internet traffic today, despite the ongoing deployment of a successor protocol, IPv6.
// IPv4 is described in IETF publication RFC 791 (September 1981), replacing an earlier definition (RFC 760, January 1980).
// IPv4 uses a 32-bit address space, which limits the number of unique hosts to 4,294,967,296 (232), but large blocks are reserved for special networking methods.
message IPv4 {
int64 Timestamp = 1;
int32 Version = 2;
int32 IHL = 3;
int32 TOS = 4;
int32 Length = 5;
int32 Id = 6;
int32 Flags = 7;
int32 FragOffset = 8;
int32 TTL = 9;
int32 Protocol = 10;
int32 Checksum = 11;
string SrcIP = 12;
string DstIP = 13;
bytes Padding = 14;
repeated IPv4Option Options = 15;
double PayloadEntropy = 16;
int32 PayloadSize = 17;
int32 SrcPort = 18;
int32 DstPort = 19;
}
message IPv4Option {
int32 OptionType = 1;
int32 OptionLength = 2;
bytes OptionData = 3;
}
// Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol (IP),
// the communications protocol that provides an identification and location system for computers
// on networks and routes traffic across the Internet. IPv6 was developed by the Internet Engineering
// Task Force (IETF) to deal with the long-anticipated problem of IPv4 address exhaustion.
// IPv6 is intended to replace IPv4.
message IPv6 {
int64 Timestamp = 1;
int32 Version = 2;
int32 TrafficClass = 3;
uint32 FlowLabel = 4;
int32 Length = 5;
int32 NextHeader = 6;
int32 HopLimit = 7;
string SrcIP = 8;
string DstIP = 9;
double PayloadEntropy = 10;
int32 PayloadSize = 11;
IPv6HopByHop HopByHop = 12;
int32 SrcPort = 13;
int32 DstPort = 14;
}
message IPv6Fragment {
int64 Timestamp = 1;
int32 NextHeader = 2;
int32 Reserved1 = 3; // Reserved1 is bits [8-16), from least to most significant, 0-indexed
int32 FragmentOffset = 4;
int32 Reserved2 = 5; // Reserved2 is bits [29-31), from least to most significant, 0-indexed
bool MoreFragments = 6;
uint32 Identification = 7;
int32 SrcPort = 8;
int32 DstPort = 9;
string SrcIP = 10;
string DstIP = 11;
}
message ICMPv4 {
int64 Timestamp = 1;
int32 TypeCode = 2;
int32 Checksum = 3;
int32 Id = 4;
int32 Seq = 5;
string SrcIP = 6;
string DstIP = 7;
}
message ICMPv6 {
int64 Timestamp = 1;
int32 TypeCode = 2;
int32 Checksum = 3;
string SrcIP = 4;
string DstIP = 5;
}
message ICMPv6NeighborAdvertisement {
int64 Timestamp = 1;
int32 Flags = 2;
string TargetAddress = 3;
repeated ICMPv6Option Options = 4;
string SrcIP = 5;
string DstIP = 6;
}
message ICMPv6RouterAdvertisement {
int64 Timestamp = 1;
int32 HopLimit = 2;
int32 Flags = 3;
int32 RouterLifetime = 4;
uint32 ReachableTime = 5;
uint32 RetransTimer = 6;
repeated ICMPv6Option Options = 7;
string SrcIP = 8;
string DstIP = 9;
}
message ICMPv6Option {
int32 Type = 1;
bytes Data = 2;
}
//
// * Transport Layer
//
// The User Datagram Protocol (UDP) is one of the core members of the Internet
// protocol suite. The protocol was designed by David P. Reed in 1980 and formally
// defined in RFC 768. With UDP, computer applications can send messages, in this
// case referred to as datagrams, to other hosts on an Internet Protocol (IP) network.
// Prior communications are not required in order to set up communication channels or data paths.
message UDP {
int64 Timestamp = 1;
int32 SrcPort = 2;
int32 DstPort = 3;
int32 Length = 4;
int32 Checksum = 5;
double PayloadEntropy = 6;
int32 PayloadSize = 7;
bytes Payload = 8;
string SrcIP = 9;
string DstIP = 10;
}
// The Transmission Control Protocol (TCP) is one of the main protocols of the Internet
// protocol suite. It originated in the initial network implementation in which it
// complemented the Internet Protocol (IP). Therefore, the entire suite is commonly
// referred to as TCP/IP. TCP provides reliable, ordered, and error-checked delivery of
// a stream of octets (bytes) between applications running on hosts communicating via an
// IP network. Major internet applications such as the World Wide Web, email, remote
// administration, and file transfer rely on TCP, which is part of the Transport Layer
// of the TCP/IP suite. SSL/TLS often runs on top of TCP.
message TCP {
int64 Timestamp = 1;
int32 SrcPort = 2;
int32 DstPort = 3;
uint32 SeqNum = 4;
uint32 AckNum = 5;
int32 DataOffset = 6;
bool FIN = 7;
bool SYN = 8;
bool RST = 9;
bool PSH = 10;
bool ACK = 11;
bool URG = 12;
bool ECE = 13;
bool CWR = 14;
bool NS = 15;
int32 Window = 16;
int32 Checksum = 17;
int32 Urgent = 18;
bytes Padding = 19;
repeated TCPOption Options = 20;
double PayloadEntropy = 21;
int32 PayloadSize = 22;
bytes Payload = 23;
string SrcIP = 24;
string DstIP = 25;
}
message TCPOption {
int32 OptionType = 1;
int32 OptionLength = 2;
bytes OptionData = 3;
}
message SCTP {
int64 Timestamp = 1;
int32 SrcPort = 2;
int32 DstPort = 3;
uint32 VerificationTag = 4;
uint32 Checksum = 5;
string SrcIP = 6;
string DstIP = 7;
}
//
// * Application Layer
//
// The Domain Name System (DNS) is a hierarchical and decentralized naming system
// for computers, services, or other resources connected to the Internet or a private
// network. It associates various information with domain names assigned to each of
// the participating entities. Most prominently, it translates more readily memorized
// domain names to the numerical IP addresses needed for locating and identifying
// computer services and devices with the underlying network protocols. By providing a
// worldwide, distributed directory service, the Domain Name System has been an essential
// component of the functionality of the Internet since 1985.
message DNS {
int64 Timestamp = 1;
// Header fields
int32 ID = 2;
bool QR = 3;
int32 OpCode = 4;
bool AA = 5; // Authoritative answer
bool TC = 6; // Truncated
bool RD = 7; // Recursion desired
bool RA = 8; // Recursion available
int32 Z = 9; // Reserved for future use
int32 ResponseCode = 10;
int32 QDCount = 11; // Number of questions to expect
int32 ANCount = 12; // Number of answers to expect
int32 NSCount = 13; // Number of authorities to expect
int32 ARCount = 14; // Number of additional records to expect
// Entries
repeated DNSQuestion Questions = 15;
repeated DNSResourceRecord Answers = 16;
repeated DNSResourceRecord Authorities = 17;
repeated DNSResourceRecord Additionals = 18;
string SrcIP = 19;
string DstIP = 20;
int32 SrcPort = 21;
int32 DstPort = 22;
}
message DNSResourceRecord {
// Header
string Name = 1;
int32 Type = 2;
int32 Class = 3;
uint32 TTL = 4;
// RDATA Raw Values
int32 DataLength = 5;
bytes Data = 6;
// RDATA Decoded Values
string IP = 7;
bytes NS = 8;
bytes CNAME = 9;
bytes PTR = 10;
DNSSOA SOA = 11;
DNSSRV SRV = 12;
DNSMX MX = 13;
repeated bytes TXTs = 14;
}
// DNSSOA is a Start of Authority record.
// Each domain requires a SOA record at the cutover where a domain is delegated from its parent.
message DNSSOA {
bytes MName = 1;
bytes RName = 2;
uint32 Serial = 3;
uint32 Refresh = 4;
uint32 Retry = 5;
uint32 Expire = 6;
uint32 Minimum = 7;
}
// DNSSRV is a Service record, defining a location (hostname/port) of a server/service.
message DNSSRV {
int32 Priority = 1;
int32 Weight = 2;
int32 Port = 3;
bytes Name = 4;
}
// DNSMX is a mail exchange record, defining a mail server for a recipient's domain.
message DNSMX {
int32 Preference = 1;
string Name = 2;
}
// DNSQuestion wraps a single request (question) within a DNS query.
message DNSQuestion {
string Name = 1;
int32 Type = 2;
int32 Class = 3;
}
message DHCPv4 {
int64 Timestamp = 1;
int32 Operation = 2;
int32 HardwareType = 3;
int32 HardwareLen = 4;
int32 HardwareOpts = 5;
uint32 Xid = 6;
int32 Secs = 7;
int32 Flags = 8;
string ClientIP = 9;
string YourClientIP = 10;
string NextServerIP = 11;
string RelayAgentIP = 12;
string ClientHWAddr = 13;
bytes ServerName = 14;
bytes File = 15;
repeated DHCPOption Options = 16;
string Fingerprint = 17;
string SrcIP = 18;
string DstIP = 19;
int32 SrcPort = 20;
int32 DstPort = 21;
}
message DHCPOption {
int32 Type = 1;
int32 Length = 2;
string Data = 3;
}
message DHCPv6 {
int64 Timestamp = 1;
int32 MsgType = 2;
int32 HopCount = 3;
string LinkAddr = 4;
string PeerAddr = 5;
bytes TransactionID = 6;
repeated DHCPv6Option Options = 7;
string Fingerprint = 8;
string SrcIP = 9;
string DstIP = 10;
int32 SrcPort = 11;
int32 DstPort = 12;
}
message DHCPv6Option {
int32 Code = 1;
int32 Length = 2;
string Data = 3;
}
// LLC is the layer used for 802.2 Logical Link Control headers.
// See http://standards.ieee.org/getieee802/download/802.2-1998.pdf
message LLC {
int64 Timestamp = 1;
int32 DSAP = 2;
bool IG = 3; // true means group, false means individual
int32 SSAP = 4;
bool CR = 5; // true means response, false means command
int32 Control = 6;
}
// The Network Time Protocol (NTP) is a networking protocol for clock
// synchronization between computer systems over packet-switched, variable-latency
// data networks. In operation since before 1985, NTP is one of the oldest Internet
// protocols in current use. NTP was designed by David L. Mills of the University of Delaware.
message NTP {
int64 Timestamp = 1;
int32 LeapIndicator = 2; // [0,3]. Indicates whether leap second(s) is to be added.
int32 Version = 3; // [0,7]. Version of the NTP protocol.
int32 Mode = 4; // [0,7]. Mode.
int32 Stratum = 5; // [0,255]. Stratum of time server in the server tree.
int32 Poll = 6; // [-128,127]. The maximum interval between successive messages, in log2 seconds.
int32 Precision = 7; // [-128,127]. The precision of the system clock, in log2 seconds.
uint32 RootDelay = 8; // [0,2^32-1]. Total round trip delay to the reference clock in seconds times 2^16.
uint32 RootDispersion = 9; // [0,2^32-1]. Total dispersion to the reference clock, in seconds times 2^16.
uint32 ReferenceID = 10; // ID code of reference clock [0,2^32-1].
uint64 ReferenceTimestamp = 11; // Most recent timestamp from the reference clock.
uint64 OriginTimestamp = 12; // Local time when request was sent from local host.
uint64 ReceiveTimestamp = 13; // Local time (on server) that request arrived at server host.
uint64 TransmitTimestamp = 14; // Local time (on server) that request departed server host.
bytes ExtensionBytes = 15; // Just put extensions in a byte slice.
string SrcIP = 16;
string DstIP = 17;
int32 SrcPort = 18;
int32 DstPort = 19;
}
// The Session Initiation Protocol (SIP) is a signalling protocol used for initiating, maintaining, and terminating real-time sessions that include voice, video and messaging applications
message SIP {
int64 Timestamp = 1;
// Base information
int32 Version = 2;
int32 Method = 3;
//map[string][]string Headers
repeated string Headers = 4;
// Response
bool IsResponse = 5;
int32 ResponseCode = 6;
string ResponseStatus = 7;
string SrcIP = 8;
string DstIP = 9;
int32 SrcPort = 10;
int32 DstPort = 11;
}
// The Internet Group Management Protocol (IGMP) is a communications protocol
// used by hosts and adjacent routers on IPv4 networks to establish multicast
// group memberships. IGMP is an integral part of IP multicast.
// IGMP can be used for one-to-many networking applications such as online streaming
// video and gaming, and allows more efficient use of resources when supporting these
// types of applications. IGMP is used on IPv4 networks. Multicast management on IPv6
// networks is handled by Multicast Listener Discovery (MLD) which is a part of ICMPv6
// in contrast to IGMP's bare IP encapsulation.
message IGMP {
int64 Timestamp = 1;
int32 Type = 2;
uint64 MaxResponseTime = 3;
int32 Checksum = 4;
string GroupAddress = 5;
bool SupressRouterProcessing = 6;
int32 RobustnessValue = 7;
uint64 IntervalTime = 8;
repeated string SourceAddresses = 9;
int32 NumberOfGroupRecords = 10;
int32 NumberOfSources = 11;
repeated IGMPv3GroupRecord GroupRecords = 12;
int32 Version = 13;
string SrcIP = 14;
string DstIP = 15;
}
message IGMPv3GroupRecord {
int32 Type = 1;
int32 AuxDataLen = 2; // this should always be 0 as per IGMPv3 spec.
int32 NumberOfSources = 3;
string MulticastAddress = 4;
repeated string SourceAddresses = 5;
}
message IPv6HopByHop {
int64 Timestamp = 1;
repeated IPv6HopByHopOption Options = 2;
string SrcIP = 3;
string DstIP = 4;
}
message IPv6HopByHopOption {
int32 OptionType = 1;
int32 OptionLength = 2;
int32 ActualLength = 3;
bytes OptionData = 4;
IPv6HopByHopOptionAlignment OptionAlignment = 5;
}
message IPv6HopByHopOptionAlignment {
int32 One = 1;
int32 Two = 2;
}
// SNAP is used inside LLC. See http://standards.ieee.org/getieee802/download/802-2001.pdf. From http://en.wikipedia.org/wiki/Subnetwork_Access_Protocol:
// "[T]he Subnetwork Access Protocol (SNAP) is a mechanism for multiplexing,
// on networks using IEEE 802.2 LLC, more protocols than can be distinguished
// by the 8-bit 802.2 Service Access Point (SAP) fields."
message SNAP {
int64 Timestamp = 1;
bytes OrganizationalCode = 2;
int32 Type = 3;
}
message ICMPv6Echo {
int64 Timestamp = 1;
int32 Identifier = 2;
int32 SeqNumber = 3;
string SrcIP = 4;
string DstIP = 5;
}
message ICMPv6NeighborSolicitation {
int64 Timestamp = 1;
string TargetAddress = 2;
repeated ICMPv6Option Options = 3;
string SrcIP = 4;
string DstIP = 5;
}
message ICMPv6RouterSolicitation {
int64 Timestamp = 1;
repeated ICMPv6Option Options = 2;
string SrcIP = 3;
string DstIP = 4;
}
// The Hypertext Transfer Protocol (HTTP) is an application protocol for distributed,
// collaborative, hypermedia information systems. HTTP is the foundation of data
// communication for the World Wide Web.
message HTTP {
int64 Timestamp = 1;
string Proto = 2;
string Method = 3;
string Host = 4;
string UserAgent = 5;
string Referer = 6;
repeated HTTPCookie ReqCookies = 7;
int32 ReqContentLength = 8;
string URL = 9;
int32 ResContentLength = 10;
string ContentType = 11;
int32 StatusCode = 12;
string SrcIP = 13;
string DstIP = 14;
string ReqContentEncoding = 15;
string ResContentEncoding = 16;
string ServerName = 17;
repeated HTTPCookie ResCookies = 18;
string ResContentType = 19;
// Time Deltas (Nanoseconds)
// currently only available when using the HTTP proxy with tracing enabled.
int64 DoneAfter = 20;
int64 DNSDoneAfter = 21;
int64 FirstByteAfter = 22;
int64 TLSDoneAfter = 23;
string ContentTypeDetected = 24;
string ResContentTypeDetected = 25;
map<string, string> RequestHeader = 26;
map<string, string> ResponseHeader = 27;
map<string, string> Parameters = 28;
bytes RequestBody = 29;
bytes ResponseBody = 30;
}
message HTTPCookie {
string Name = 1;
string Value = 2;
string Path = 3; // optional
string Domain = 4; // optional
uint64 Expires = 5; // optional
int32 MaxAge = 6;
bool Secure = 7;
bool HttpOnly = 8;
int32 SameSite = 9;
}
// TLS Client Hello
message TLSClientHello {
int64 Timestamp = 1;
int32 Type = 2;
int32 Version = 3;
int32 MessageLen = 4;
int32 HandshakeType = 5;
uint32 HandshakeLen = 6;
int32 HandshakeVersion = 7;
bytes Random = 8;
uint32 SessionIDLen = 9;
bytes SessionID = 10;
int32 CipherSuiteLen = 11;
int32 ExtensionLen = 12;
string SNI = 13;
bool OSCP = 14;
repeated int32 CipherSuites = 15;
repeated int32 CompressMethods = 16;
repeated int32 SignatureAlgs = 17;
repeated int32 SupportedGroups = 18;
repeated int32 SupportedPoints = 19;
repeated string ALPNs = 20;
string Ja3 = 21;
string SrcIP = 22;
string DstIP = 23;
string SrcMAC = 24;