Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Output MAC addresses #3

Closed
ctwardy opened this issue Aug 24, 2022 · 3 comments
Closed

Output MAC addresses #3

ctwardy opened this issue Aug 24, 2022 · 3 comments
Assignees

Comments

@ctwardy
Copy link

ctwardy commented Aug 24, 2022

Need MAC as a better unique ID for training classifiers.
UNSW data and bench data will have pretty reliable MACs, while IPs will change.

@ctwardy
Copy link
Author

ctwardy commented Aug 24, 2022

Branch mac_addr compiles and seems to work. ab8eceb

It reads the MACs from the first 12 bytes of the ethernet frame -- assuming they are MAC! -- and outputs them in the json as sm for source MAC and dm for destination MAC. (Follows convention of sa/da and sp/dp for IP addresses and ports.)

Example output:

/app/cisco-joy$ ./joy_static dist=1 dns=1 tls=1 bidir=0 /data/test_data/pcap/analytics.pcap > /data/test_data/out/analytics.json

{"sm":"00:0c:29:2e:cb:1c","dm":"00:0c:29:5f:97:80","sa":"192.168.12.141","da":"47.74.174.54","pr":6,"sp":54058,"dp":80,"bytes_out":0,"num_pkts_out":1,"time_start":1539281086.143142,"time_end":1539281086.143142,"packets":[],"byte_dist":...,"ip":{"out":{"ttl":63,"id":[15691]}},"expire_type":"i"}

@ctwardy
Copy link
Author

ctwardy commented Aug 24, 2022

Can @dmackenzie1 or @mkraft12 review my C changes for memory leaks? It's been a long time.
I think I'm leaving dangling pointers. Hopefully nothing worse.

@ctwardy
Copy link
Author

ctwardy commented Aug 25, 2022

This is done. Need a new ticket to add bytes_dist_per_packet which Chris Schulze's version had but is not in any of the visible forks form Cisco.

@ctwardy ctwardy closed this as completed Aug 25, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants