diff --git a/GM3/build-ant.xml b/GM3/build-ant.xml index ef59716..2b079c7 100644 --- a/GM3/build-ant.xml +++ b/GM3/build-ant.xml @@ -80,7 +80,7 @@ where methods that are used in GRASSMARLIN are declared private). - + @@ -226,11 +226,11 @@ where methods that are used in GRASSMARLIN are declared private). - + - + @@ -303,7 +303,7 @@ where methods that are used in GRASSMARLIN are declared private). - + diff --git a/GM3/data/fingerprint/ADA Control.xml b/GM3/data/fingerprint/ADA Control.xml index 9f7ccb6..cae936c 100644 --- a/GM3/data/fingerprint/ADA Control.xml +++ b/GM3/data/fingerprint/ADA Control.xml @@ -3,16 +3,19 @@
ADA Control Default - This fingerprint looks for the evidence of ADA Control traffic. - Original + This fingerprint looks for evidence of ADA Control traffic.
- + 2085 - + + TCP/UDP ADA-CIP - - + +
+ ICS_HOST + ADA-CIP +
diff --git a/GM3/data/fingerprint/AIMPP.xml b/GM3/data/fingerprint/AIMPP.xml index c235893..1c0551a 100644 --- a/GM3/data/fingerprint/AIMPP.xml +++ b/GM3/data/fingerprint/AIMPP.xml @@ -3,22 +3,34 @@
AIMPP Default - This fingerprint looks for the evidence of AIMPP Hello traffic.This fingerprint looks for the evidence of AIMPP Port Req traffic. + This fingerprint looks for evidence of TCP/UDP AIMPP Hello traffic. This fingerprint looks for evidence of TCP/UDP AIMPP Port Req traffic.
- + 2846 - - + + 2847 - + + Hello AIMPP that hits on destination port - + +
+ ICS_HOST + AIMPP Hello +
+ - - + + + Port Req AIMPP that hits on destination port - + +
+ ICS_HOST + AIMPP Port Req +
+ - + diff --git a/GM3/data/fingerprint/ANSI.xml b/GM3/data/fingerprint/ANSI.xml new file mode 100644 index 0000000..0020437 --- /dev/null +++ b/GM3/data/fingerprint/ANSI.xml @@ -0,0 +1,34 @@ + + +
+ ANSI + Default + This fingerprint identifies evidenece of ANSI x3.28, z39.50, and c1222-asse traffic. +
+ + 210 + + + 1153 + + + Developed by Allen Bradley to communicate between stations and substations. Z39.50 + + +
+ ANSI +
+ + + + + Developed by Allen Bradley to communicate between stations and substations. C1222-ASSE. + + +
+ ANSI +
+ + + + diff --git a/GM3/data/fingerprint/ASP.Net.xml b/GM3/data/fingerprint/ASP.Net.xml new file mode 100644 index 0000000..b3370b6 --- /dev/null +++ b/GM3/data/fingerprint/ASP.Net.xml @@ -0,0 +1,21 @@ + + +
+ ASP.Net + Default + This fingerprint identifies evidence of session states that stores data out of process. +
+ + 42424 + + + Payload supports asp.net state service + + +
+ ASP.NET +
+ + + + diff --git a/GM3/data/fingerprint/Allen Bradley.xml b/GM3/data/fingerprint/Allen Bradley.xml new file mode 100644 index 0000000..4add90f --- /dev/null +++ b/GM3/data/fingerprint/Allen Bradley.xml @@ -0,0 +1,101 @@ + + +
+ Allen Bradley + Default + This is the response seen from a device running an Allen Bradley specific web server and providing its device description via a web page. +This is evidence of some sort of Allen Bradley Intelligent Electronic Device (IED). + This is the response seen from a device running an Allen Bradley specific web server. "Server: A-B WWW/0.1" +This is evidence of some sort of Allen Bradley Intelligent Electronic Device (IED). + This is the response seen from a device running an Allen Bradley specific web server and providing its device name via a web page. +This is evidence of some sort of Allen Bradley Intelligent Electronic Device (IED). + +
+ + 6 + 2048 + 80 + + + 6 + 2048 + 80 + + + 6 + 2048 + 80 + + + 6 + 44818 + + + Bradley Web Server Device Description + + Description</td><td> + + + 3C + + + +
+ IED + SERVER + Bradley Web Server Device Description +
+ + + + + + + + Bradley Web Server + + 5365727665723A20412D42205757572F302E310D0A + + +
+ IED + SERVER + Bradley Web Server +
+ + + + + + Bradley Web Server Device Name + + 73733D52363E446576696365204E616D653C2F74643E3C74643E + + + 3C + + + +
+ IED + SERVER + Bradely Web Server Device Name +
+ + + + + + + + Allen Bradley Rockwell PLC + + +
+ PLC + Allen Bradley Rockwell PLC +
+ + + + diff --git a/GM3/data/fingerprint/Automation Direct DirectNET.xml b/GM3/data/fingerprint/Automation Direct DirectNET.xml new file mode 100644 index 0000000..5f553a6 --- /dev/null +++ b/GM3/data/fingerprint/Automation Direct DirectNET.xml @@ -0,0 +1,112 @@ + + +
+ Automation Direct DirectNET + Default + This fingerprint looks for evidence of Automation Direct's DirectNet protocol traffic. +
+ + 6 + 3447 + + + 17 + 3447 + + + 17 + 3447 + + + 17 + 3447 + + + DirectNet MASTER that matches the HEX pattern + + +
+ MTU + MASTER + Automation Direct DirectNet +
+ + + + 4E2105 + + +
+ Automation Direct DirectNet +
+ + + + + + DirectNet SLAVE that matches the HEX pattern + + +
+ RTU + SLAVE + Automation Direct DirectNet +
+ + + + 4E2105 + + +
+ Automation Direct DirectNet +
+ + + + + + DirectNet MASTER that matches the HEX pattern + + +
+ MTU + MASTER + Automation Direct DirectNet +
+ + + + 4E2105 + + +
+ Automation Direct DirectNet +
+ + + + + + DirectNet SLAVE that matches the HEX pattern + + +
+ RTU + SLAVE + Automation Direct DirectNet +
+ + + + 4E2105 + + +
+ Automation Direct DirectNet +
+ + + + + diff --git a/GM3/data/fingerprint/BACNET.xml b/GM3/data/fingerprint/BACNET.xml index 0eefdbe..c037695 100644 --- a/GM3/data/fingerprint/BACNET.xml +++ b/GM3/data/fingerprint/BACNET.xml @@ -1,65 +1,57 @@ - - - + +
BACNET Default - - Finds BACNET traffic and attemps to extract the Device Name and Number. - + Finds BACNET traffic and attemps to extract the Device Name and Number.
- - + 47808 47808 - + Tags BACNET traffic - +
ICS_HOST - BACNET + BACNET
- + 1007 - - + - +
+ ICS_HOST SERVER
- - + + + - + 1000C40200 - - - + +
+ ICS_HOST CLIENT + BACNET
- + - diff --git a/GM3/data/fingerprint/BINL.xml b/GM3/data/fingerprint/BINL.xml new file mode 100644 index 0000000..167c254 --- /dev/null +++ b/GM3/data/fingerprint/BINL.xml @@ -0,0 +1,22 @@ + + +
+ BINL + Default + This fingerprint identifies evidence of Boot Information Negotiation layer service which answers PXE requests and checks active directory for client information to and from the server. +
+ + 17 + 4011 + + + Tags UDP service that makes sure the client received correct configuration and policy settings during negotiation. + + +
+ BINL +
+ + + + \ No newline at end of file diff --git a/GM3/data/fingerprint/Beckhoff.xml b/GM3/data/fingerprint/Beckhoff.xml new file mode 100644 index 0000000..58eedd2 --- /dev/null +++ b/GM3/data/fingerprint/Beckhoff.xml @@ -0,0 +1,86 @@ + + +
+ Beckhoff + Default + This fingerprint looks for evidence of EtherCAT traffic. +
+ + 6 + 34980 + + + 6 + 34980 + + + 17 + 34980 + + + 17 + 34980 + + + 48898 + + + EtherCAT Master that matches TCP and port number + + +
+ MTU + MASTER + BECKHOFF EtherCAT +
+ + + + + EtherCAT Slave that matches TCP and port number + + +
+ PLC + SLAVE + BECKHOFF EtherCAT +
+ + + + + EtherCAT Master that matches UDP and port number + + +
+ MTU + MASTER + BECKHOFF EtherCAT +
+ + + + + EtherCAT Slave that matches UDP and port number + + +
+ PLC + SLAVE + BECKHOFF EtherCAT +
+ + + + + BECKHOFF Embedded PC over destination port + + +
+ PLC + BECKHOFF Embedded PC +
+ + + + diff --git a/GM3/data/fingerprint/Browser Protocol.xml b/GM3/data/fingerprint/Browser Protocol.xml new file mode 100644 index 0000000..898a38c --- /dev/null +++ b/GM3/data/fingerprint/Browser Protocol.xml @@ -0,0 +1,200 @@ + + +
+ Browser Protocol + Default + This fingerprint tags the Host Name and the OS version in the Browser protocol. +
+ + 17 + 138 + + + 17 + 138 + + + 17 + 138 + + + 17 + 138 + + + 17 + 138 + + + 17 + 138 + + + 17 + 138 + + + 17 + 138 + + + 17 + 138 + + + 17 + 138 + + + 17 + 138 + + + 17 + 138 + + + Tags 0F00C0D4 Hex pattern in payload. Extracting from bytes 174-182 for Windows Name and bytes 190-192 for Version number. + + +
+ Microsoft Windows Browser Protocol +
+ + + + 0F00C0D4 + + +
+ + + + + + + + + + + + Tags 0F0080FC Hex pattern in payload. Extracting from bytes 174-190 for Windows Name and bytes 190-192 for Version number. + + +
+ Microsoft Windows Browser Protocol +
+ + + + 0F0080FC + + +
+ + + + + + + + + + + + Tags 010080FC Hex pattern in payload. Extracting from bytes 174-189 for Windows Name and bytes 190-192 for Version number. + + +
+ Microsoft Windows Browser Protocol +
+ + + + 010080FC + + +
+ + + + + + + + + + + + Tags 0F162012 Hex pattern in payload. Extracting from bytes 174-189 for Windows Name and bytes 190-192 for Version number. + + +
+ Microsoft Windows Browser Protocol +
+ + + + 0F162012 + + +
+ + + + + + + + + + + + Tags 010080A9 Hex pattern in payload. Extracting from bytes 174-190 for Windows Name and bytes 190-192 for Version number. + + +
+ Microsoft Windows Browser Protocol +
+ + + + 010080A9 + + +
+ + + + + + + + + + + + Tags the Domain/Workgroup Accouncement in the Browser Protocol and matches on 0C00A0BB Hex pattern in payload. Extracts bytes 174-190 for Domain/Workgroup and bytes 190-192 for Windows version number. + + +
+ Microsoft Windows Browser Protocol +
+ + + + 0C00A0BB + + +
+ + + + + + + + + + + diff --git a/GM3/data/fingerprint/CAMP.xml b/GM3/data/fingerprint/CAMP.xml index 5fff727..ea89494 100644 --- a/GM3/data/fingerprint/CAMP.xml +++ b/GM3/data/fingerprint/CAMP.xml @@ -3,15 +3,20 @@
CAMP Default - Could indicate CAMP protocol - Original + Possible indication of command/response from CAMP. When a CAMP command is sent to another node, reponse is expected. This allows the application to determine whether a command was sucessfully completed.
- + 4450 - + + Tags the Common ASCII Message Protocol - + +
+ ICS_HOST + Common ASCII Message Protocol +
+ diff --git a/GM3/data/fingerprint/CNRP.xml b/GM3/data/fingerprint/CNRP.xml index bbe4d8b..4a0b47a 100644 --- a/GM3/data/fingerprint/CNRP.xml +++ b/GM3/data/fingerprint/CNRP.xml @@ -3,15 +3,20 @@
CNRP Default - This fingerprint looks for the evidence of CNRP traffic - Original + This fingerprint looks for evidence of CNRP traffic
- + 2757 - + + Tags the Common Name Resolution Protocol - + +
+ ICS_HOST + Common Name Resolution Protocol +
+ diff --git a/GM3/data/fingerprint/CT Discovery Protocol.xml b/GM3/data/fingerprint/CT Discovery Protocol.xml index 0c952c3..5d5f90d 100644 --- a/GM3/data/fingerprint/CT Discovery Protocol.xml +++ b/GM3/data/fingerprint/CT Discovery Protocol.xml @@ -3,17 +3,34 @@
CT Discovery Protocol Default - This fingerprint looks for the evidence of CT Discovery Protocol traffic. - Original + This fingerprint looks for evidence of CT Discovery Protocol traffic.
- + 7022 - + + 7022 + + + Tags source traffic of CT Discovery Protocol - - + +
+ ICS_HOST + CT Discovery Protocol +
+ + Tags destination traffic of CT Discovery Protocol + + +
+ ICS_HOST + CT Discovery Protocol +
+ + + diff --git a/GM3/data/fingerprint/CTI.xml b/GM3/data/fingerprint/CTI.xml index b689124..8f2739b 100644 --- a/GM3/data/fingerprint/CTI.xml +++ b/GM3/data/fingerprint/CTI.xml @@ -3,25 +3,33 @@
CTI Default - This fingerprint looks for the evidence of CTI Program Load traffic.This fingerprint looks for the evidence of CTI System Msg traffic. + This fingerprint looks for evidence of CTI Program Load traffic. This fingerprint looks for evidence of CTI System Msg traffic.
- + 4452 - + 4451 - + + Tags the CTI Program Load - - + +
+ ICS_HOST + CT Program Load +
- + + Tags the CT Discovery Protocol - - + +
+ ICS_HOST + CT System Message +
diff --git a/GM3/data/fingerprint/CodeSys.xml b/GM3/data/fingerprint/CodeSys.xml new file mode 100644 index 0000000..5ef8aa3 --- /dev/null +++ b/GM3/data/fingerprint/CodeSys.xml @@ -0,0 +1,38 @@ + + +
+ CodeSys + Default + This fingerprint looks for evidence of CodeSys traffic. +
+ + 6 + 2455 + + + 6 + 1200 + + + Gateway Server for industrial devices running CodeSys programming interface + + +
+ SERVER + CodeSys +
+ + + + + Gateway Server for industrial devices running CodeSys programming interface + + +
+ SERVER + CodeSys +
+ + + + diff --git a/GM3/data/fingerprint/Cutler-Hammer IP Port.xml b/GM3/data/fingerprint/Cutler-Hammer IP Port.xml index 61b715e..3419cf0 100644 --- a/GM3/data/fingerprint/Cutler-Hammer IP Port.xml +++ b/GM3/data/fingerprint/Cutler-Hammer IP Port.xml @@ -3,16 +3,19 @@
Cutler-Hammer IP Port Default - This fingerprint looks for the evidence of Cutler-Hammer IP Port traffic. - Original + This fingerprint looks for evidence of Cutler-Hammer IP Port traffic.
- + 3743 - + + Tags the Cutler-Hammer IP Port - - + +
+ ICS_HOST + IPCS Command +
diff --git a/GM3/data/fingerprint/DCERPC.xml b/GM3/data/fingerprint/DCERPC.xml new file mode 100644 index 0000000..0c9f08b --- /dev/null +++ b/GM3/data/fingerprint/DCERPC.xml @@ -0,0 +1,30 @@ + + +
+ DCERPC + Default + This fingerprint identifies evidence of DCERPC traffic which is a specificiation for a remote call that defines both APIs and an over-the-network protocol. A DCE/RPC server's endpoint mapper (EPMAP) will listen for incoming calls. A client will call this endpoint mapper and ask for a specific interface, which will be accessed on a different connection. +
+ + 135 + + + Tags the CTX data item under the DCE/RPC payload + + 00000100C4 + + +
+ DCE/RPC +
+ + + + + + + + + + + diff --git a/GM3/data/fingerprint/DHCP.xml b/GM3/data/fingerprint/DHCP.xml new file mode 100644 index 0000000..ef360da --- /dev/null +++ b/GM3/data/fingerprint/DHCP.xml @@ -0,0 +1,36 @@ + + +
+ DHCP + Default + This fingerprint identifies evidence of DHCP communication and DHCP traffic deployed at a MADCAP server. +
+ + 17 + 67 + + + 17 + 2535 + + + Tags DHCP traffic + + +
+ DHCP +
+ + + + + Tags DHCP in MADCAP server deployment + + +
+ DHCP MADCAP +
+ + + + diff --git a/GM3/data/fingerprint/DLIP.xml b/GM3/data/fingerprint/DLIP.xml index 8e6a89e..802005b 100644 --- a/GM3/data/fingerprint/DLIP.xml +++ b/GM3/data/fingerprint/DLIP.xml @@ -3,17 +3,34 @@
DLIP Default - This fingerprint looks for the evidence of DLIP traffic. - Original + This fingerprint looks for evidence of DLIP traffic.
- + 7201 - - - - + + 7201 + + + Tags Intelligent Data Acquisition and Control + + +
+ ICS_HOST + DLIP +
+ + Tags Intelligent Data Acquisition and Control + + +
+ ICS_HOST + DLIP +
+ + + diff --git a/GM3/data/fingerprint/DNP3.xml b/GM3/data/fingerprint/DNP3.xml index 278b881..cda1ec1 100644 --- a/GM3/data/fingerprint/DNP3.xml +++ b/GM3/data/fingerprint/DNP3.xml @@ -1,46 +1,44 @@ - - - - + +
DNP3 Default - Looks for evidence of DNP3 traffic typically on port 20000. + Looks for evidence of DNP3 traffic on src/des on port 20000
- - + 20000 - - - - Finds a DNP3 Master device by matching the DNP3 header and attaches - details to both the SOURCE and DESTINATION in the frame. - - + + 20000 + + + Finds a DNP3 Master device by matching the DNP3 header and attaches details to the DESTINATION in the frame. + 0564 - +
- IED - SLAVE + MTU + MASTER DNP3
- + + + + + Finds a DNP3 Slave device by matching the DNP3 header and attaches details to the SOURCE in the frame. + + 0564 + +
- MTU - MASTER + IED + SLAVE DNP3
- diff --git a/GM3/data/fingerprint/Danfoss.xml b/GM3/data/fingerprint/Danfoss.xml new file mode 100644 index 0000000..0326b42 --- /dev/null +++ b/GM3/data/fingerprint/Danfoss.xml @@ -0,0 +1,22 @@ + + +
+ Danfoss + Default + This fingerprint identifies evidence of Danfoss ECL Alex traffic. +
+ + 5050 + + + High performance PLC runtime engine desinged to run both embedded and PC applications + + +
+ PLC + Danfoss ECL Apex +
+ + + + \ No newline at end of file diff --git a/GM3/data/fingerprint/Data Acquisition and Control.xml b/GM3/data/fingerprint/Data Acquisition and Control.xml index b781574..0304dde 100644 --- a/GM3/data/fingerprint/Data Acquisition and Control.xml +++ b/GM3/data/fingerprint/Data Acquisition and Control.xml @@ -3,16 +3,19 @@
Data Acquisition and Control Default - Data Acquisition and Control - Original + This fingerprint identifies evidence of Data Acquisition and Control traffic.
- + 3881 - - - - + + Tags Intelligent Data Acquisition and Control + + +
+ ICS_HOST + Intelligent Data Acquisition and Control +
diff --git a/GM3/data/fingerprint/Domain Controller.xml b/GM3/data/fingerprint/Domain Controller.xml new file mode 100644 index 0000000..714624a --- /dev/null +++ b/GM3/data/fingerprint/Domain Controller.xml @@ -0,0 +1,112 @@ + + +
+ Domain Controller + Default + This fingerprint identifies evidence of domain controller communication including client computers, authentication, and active directory. +
+ + 135 + + + 17 + 88 + + + 17 + 138 + + + 6 + 139 + + + 389 + + + 6 + 636 + + + 6 + 3268 + + + 6 + 3269 + + + 6 + 53248 + + + 6 + 5722 + + + Identifies domain contoller to domain controller traffic. + + +
+ SERVER + Authentication +
+ + + + + Identifies kerberos authentication traffic. + + +
+ SERVER + Kerberos +
+ + + + + File replication service between domain controllers. + + +
+ SERVER + File Replication Service +
+ + + + + LDAP to handle normal queries from client computers to domain controllers. + + +
+ SERVER + LDAP +
+ + + + + Microsoft technology that replicates files and folders stored in the SYSVOL shared folder on domain controllers and distributed shared folders. + + +
+ SERVER + FRS-RPC +
+ + + + + Microsoft DFS replication service that shares folders that can be kept synchronized by using methods other than FRS. + + +
+ SERVER + DFS-R +
+ + + + diff --git a/GM3/data/fingerprint/EGD.xml b/GM3/data/fingerprint/EGD.xml new file mode 100644 index 0000000..7c5f378 --- /dev/null +++ b/GM3/data/fingerprint/EGD.xml @@ -0,0 +1,39 @@ + + +
+ EGD + Default + This fingerprint identifies evidence of EGD Type:13 Version:1 traffic over 18246. +
+ + 18246 + 18246 + + + Protocol that enables producer (server) to share a portion of its memory to all the consumer (clients) at the schedule periodic rate protocol developed for GE Fanuc PLCs to change data between PLCs/GE drive systems. The protocol uses UDP over Ethernet layers for exchanging data. + + +
+ Ethernet Global Data +
+ + + + 0D01 + + +
+ + + + + + + + + + + + + + diff --git a/GM3/data/fingerprint/EtherNetIP.xml b/GM3/data/fingerprint/EtherNetIP.xml index 9bced5f..39195f7 100644 --- a/GM3/data/fingerprint/EtherNetIP.xml +++ b/GM3/data/fingerprint/EtherNetIP.xml @@ -3,20 +3,21 @@
EtherNetIP Default - EthernetIP Traffic + This fingerprint identifies evidence of EtherNetIP traffic. ETHERNETIP
- + 17 44818 - + 44818 - + 44818 + Tags UDP replier/requester EtherNetIP traffic.
@@ -27,6 +28,7 @@ + Tags UDP identity EtherNetIP response traffic.
diff --git a/GM3/data/fingerprint/Extensible Automation.xml b/GM3/data/fingerprint/Extensible Automation.xml index 9a75324..8dcddb9 100644 --- a/GM3/data/fingerprint/Extensible Automation.xml +++ b/GM3/data/fingerprint/Extensible Automation.xml @@ -3,17 +3,18 @@
Extensible Automation Default - This fingerprint looks for the evidence of Extensible Automation traffic. - Original + This fingerprint looks for evidence of Extensible Automation traffic.
- + 3639 - + + Supports integration of telemetry and control devices for building automation - - + + ICS_HOST + xAP-HA - + \ No newline at end of file diff --git a/GM3/data/fingerprint/FODMS FLIP.xml b/GM3/data/fingerprint/FODMS FLIP.xml index 051774a..906dbfd 100644 --- a/GM3/data/fingerprint/FODMS FLIP.xml +++ b/GM3/data/fingerprint/FODMS FLIP.xml @@ -3,16 +3,19 @@
FODMS FLIP Default - This fingerprint looks for the evidence of FODMS FLIP traffic. - Original + This fingerprint looks for evidence of FODMS FLIP traffic.
- + 7200 - + + Fiber optics multiplexing service as per RFC 822 - - + +
+ ICS_HOST + FODMS FLIP +
diff --git a/GM3/data/fingerprint/Fagor.xml b/GM3/data/fingerprint/Fagor.xml new file mode 100644 index 0000000..70c9b48 --- /dev/null +++ b/GM3/data/fingerprint/Fagor.xml @@ -0,0 +1,22 @@ + + +
+ Fagor + Default + This fingerprint looks for evidence for Fagor DNC traffic. +
+ + 3873 + + + Fagor DNC over 3873 + + +
+ ICS_HOST + DNC +
+ + + + diff --git a/GM3/data/fingerprint/Fatek.xml b/GM3/data/fingerprint/Fatek.xml new file mode 100644 index 0000000..1f76c2b --- /dev/null +++ b/GM3/data/fingerprint/Fatek.xml @@ -0,0 +1,22 @@ + + +
+ Fatek + Default + This fingerprint identifies evidence of the FATEK FB Series traffic. +
+ + 500 + + + Identifies Fatek FB series PLC traffic. + + +
+ PLC + Fatek FB Series +
+ + + + diff --git a/GM3/data/fingerprint/GE.xml b/GM3/data/fingerprint/GE.xml index a5a8daa..93fabbb 100644 --- a/GM3/data/fingerprint/GE.xml +++ b/GM3/data/fingerprint/GE.xml @@ -3,32 +3,112 @@
GE Default - Identifies the GE 9030 devices.Identifies engineering workstations for the GE 9030 devices. + This fingerprint identifies evidence of GE 9030 devices. This fingerprint identifies evidence of engineering workstations for GE 9030 devices. This fingerprint identifies evidence of GE Industrial Solution SRTP Data traffic. This fingerprint identifies evidence of Ethernet Global Data traffic.
- + + 6 18245 - + + 6 18245 - - - 0200 - - - - - - + + 6 + 18245 + + + 6 + 18246 + + + 17 + 18246 + + + 17 + 7937 + + + 6 + 57176 + + + PLC GE9030 device + + +
+ PLC + SLAVE +
+ + - - + + Engineering workstation for GE9030 + 0200 - - + +
+ WORKSTATION + ENGINEER +
+ + The protocol was developed by GE Intelligent Platforms after GE Fanuc to tranfer data of PLCs + + +
+ ICS_HOST + GE-STRP +
+ + + + + The protocol was developed by GE Intelligent Platforms after GE Fanuc to tranfer data of PLCs + + +
+ ICS_HOST + GE-STRP +
+ + + + + The EGD supports both the producer/consumer service port and the command service port using UDP over an IP network. + + +
+ GE Fanuc EGD Producer/Consumer +
+ + + + + The EGD supports both the producer/consumer service port and the command service port using UDP over an IP network. + + +
+ GE Fanuc EGD Command Service +
+ + + + + Multi functional interface that integrates process control, views, runs data historian communication. + + +
+ HMI + GE Fanuc QuickPanels +
+ + + diff --git a/GM3/data/fingerprint/HMS HICP Port.xml b/GM3/data/fingerprint/HMS HICP Port.xml index 144cfe1..0f5b5a1 100644 --- a/GM3/data/fingerprint/HMS HICP Port.xml +++ b/GM3/data/fingerprint/HMS HICP Port.xml @@ -3,16 +3,19 @@
HMS HICP Port Default - This fingerprint looks for the evidence ofHMS HICP Port traffic. - Original + This fingerprint looks for evidence of HMS HICP Port traffic.
- + 3250 - + + Acts as a translator between industrial control systems. It also detects any Ethernet device on a local network. - - + +
+ ICS_HOST + HMS HICP +
diff --git a/GM3/data/fingerprint/Hitachi.xml b/GM3/data/fingerprint/Hitachi.xml new file mode 100644 index 0000000..c140e3e --- /dev/null +++ b/GM3/data/fingerprint/Hitachi.xml @@ -0,0 +1,22 @@ + + +
+ Hitachi + Default + This fingerprint identifies evidence of Hitachi EHV Series traffic. +
+ + 3004 + + + General purpose PLC that uses Codesys + + +
+ PLC + Hitachi EHV Series +
+ + + + diff --git a/GM3/data/fingerprint/I-NET 2000-NPR.xml b/GM3/data/fingerprint/I-NET 2000-NPR.xml index 46f02b7..85779e9 100644 --- a/GM3/data/fingerprint/I-NET 2000-NPR.xml +++ b/GM3/data/fingerprint/I-NET 2000-NPR.xml @@ -4,15 +4,18 @@ I-NET 2000-NPR Default This fingerprint looks for the evidence of I/NET 2000-NPR traffic. - Original - + 5069 - + + This fingerprint looks for the evidence of I/NET 2000-NPR traffic. - - + +
+ ICS_HOST + I-NET 2000-NPR +
diff --git a/GM3/data/fingerprint/IEC 60870-5-104.xml b/GM3/data/fingerprint/IEC 60870-5-104.xml new file mode 100644 index 0000000..e87a453 --- /dev/null +++ b/GM3/data/fingerprint/IEC 60870-5-104.xml @@ -0,0 +1,22 @@ + + +
+ IEC 60870-5-104 + Default + This fingerprint identifies evidence of IEC 60870-5-104 traffic. +
+ + 2404 + + + Set of standards which define systems used for SCADA in electrical engineering and power systems + + +
+ ICS_HOST + IEC 60870-5-104 +
+ + + + diff --git a/GM3/data/fingerprint/IMAP.xml b/GM3/data/fingerprint/IMAP.xml new file mode 100644 index 0000000..2fbbcc1 --- /dev/null +++ b/GM3/data/fingerprint/IMAP.xml @@ -0,0 +1,21 @@ + + +
+ IMAP + Default + This fingerprint identifies evidence of communication between the exchange server. +
+ + 143 + + + Tags IMAP exchange server communication used to manage email server/receive email. + + +
+ IMAP +
+ + + + diff --git a/GM3/data/fingerprint/IP Control Systems Ltd.xml b/GM3/data/fingerprint/IP Control Systems Ltd.xml index 268bbc3..f725218 100644 --- a/GM3/data/fingerprint/IP Control Systems Ltd.xml +++ b/GM3/data/fingerprint/IP Control Systems Ltd.xml @@ -3,17 +3,20 @@
IP Control Systems Ltd Default - This fingerprint looks for the evidence of IP Control Systems traffic. - Original + This fingerprint looks for evidence of IP Control Systems traffic. Write standard input info about active interprocess communication facilities.
- + 3743 - + + This fingerprint looks for the evidence of IP Control Systems traffic. - - + +
+ ICS_HOST + IP Control Systems Ltd +
- + diff --git a/GM3/data/fingerprint/IT Environmental Monitor.xml b/GM3/data/fingerprint/IT Environmental Monitor.xml index 884b0fa..c07c8b5 100644 --- a/GM3/data/fingerprint/IT Environmental Monitor.xml +++ b/GM3/data/fingerprint/IT Environmental Monitor.xml @@ -3,16 +3,19 @@
IT Environmental Monitor Default - This fingerprint looks for the evidence of IT Environmental Monitor traffic. - Original + This fingerprint looks for evidence of IT Environmental Monitor traffic.
- + 3848 - + + Gateway Server for industrial devices running CodeSys programming interface. - - + +
+ ICS_HOST + IT Environmental Monitor +
diff --git a/GM3/data/fingerprint/Intelligent Instrumentation EDAS units.xml b/GM3/data/fingerprint/Intelligent Instrumentation EDAS units.xml new file mode 100644 index 0000000..fcece84 --- /dev/null +++ b/GM3/data/fingerprint/Intelligent Instrumentation EDAS units.xml @@ -0,0 +1,22 @@ + + +
+ Intelligent Instrumentation EDAS units + Default + This fingerprint looks for the evidence of Undocumented usage by Intelligent Instrumentation EDAS units, models EDAS-1001E, -1002E, -1024E, 1031E traffic. +
+ + 5891 + + + Tags Undocumented usage by Intelligent Instrumentation EDAS unites by incoming source port + + +
+ ICS_HOST + Intelligent Instrumentation EDAS +
+ + + + diff --git a/GM3/data/fingerprint/JAUS Robots.xml b/GM3/data/fingerprint/JAUS Robots.xml index 421b313..4cba709 100644 --- a/GM3/data/fingerprint/JAUS Robots.xml +++ b/GM3/data/fingerprint/JAUS Robots.xml @@ -3,16 +3,19 @@
JAUS Robots Default - This fingerprint looks for the evidence of JAUS Robots traffic. - Original + This fingerprint looks for evidence of JAUS Robots traffic.
- + 3794 - + + This fingerprint looks for evidence of JAUS Robots traffic. - - + +
+ ICS_HOST + JAUS Robots +
diff --git a/GM3/data/fingerprint/Keyence.xml b/GM3/data/fingerprint/Keyence.xml new file mode 100644 index 0000000..9ca8260 --- /dev/null +++ b/GM3/data/fingerprint/Keyence.xml @@ -0,0 +1,22 @@ + + +
+ Keyence + Default + This fingerprint identifies evidence of Keyence KV-5000 series traffic over 8501. +
+ + 8501 + + + PLC traffic for real time control over 8501. + + +
+ PLC + Keyence KV-5000 +
+ + + + \ No newline at end of file diff --git a/GM3/data/fingerprint/Korenix.xml b/GM3/data/fingerprint/Korenix.xml new file mode 100644 index 0000000..068a6b8 --- /dev/null +++ b/GM3/data/fingerprint/Korenix.xml @@ -0,0 +1,21 @@ + + +
+ Korenix + Default + This fingerprint identifies evidence of Korenix 6550 traffic. +
+ + 502 + + + Korenix 6550 PLC series for communication monitoring. + + +
+ Korenix 6550 +
+ + + + diff --git a/GM3/data/fingerprint/Koyo Ethernet.xml b/GM3/data/fingerprint/Koyo Ethernet.xml new file mode 100644 index 0000000..1783040 --- /dev/null +++ b/GM3/data/fingerprint/Koyo Ethernet.xml @@ -0,0 +1,22 @@ + + +
+ Koyo Ethernet + Default + This fingerprint identifies evidence of Koyo Ethernet traffic over 28784. +
+ + 28784 + + + PLC that uses IEC/JIS standards under the Direct Logic PLC. + + +
+ PLC + Koyo Ethernet +
+ + + + \ No newline at end of file diff --git a/GM3/data/fingerprint/LDAP.xml b/GM3/data/fingerprint/LDAP.xml new file mode 100644 index 0000000..abb0823 --- /dev/null +++ b/GM3/data/fingerprint/LDAP.xml @@ -0,0 +1,21 @@ + + +
+ LDAP + Default + Local Security Authority/Distributed File System. +
+ + 389 + + + Tags LDAP communication to the server + + +
+ LDAP +
+ + + + diff --git a/GM3/data/fingerprint/LS.xml b/GM3/data/fingerprint/LS.xml new file mode 100644 index 0000000..fd21bc7 --- /dev/null +++ b/GM3/data/fingerprint/LS.xml @@ -0,0 +1,27 @@ + + +
+ LS + Default + This fingerprint identifies evidence of LS GLOFA FEnet traffic over 2004. This fingerprint identifies evidence of LS XGB fenet over 2004. This fingerprint identifies evidence of LS XGK FEnet over 2004. +
+ + 2004 + + + 2004 + + + 2004 + + + PLCs with built in master/slave capability via MODBUS. Depending on the PLC, the device can handle high processing in large networks. + + +
+ Koyo Ethernet +
+ + + + \ No newline at end of file diff --git a/GM3/data/fingerprint/LonWorks.xml b/GM3/data/fingerprint/LonWorks.xml index 3356ff6..746e838 100644 --- a/GM3/data/fingerprint/LonWorks.xml +++ b/GM3/data/fingerprint/LonWorks.xml @@ -4,16 +4,27 @@ LonWorks Default This fingerprint looks for the evidence of LonWorks traffic. - Original - + 2540 - + + 2541 + + - - + + ICS_HOST + LonWorks + + + + ICS_HOST + LonWorks + + + diff --git a/GM3/data/fingerprint/MMS.xml b/GM3/data/fingerprint/MMS.xml new file mode 100644 index 0000000..1b5f5fb --- /dev/null +++ b/GM3/data/fingerprint/MMS.xml @@ -0,0 +1,21 @@ + + +
+ MMS + Default + This fingerprint identifies evidence of Microsoft media Server as part of a service. +
+ + 1755 + + + Tags Microsoft Media Server + + +
+ Microsoft Media Server +
+ + + + diff --git a/GM3/data/fingerprint/MODBUS.xml b/GM3/data/fingerprint/MODBUS.xml index c4cbaf8..c886612 100644 --- a/GM3/data/fingerprint/MODBUS.xml +++ b/GM3/data/fingerprint/MODBUS.xml @@ -1,48 +1,36 @@ - - - +
MODBUS Default - This fingerprint looks for the evidence of MODBUS traffic on port 502. + This fingerprint looks for evidence of MODBUS traffic on port 502.
- - + 6 502 - - + 17 502 - - + 6 502 - + MODBUS TCP Master
MTU + MASTER MODBUS
- - + - - MODBUS UDP Client or Server - + MODBUS UDP Client or Server
@@ -52,11 +40,8 @@ - - - MODBUS TCP Slave Unit Number - + MODBUS TCP Slave Unit Number
@@ -64,11 +49,8 @@ SLAVE MODBUS
+ - - - - \ No newline at end of file diff --git a/GM3/data/fingerprint/MOM.xml b/GM3/data/fingerprint/MOM.xml new file mode 100644 index 0000000..ce37ec8 --- /dev/null +++ b/GM3/data/fingerprint/MOM.xml @@ -0,0 +1,22 @@ + + +
+ MOM + Default + This fingerprint identifies evidence of Microsoft's Operation Manager framework that provides event driven operation for monitoring and performance tracking, policy enforcement, and auditing. +
+ + 6 + 1270 + + + Tags MOM encrypted traffic + + +
+ MOM +
+ + + + diff --git a/GM3/data/fingerprint/MSMQ.xml b/GM3/data/fingerprint/MSMQ.xml new file mode 100644 index 0000000..5370208 --- /dev/null +++ b/GM3/data/fingerprint/MSMQ.xml @@ -0,0 +1,91 @@ + + +
+ MSMQ + Default + This fingerprint identifies evidence of the Microsoft messaging queuing system for the messaging infrastructure and development tool for creating distributed messaging applications for Windows. +
+ + 1801 + + + 6 + 2101 + + + 6 + 27107 + + + 17 + 3527 + + + 6 + 2105 + + + 17 + 2103 + + + MSMQ UDP/TCP over 1801 + + +
+ MSMQ +
+ + + + + MSMQ-DCs TCP over 2101 + + +
+ MSMQ-DCs +
+ + + + + MSMQ-Mgmt TCP over 2107 + + +
+ MSMQ-Mgmt +
+ + + + + MSMQ-Ping UDP over 3527 + + +
+ MSMQ-Ping +
+ + + + + MSMQ-RPC TCP over 2105 + + +
+ MSMQ-RPC +
+ + + + + MSMQ-RPC2 TCP over 2103 + + +
+ MSMQ-RPC2 +
+ + + + diff --git a/GM3/data/fingerprint/Memobus.xml b/GM3/data/fingerprint/Memobus.xml new file mode 100644 index 0000000..4e10575 --- /dev/null +++ b/GM3/data/fingerprint/Memobus.xml @@ -0,0 +1,21 @@ + + +
+ Memobus + Default + This fingerprint identifies evidence of Memobus traffic. +
+ + 502 + + + Alternative for those who require a non-ieController + + +
+ Memobus +
+ + + + diff --git a/GM3/data/fingerprint/Mitsubishi Electronic.xml b/GM3/data/fingerprint/Mitsubishi Electronic.xml new file mode 100644 index 0000000..5fd9690 --- /dev/null +++ b/GM3/data/fingerprint/Mitsubishi Electronic.xml @@ -0,0 +1,176 @@ + + +
+ Mitsubishi Electronic + Default + This fingerprint looks for evidence of MELSEC-Q network protocol communication. The devices are used by equipment and manufacturing facilities to provide high-speed, large volume data processing and machine control. +
+ + 5006 + + + 5007 + + + 5007 + + + 5007 + + + 4999 + + + 4999 + + + 1025 + + + 5001 + + + 55000 + + + 55001 + + + 55002 + + + 55003 + + + MELSEC-Q payload that tags the destination port and always returns details. + + +
+ MTU + MASTER + MELSEC-Q +
+ + + + + MELSEC-Q payload that tags the destination port and always returns details. + + +
+ MTU + MASTER + MELSEC-Q +
+ + + + + MELSEC-Q payload that tags the destination port and always returns details. + + +
+ PLC + SLAVE + MELSEC-Q +
+ + + + + MELSEC-Q payload that tags the destination port and always returns details. + + +
+ PLC + SLAVE + MELSEC-Q +
+ + + + + MELSEC-Q payload that tags the destination port and always returns details. + + +
+ PLC + MELSEC-Q +
+ + + + + QJ71E71 payload that tags the destination port and always returns details. + + +
+ PLC + QJ71E71 +
+ + + + + PLC that incorporates power supply, cpu, I/O into a single unit. + + +
+ PLC + FX +
+ + + + + Part of the MELSEC-F PLCs, that has exchangable communication boards that mount directly into the main unit (Ethernet or Serial). + + +
+ PLC + FX3u +
+ + + + + FA link protocol is a standardized by the Japan FA Open System Promotion Group of the manufacturing Science and Technology Center. The FL link protocol is intended for the FL net to be used for data exchange between various control modules. + + +
+ Cyclic Transmission +
+ + + + + FA link protocol is a standardized by the Japan FA Open System Promotion Group of the manufacturing Science and Technology Center. The FL link protocol is intended for the FL net to be used for data exchange between various control modules. + + +
+ Message Transmission +
+ + + + + FA link protocol is a standardized by the Japan FA Open System Promotion Group of the manufacturing Science and Technology Center. The FL link protocol is intended for the FL net to be used for data exchange between various control modules. + + +
+ Message Transmission +
+ + + + + FA link protocol is a standardized by the Japan FA Open System Promotion Group of the manufacturing Science and Technology Center. The FL link protocol is intended for the FL net to be used for data exchange between various control modules. + + +
+ Message Transmission +
+ + + + diff --git a/GM3/data/fingerprint/MocanaSSH2.xml b/GM3/data/fingerprint/MocanaSSH2.xml index 926d883..86d1899 100644 --- a/GM3/data/fingerprint/MocanaSSH2.xml +++ b/GM3/data/fingerprint/MocanaSSH2.xml @@ -3,19 +3,22 @@
MocanaSSH2 Default - This device is running Mocana SSH 2, it is commonly used on industrial systems and is at least seen in ruggedcom routers. - Original + This device is running Mocana SSH2, it is commonly used on industrial systems and is at least seen in ruggedcom routers.
- + 6 22 - + + Tags Mocana SSH2 traffic with HEX pattern and destination port match. 5353482D322E302D4D6F63616E612053534820 - - + +
+ ICS_HOST + MocanaSSH2 +
diff --git a/GM3/data/fingerprint/Network Time Protocol.xml b/GM3/data/fingerprint/Network Time Protocol.xml index f01637c..2d92369 100644 --- a/GM3/data/fingerprint/Network Time Protocol.xml +++ b/GM3/data/fingerprint/Network Time Protocol.xml @@ -3,16 +3,21 @@
Network Time Protocol Default - This fingerprint looks for the evidence of Network Time Protocol traffic. - Original + This fingerprint looks for evidence of Network Time Protocol traffic.
- + 0 123 - + + This fingerprint looks for the evidence of Network Time Protocol traffic. - + +
+ ICS_HOST + NTP +
+ diff --git a/GM3/data/fingerprint/Novar.xml b/GM3/data/fingerprint/Novar.xml index c12b88e..c2b7344 100644 --- a/GM3/data/fingerprint/Novar.xml +++ b/GM3/data/fingerprint/Novar.xml @@ -3,36 +3,48 @@
Novar Default - This fingerprint looks for the evidence of Novar Alarm traffic.This fingerprint looks for the evidence of Novar Global traffic.This fingerprint looks for the evidence of Novar Data traffic. + This fingerprint looks for evidence of Novar Alarm traffic. This fingerprint looks for evidence of Novar Global traffic. This fingerprint looks for evidence of Novar Data traffic.
- + 23401 - + 23402 - + 23400 - + + This fingerprint looks for evidence of Novar Alarm traffic. - - + +
+ ICS_HOST + Novar Alarm +
- + + This fingerprint looks for evidence of Novar Global traffic. - - + +
+ ICS_HOST + Novar Global +
- + + This fingerprint looks for evidence of Novar Data traffic. - - + +
+ ICS_HOST + Novar Data +
- + diff --git a/GM3/data/fingerprint/OLAP.xml b/GM3/data/fingerprint/OLAP.xml new file mode 100644 index 0000000..5109d8d --- /dev/null +++ b/GM3/data/fingerprint/OLAP.xml @@ -0,0 +1,36 @@ + + +
+ OLAP + Default + This fingerprint identifies evidence of OLAP service which provides SQL service client support for answering multi dimensional analytical queries. +
+ + 6 + 2393 + + + 6 + 2394 + + + Tags OLAP SQL services + + +
+ OLAP +
+ + + + + Tags OLAP SQL services + + +
+ OLAP +
+ + + + diff --git a/GM3/data/fingerprint/OMF.xml b/GM3/data/fingerprint/OMF.xml index 4fa4b32..9a0f655 100644 --- a/GM3/data/fingerprint/OMF.xml +++ b/GM3/data/fingerprint/OMF.xml @@ -3,45 +3,61 @@
OMF Default - OMF Data B This fingerprint looks for the evidence of OMF Data M traffic.This fingerprint looks for the evidence of OMF Data H traffic.This fingerprint looks for the evidence of OMF Data l traffic + This fingerprint looks for evidence of OMF Data B traffic. This fingerprint looks for evidence of OMF Data M traffic. This fingerprint looks for evidence of OMF Data H traffic. This fingerprint looks for evidence of OMF Data L traffic
- + 3338 - + 3340 - + 3341 - + 0 - + + OMF Data B ANET-B - +
+ ICS_HOST + ANET-B +
- + + OMF Data M ANET-M - +
+ ICS_HOST + ANET-M +
- + + OMF Data H ANET-H - +
+ ICS_HOST + ANET-H +
- + + OMF Data L ANET-L - +
+ ICS_HOST + ANET-L +
diff --git a/GM3/data/fingerprint/OPC.xml b/GM3/data/fingerprint/OPC.xml new file mode 100644 index 0000000..0bcd92d --- /dev/null +++ b/GM3/data/fingerprint/OPC.xml @@ -0,0 +1,21 @@ + + +
+ OPC + Default + This fingerprint identifies evidence of OPC traffic. OPC is a series of standard specifications designed to simplify integration of various forms of data on systems from different vendors. +
+ + 135 + + + Devices running OPC client trying to connect an OPC server on a different computer would reply on DCOM for the communication. + + +
+ OPC +
+ + + + diff --git a/GM3/data/fingerprint/OSI Monarch.xml b/GM3/data/fingerprint/OSI Monarch.xml new file mode 100644 index 0000000..ff4ca26 --- /dev/null +++ b/GM3/data/fingerprint/OSI Monarch.xml @@ -0,0 +1,69 @@ + + +
+ OSI Monarch + Default + Identifies the Application layer header for the FEPSI protocol (version 2) from a client. This protocol is used within the OSI Monarch SCADA system. This fingerprint looks for the start byte value, the function code, and version number within their dedicated position in the payload. + +The second payload looks for the start byte value, server response byte value, the function code, and version number within their dedicated position in the payload. + +The third payload identifies the Network header for the Fepcontrol protocol (header type 1). This protocol is used within the OSI Monarch SCADA system. This fingerprint looks for the start byte, the header type, the Application ID, and the Control Type values within their dedicated positions in the payload. +
+ + 6 + 11999 + + + 6 + 11999 + + + 6 + 16002 + + + Identifies the Application layer header for the FEPSI protocol (version 2) from a client. This protocol is used within the OSI Monarch SCADA system. + + \x03(.{7}[\x00\x10\x20\x30\x40]{1})\x02 + + +
+ ICS_HOST + CLIENT + OSI Monarch FEPSI Client +
+ + + + + + Identifies the Application layer header for the FEPSI protocol (version 2) from a server. This protocol is used within the OSI Monarch SCADA system. + + \x03(.{2}\x03)(.{4}[\x00\x10\x20\x30\x40]{1})\x02 + + +
+ ICS_HOST + SERVER + OSI Monarch FEPSI Server +
+ + + + + + Identifies the Network header for the Fepcontrol protocol (header type 1). This protocol is used within the OSI Monarch SCADA system. + + \x03(.{11}\x01)(.{16}[\x00\x01\x02\x03])(.{1}[\s3-7e-l]{1,20}) + + +
+ ICS_HOST + CLIENT + OSI Monarch Fepcontrol Client +
+ + + + + diff --git a/GM3/data/fingerprint/Omron.xml b/GM3/data/fingerprint/Omron.xml new file mode 100644 index 0000000..6ba541e --- /dev/null +++ b/GM3/data/fingerprint/Omron.xml @@ -0,0 +1,22 @@ + + +
+ Omron + Default + This fingerprint looks for evidence of Omron Factory Interface Network (FIN) Service traffic. Protocol is used by Omron PLCs over physical networks. +
+ + 9600 + + + This network protocol is used by Omron PLCs and it looks for the response code over the port. + + +
+ PLC + FIN (Factory Interface Network) Service +
+ + + + diff --git a/GM3/data/fingerprint/OneHome.xml b/GM3/data/fingerprint/OneHome.xml index 09abfe3..34365f3 100644 --- a/GM3/data/fingerprint/OneHome.xml +++ b/GM3/data/fingerprint/OneHome.xml @@ -3,25 +3,33 @@
OneHome Default - This fingerprint looks for the evidence of OneHome Remote Access traffic.This fingerprint looks for the evidence of OneHome Service Port traffic. + This fingerprint looks for evidence of OneHome Remote Access traffic. This fingerprint looks for evidence of OneHome Service Port traffic.
- + 2198 - + 2199 + OneHome Remote Access - - + +
+ HMI + OneHome Remote Access +
+ OneHome Remote Access Service port - - + +
+ HMI + OneHome Remote Access Service port +
diff --git a/GM3/data/fingerprint/Operating System.xml b/GM3/data/fingerprint/Operating System.xml new file mode 100644 index 0000000..176e1b1 --- /dev/null +++ b/GM3/data/fingerprint/Operating System.xml @@ -0,0 +1,160 @@ + + +
+ Operating System + Default + This fingerprint looks for evidence of Operating system by TCP default Window_Size and IP header TTL values. Various Payloads include XP, Vista, 7... +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 6 + + + + 17 + + + + Tags TTL value in the IP header + + +
+ Windows 2000, XP, Vista, 7, 10, Server +
+ + + + + Tags TTL value in the IP header + + +
+ Linux 2.4/2.6 +
+ + + + + Tags TTL value in the IP header + + +
+ Google Linux +
+ + + + + Tags TTL value in the IP header + + +
+ FreeBSD +
+ + + + + Tags TTL value in the IP header + + +
+ CISCO Router IOS 12.4 +
+ + + + + Tags TTL value in the IP header + + +
+ Solaris +
+ + + + + Tags TTL value in the IP header + + +
+ Stratus +
+ + + + + Tags TTL value in the IP header + + +
+ SunOS +
+ + + + + Tags TTL value in the IP header + + +
+ Ultrix +
+ + + + diff --git a/GM3/data/fingerprint/PNBSCADA.xml b/GM3/data/fingerprint/PNBSCADA.xml index 1377686..4124b56 100644 --- a/GM3/data/fingerprint/PNBSCADA.xml +++ b/GM3/data/fingerprint/PNBSCADA.xml @@ -3,15 +3,20 @@
PNBSCADA Default - This fingerprint looks for the evidence of PNBSCADA traffic. - Original + This fingerprint looks for evidence of PNBSCADA traffic.
- + 3875 - + + Tags PNBSCADA by TCP/UDP destination port - + +
+ ICS_HOST + PNBSCADA +
+ diff --git a/GM3/data/fingerprint/PROFInet.xml b/GM3/data/fingerprint/PROFInet.xml index 81bb106..3ded1a7 100644 --- a/GM3/data/fingerprint/PROFInet.xml +++ b/GM3/data/fingerprint/PROFInet.xml @@ -3,35 +3,47 @@
PROFInet Default - This fingerprint looks for the evidence of PROFInet RT Multicast traffic.This fingerprint looks for the evidence of PROFInet RT Unicast traffic.This fingerprint looks for the evidence of PROFInet Context Manager traffic. + This fingerprint looks for evidence of PROFInet RT Multicast traffic. This fingerprint looks for the evidence of PROFInet RT Unicast traffic. This fingerprint looks for the evidence of PROFInet Context Manager traffic.
- + 34963 - + 34962 - + 34964 - + + PROFInet RT Multicast over source port - - + +
+ ICS_HOST + RT Multicast +
- + + PROFInet RT Unicast over destination port - - + +
+ ICS_HOST + RT Unicast +
- + + PROFInet Context Manager over source port - - + +
+ ICS_HOST + Context Manager +
diff --git a/GM3/data/fingerprint/Panasonic.xml b/GM3/data/fingerprint/Panasonic.xml new file mode 100644 index 0000000..8c540d8 --- /dev/null +++ b/GM3/data/fingerprint/Panasonic.xml @@ -0,0 +1,25 @@ + + +
+ Panasonic + Default + This fingerprint identifies evidence of Panasonic FP and FP2 ethernet traffic. +
+ + 9094 + + + 8500 + + + PLC that has the ability to do higher processing with optimizing communication. + + +
+ PLC + Pansonic FP/FP2 +
+ + + + diff --git a/GM3/data/fingerprint/Phoenix Contact PCWorx.xml b/GM3/data/fingerprint/Phoenix Contact PCWorx.xml new file mode 100644 index 0000000..e8c3fc4 --- /dev/null +++ b/GM3/data/fingerprint/Phoenix Contact PCWorx.xml @@ -0,0 +1,23 @@ + + +
+ Phoenix Contact PCWorx + Default + This fingerprint looks for evidence of Phoenix contact data traffic. +
+ + 1962 + + + Looks for PCWorx data communication of engineering workstation over the port specified. + + +
+ WORKSTATION + ENGINEER + PCWorx +
+ + + + diff --git a/GM3/data/fingerprint/ProconOS.xml b/GM3/data/fingerprint/ProconOS.xml new file mode 100644 index 0000000..7f5a4ab --- /dev/null +++ b/GM3/data/fingerprint/ProconOS.xml @@ -0,0 +1,22 @@ + + +
+ ProconOS + Default + This fingerprint identifies evidence of ProconOS traffic. +
+ + 20547 + + + High performance PLC runtime engine desinged to run both embedded and PC applications + + +
+ PLC + ProconOS +
+ + + + \ No newline at end of file diff --git a/GM3/data/fingerprint/RADIUS.xml b/GM3/data/fingerprint/RADIUS.xml new file mode 100644 index 0000000..03c7236 --- /dev/null +++ b/GM3/data/fingerprint/RADIUS.xml @@ -0,0 +1,36 @@ + + +
+ RADIUS + Default + This fingerprint identifies evidence of RADIUS services including internet authentication and accounting. +
+ + 17 + 1812 + + + 17 + 1813 + + + Tags RADIUS authentication internet service + + +
+ RADIUS-Authentication +
+ + + + + Tags RADIUS accounting internet service. + + +
+ RADIUS - Accounting +
+ + + + diff --git a/GM3/data/fingerprint/RNRP.xml b/GM3/data/fingerprint/RNRP.xml index a18a23a..0e74db9 100644 --- a/GM3/data/fingerprint/RNRP.xml +++ b/GM3/data/fingerprint/RNRP.xml @@ -3,15 +3,20 @@
RNRP Default - This fingerprint looks for the evidence of RNRP traffic. - Original + This fingerprint looks for evidence of RNRP traffic.
- + 2423 - + + Tags RNRP TCP/UDP destination port - + +
+ ICS_HOST + RNRP +
+ diff --git a/GM3/data/fingerprint/RTP.xml b/GM3/data/fingerprint/RTP.xml new file mode 100644 index 0000000..d02ef7c --- /dev/null +++ b/GM3/data/fingerprint/RTP.xml @@ -0,0 +1,34 @@ + + +
+ RTP + Default + This fingerprint identifies evidence of real time streaming communicating with media servers in conjunction with real time control protocol for media delivery. +
+ + 554 + + + 5004 + + + Real time streaming protocol + + +
+ RTSP +
+ + + + + Real Time Transport + + +
+ RTP +
+ + + + diff --git a/GM3/data/fingerprint/Red Lion.xml b/GM3/data/fingerprint/Red Lion.xml new file mode 100644 index 0000000..802a78d --- /dev/null +++ b/GM3/data/fingerprint/Red Lion.xml @@ -0,0 +1,22 @@ + + +
+ Red Lion + Default + This fingerprint looks for evidence of Red Lion traffic running the CrimsonV3 software for HMI. +
+ + 789 + + + Red Lion traffic running the CrimsonV3 software for HMI. + + +
+ HMI + Red Lion CrimsonV3 +
+ + + + diff --git a/GM3/data/fingerprint/Review_Comments.txt b/GM3/data/fingerprint/Review_Comments.txt new file mode 100644 index 0000000..96cf398 --- /dev/null +++ b/GM3/data/fingerprint/Review_Comments.txt @@ -0,0 +1,11 @@ +Fingerprint XML Notes +DCERPC.xml Line 6, near end "..which whill...", remove h. - Fixed +EDG.xml Line 13, several places - Fixed +Fatek.xml Line 12 - Fixed +GE.xml Line 6, 62, 73 - Fixed +HMS HICP Port.xml Line 6, space between "of" & "HMS" - Fixed +Invensys Sigma Port.xml Line 12 "Schneider" - Fixed +LonWorks Line 18, 26 not LongWorks - Fixed +Mitsubishi Electronic.xml Line 115 - Fixed +Rockwell AADvance.xml Line 72, 83, 95, 107, 118, 129: destination, not "destiantion" - Fixed +Who_Login.xml Line 6 near end, several items - Fixed \ No newline at end of file diff --git a/GM3/data/fingerprint/Rockwell AADvance.xml b/GM3/data/fingerprint/Rockwell AADvance.xml new file mode 100644 index 0000000..40417d5 --- /dev/null +++ b/GM3/data/fingerprint/Rockwell AADvance.xml @@ -0,0 +1,139 @@ + + +
+ Rockwell AADvance + Default + This fingerprint looks for evidence of Rockwell AADvance traffic. +
+ + 6 + 502 + + + 6 + 1132 + + + 6 + 1132 + + + 17 + 2010 + + + 17 + 2011 + + + 17 + 5000 + + + 6 + 10001 + + + 6 + 10002 + + + 6 + 10003 + + + 6 + 10004 + + + 6 + 10005 + + + 6 + 10006 + + + 6 + 55555 + + + Rockwell AADvance ModbusTCP that tags the destination port. + + +
+ ICS_HOST + Rockwell AADvance ModbusTCP +
+ + + + + Rockwell AADvance tagged via destination port. Safely network control protocol, used by opc, workbench debugger and binding networks. + + +
+ ICS_HOST + Rockwell AADvance SNCP +
+ + + + + Rockwell AADvance tagged via destination port. RTU packaged in serial stream. Other ports may be assigned. + + +
+ RTU + SLAVE + Rockwell AADvance ModbusRTU +
+ + + + + Rockwell AADvance tagged via destination port. Used to configure systems. the tool sends broadcast to 2010 and systems reply to port 2011. + + +
+ RTU + SLAVE + Rockw ell AADvance Discovery Tool +
+ + + + + Rockwell AADvance tagged via destination port. + + +
+ ICS_HOST + Rockwell AADvance Peer to Peer +
+ + + + + Rockwell AADvance tagged via destination port. Transparent communication interface, where an Ethernet host can talk through AADvance to a serial port + + +
+ ICS_HOST + Rockwell AADvance Serial Data +
+ + + + + Rockwell AADvance tagged via destination port. Diagnostic command line interface + + +
+ ICS_HOST + Rockwell AADvance Telnet +
+ + + + diff --git a/GM3/data/fingerprint/Rockwell Bizware.xml b/GM3/data/fingerprint/Rockwell Bizware.xml new file mode 100644 index 0000000..85221b8 --- /dev/null +++ b/GM3/data/fingerprint/Rockwell Bizware.xml @@ -0,0 +1,143 @@ + + +
+ Rockwell Bizware + Default + This fingerprint looks for evidence of Bizware Task Manager traffic. This fingerprint looks for evidence of Bizware Production Server traffic. This fingerprint looks for evidence of Bizware Server Manager traffic. This fingerprint looks for evidence of Bizware CTP Server traffic. This fingerprint looks for evidence of Bizware PlantMetrics Server traffic. +
+ + 4123 + 6 + + + 4120 + 6 + + + 4121 + 6 + + + 4125 + 6 + + + 4122 + 6 + + + 4124 + 6 + + + 8080 + 6 + + + 8081 + 6 + + + 8083 + 6 + + + Rockwell Bizware Task Manager payload that tags the destination port + + +
+ ICS_HOST + Rockwell Bizware Task Manager +
+ + + + + Rockwell Bizware Production Server payload that tags the destination port + + +
+ ICS_HOST + Rockwell Bizware Production Server +
+ + + + + Rockwell Bizware Server Manager payload that tags the destination port + + +
+ ICS_HOST + Rockwell Bizware Server Manager +
+ + + + + Rockwell Bizware CTP Server payload that tags the destination port + + +
+ ICS_HOST + Rockwell Bizware CTP Server +
+ + + + + Rockwell Bizware Server Manager payload that tags the destination port + + +
+ ICS_HOST + Rockwell Bizware PlanMetrics Server +
+ + + + + Rockwell Bizware Scheduler payload that tags the destination port + + +
+ ICS_HOST + Rockwell Bizware Task Manager +
+ + + + + Rockwell Bizware HTTP Product Server payload that tags the destination port + + +
+ ICS_HOST + Rockwell Bizware HTTP Product Server +
+ + + + + Rockwell Bizware HTTP Server Manager payload that tags the destination port + + +
+ ICS_HOST + Rockwell Bizware HTTP Server Manager +
+ + + + + Rockwell Bizware HTTP CTP Server payload that tags the destination port + + +
+ ICS_HOST + Rockwell Bizware HTTP CTP Server +
+ + + + diff --git a/GM3/data/fingerprint/Rockwell CSP.xml b/GM3/data/fingerprint/Rockwell CSP.xml new file mode 100644 index 0000000..84d8a51 --- /dev/null +++ b/GM3/data/fingerprint/Rockwell CSP.xml @@ -0,0 +1,59 @@ + + +
+ Rockwell CSP + Default + This fingerprint looks for the evidence of Rockwell CSP1, CSP2, and CSP3 traffic. +
+ + 2221 + + + 2221 + + + 2222 + + + 2222 + + + 2223 + + + 2223 + + + Rockwell CSP1 that tags the source and destination ports + + +
+ ICS_HOST + Rockwell CSP1 +
+ + + + + Rockwell CSP2 that tags the source and destination ports + + +
+ ICS_HOST + Rockwell CSP2 +
+ + + + + Rockwell CSP3 that tags the source and destination ports + + +
+ ICS_HOST + Rockwell CSP3 +
+ + + + diff --git a/GM3/data/fingerprint/Rockwell Encapsulation.xml b/GM3/data/fingerprint/Rockwell Encapsulation.xml new file mode 100644 index 0000000..75d5241 --- /dev/null +++ b/GM3/data/fingerprint/Rockwell Encapsulation.xml @@ -0,0 +1,25 @@ + + +
+ Rockwell Encapsulation + Default + This fingerprint looks for evidence of Rockwell Encapsulation traffic. +
+ + 44818 + + + 44818 + + + Rockwell encapsulation that tags the source and destination ports + + +
+ ICS_HOST + Rockwell Encapsulation +
+ + + + diff --git a/GM3/data/fingerprint/Rockwell FF.xml b/GM3/data/fingerprint/Rockwell FF.xml new file mode 100644 index 0000000..d881c58 --- /dev/null +++ b/GM3/data/fingerprint/Rockwell FF.xml @@ -0,0 +1,64 @@ + + +
+ Rockwell FF + Default + This fingerprint looks for evidence of FF LAN Redundancy Port traffic. This fingerprint looks for evidence of FF Fieldbus traffic. This fingerprint looks for evidence of FF System Management traffic. This fingerprint looks for evidence of FF Annunciation traffic. +
+ + 3622 + + + 1090 + + + 1091 + + + 1089 + + + Rockwell LAN Redundancy payload that tags the source port + + +
+ ICS_HOST + Rockwell FF-LR-PORT +
+ + + + + Rockwell Fieldbus Message Specification payload that tags the source and destination ports + + +
+ ICS_HOST + Rockwell FF-FMS +
+ + + + + Rockwell System Management payload that tags the source and destination ports + + +
+ ICS_HOST + Rockwell FF-SM +
+ + + + + Rockwell Annuciation payload that tags the source and destination ports + + +
+ ICS_HOST + Rockwell FF-ANNUNC +
+ + + + diff --git a/GM3/data/fingerprint/Rockwell FactoryTalk.xml b/GM3/data/fingerprint/Rockwell FactoryTalk.xml new file mode 100644 index 0000000..dcced61 --- /dev/null +++ b/GM3/data/fingerprint/Rockwell FactoryTalk.xml @@ -0,0 +1,347 @@ + + +
+ Rockwell FactoryTalk + Default + This fingerprint looks for evidence of FactoryTalk Event Server traffic. This fingerprint looks for evidence of FactoryTalk Directory Server File transfer traffic. This fingerprint looks for evidence of FactoryTalk Directory Server traffic. This fingerprint looks for evidence of FactoryTalk Alarming traffic. This fingerprint looks for evidence of FactoryTalk Object RPC traffic.This fingerprint looks for evidence of FactoryTalk Event Multiplexor traffic.This fingerprint looks for evidence of FactoryTalk Service control traffic.This fingerprint looks for evidence of FactoryTalk Server Health traffic. This fingerprint looks for evidence of FactoryTalk Historian Site Edition which includes PI Network Manager, Analysis Framework v1.x, ACE2 scheduler, Asset Framework Server, PI Notifications, Asset Framework to OLEDB Enterprise. This fingerprint looks for evidence of FactoryTalk Asset Centre Services traffic. This fingerprint looks for evidence of FactoryTalk Asset Centre Server/ VantagePoint SQL or MSSQL. This fingerprint looks for evidence of FactoryTalk Live Data/SE HMI Tag Server. This fingerprint looks for evidence of FactoryTalk Diagnostics. This fingerprint looks for evidence of FactoryTalk Diagnostics VantagePoint Incuity Server Advertiser. +
+ + 6 + 6543 + + + 6 + 1330 + + + 6 + 7600 + + + 6 + 1331 + + + 6 + 1332 + + + 6 + 7700 + + + 3060 + + + 6 + 7710 + + + 6 + 5450 + + + 6 + 5454 + + + 6 + 5455 + + + 6 + 5456 + + + 6 + 5457 + + + 6 + 5458 + + + 6 + 7002 + + + 6 + 7003 + + + 6 + 7004 + + + 6 + 1433 + + + 6 + 1434 + + + 6 + 49281 + + + 6 + 60093 + + + 6 + 65207 + + + Rockwell FactoryTalk Alarming Server + + +
+ HMI + Rockwell FactoryTalk Alarming Server +
+ + + + + Rockwell FactoryTalk Object RPC + + +
+ HMI + Rockwell FactoryTalk Object RPC +
+ + + + + Rockwell FactoryTalk Object RPC + + +
+ HMI + Rockwell FactoryTalk Event Multiplexor +
+ + + + + Rockwell FactoryTalk Service Control + + +
+ HMI + SERVER + Rockwell FactoryTalk Service Control +
+ + + + + Rockwell FactoryTalk Server Health + + +
+ HMI + SERVER + Rockwell FactoryTalk Server Health +
+ + + + + Rockwell FactoryTalk Event Server + + +
+ HMI + SERVER + Rockwell FactoryTalk Event Server +
+ + + + + Rockwell FactoryTalk Directory Server File Transfer + + +
+ HMI + Rockwell FactoryTalk Directory Server File Transfer +
+ + + + + Rockwell FactoryTalk Directory Server + + +
+ HMI + SERVER + Rockwell FactoryTalk Directory Server +
+ + + + + Rockwell FactoryTalk Historian Site Edition - PI Network Manager + + +
+ HMI + ENGINEER + Rockwell FactoryTalk PI Network Manager +
+ + + + + Rockwell FactoryTalk Historian Site Edition - Analysis Framework 5454 + + +
+ HMI + Rockwell FactoryTalk Analysis Framework 5454 +
+ + + + + Rockwell FactoryTalk Historian Site Edition - Analysis Framework 5455 + + +
+ HMI + Rockwell FactoryTalk Analysis Framework 5455 +
+ + + + + Rockwell FactoryTalk Historian Site Edition - ACE2 Scheduler + + +
+ HMI + Rockwell FactoryTalk ACE2 Scheduler +
+ + + + + Rockwell FactoryTalk Historian Site Edition - Asset Framework Server + + +
+ HMI + SERVER + Rockwell FactoryTalk Asset Framework Server +
+ + + + + Rockwell FactoryTalk Historian Site Edition - PI Notification + + +
+ HMI + Rockwell FactoryTalk PI Notification +
+ + + + + Rockwell FactoryTalk Historian Site Edition - Asset Centre Services 7002 + + +
+ HMI + Rockwell FactoryTalk Asset Centre Services 7002 +
+ + + + + Rockwell FactoryTalk Asset Centre Services 7003 + + +
+ HMI + Rockwell FactoryTalk Asset Centre Services 7003 +
+ + + + + Rockwell FactoryTalk Asset Centre Services 7004 + + +
+ HMI + Rockwell FactoryTalk Asset Centre Services 7004 +
+ + + + + Rockwell FactoryTalk Asset Centre Server/ VantagePoint SQL + + +
+ HMI + SERVER + Rockwell FactoryTalk Asset Centre Server. SQL server communication over default port. +
+ + + + + Rockwell FactoryTalk Asset Centre Server/ VantagePoint MSSQL + + +
+ HMI + SERVER + Rockwell FactoryTalk Asset Centre Server. Recommended static destination port for MSSQL to minimize the number of ports open to a firewall. +
+ + + + + Rockwell FactoryTalk Live Data/SE HMI Tag Server + + +
+ HMI + SERVER + Rockwell FactoryTalk Live Data/SE HMI Tag Server. +
+ + + + + Rockwell FactoryTalk Diagnostics + + +
+ HMI + Rockwell FactoryTalk Diagnostics. +
+ + + + + Rockwell FactoryTalk VantagePoint Incuity Server Advertiser + + +
+ HMI + SERVER + Rockwell FactoryTalk VantagePoint Incuity Server Advertiser. +
+ + + + diff --git a/GM3/data/fingerprint/Rockwell FlexLM Server.xml b/GM3/data/fingerprint/Rockwell FlexLM Server.xml new file mode 100644 index 0000000..51d1e3b --- /dev/null +++ b/GM3/data/fingerprint/Rockwell FlexLM Server.xml @@ -0,0 +1,169 @@ + + +
+ Rockwell FlexLM Server + Default + This fingerprint looks for evidence of FlexLM server traffic. + Original +
+ + 27000 + 6 + + + 27001 + 6 + + + 27002 + 6 + + + 27003 + 6 + + + 27004 + 6 + + + 27005 + 6 + + + 27006 + 6 + + + 27007 + 6 + + + 27008 + 6 + + + 27009 + 6 + + + Rockwell FlexLM Server payload that tags the destination port + + +
+ ICS_HOST + SERVER + Rockwell FlexLM Server +
+ + + + + Rockwell FlexLM Server payload that tags the destination port + + +
+ ICS_HOST + SERVER + Rockwell FlexLM Server +
+ + + + + Rockwell FlexLM Server payload that tags the destination port + + +
+ ICS_HOST + SERVER + Rockwell FlexLM Server +
+ + + + + Rockwell FlexLM Server payload that tags the destination port + + +
+ ICS_HOST + SERVER + Rockwell FlexLM Server +
+ + + + + Rockwell FlexLM Server payload that tags the destination port + + +
+ ICS_HOST + SERVER + Rockwell FlexLM Server +
+ + + + + Rockwell FlexLM Server payload that tags the destination port + + +
+ ICS_HOST + SERVER + Rockwell FlexLM Server +
+ + + + + Rockwell FlexLM Server payload that tags the destination port + + +
+ ICS_HOST + SERVER + Rockwell FlexLM Server +
+ + + + + Rockwell FlexLM Server payload that tags the destination port + + +
+ ICS_HOST + SERVER + Rockwell FlexLM Server +
+ + + + + Rockwell FlexLM Server payload that tags the destination port + + +
+ ICS_HOST + SERVER + Rockwell FlexLM Server +
+ + + + + Rockwell FlexLM Server payload that tags the destination port + + +
+ ICS_HOST + SERVER + Rockwell FlexLM Server +
+ + + + diff --git a/GM3/data/fingerprint/Rockwell RSBizWare.xml b/GM3/data/fingerprint/Rockwell RSBizWare.xml new file mode 100644 index 0000000..61134e9 --- /dev/null +++ b/GM3/data/fingerprint/Rockwell RSBizWare.xml @@ -0,0 +1,128 @@ + + +
+ Rockwell RSBizWare + Default + This fingerprint looks for evidence of RSBizWare traffic. +
+ + 6 + 4120 + + + 6 + 4121 + + + 6 + 4122 + + + 6 + 4123 + + + 6 + 4124 + + + 6 + 4125 + + + 6 + 8080 + + + 6 + 8081 + + + Rockwell RSBizWare Production Server payload that tags TCP traffic over the destination port + + +
+ SERVER + Rockwell RSBizWare-Production Server +
+ + + + + Rockwell RSBizWare Server Manager payload that tags TCP traffic over the destination port + + +
+ OPERATOR + Rockwell RSBizWare-Server Manager +
+ + + + + Rockwell RSBizWare PlantMetrics Server payload that tags TCP traffic over the destination port + + +
+ SERVER + Rockwell RSBizWare-Production Server +
+ + + + + Rockwell RSBizWare Task Manager payload that tags TCP traffic over the destination port + + +
+ OPERATOR + Rockwell RSBizWare-Task Manager +
+ + + + + Rockwell RSBizWare Scheduler Server payload that tags TCP traffic over the destination port + + +
+ SERVER + Rockwell RSBizWare-Scheduler Server +
+ + + + + Rockwell RSBizWare Scheduler CTP Server payload that tags TCP traffic over the destination port + + +
+ SERVER + Rockwell RSBizWare-Scheduler CTP Server +
+ + + + + Rockwell RSBizWare Production Server payload that tags TCP traffic over the destination port + + +
+ SERVER + Rockwell RSBizWare-Scheduler CTP Server +
+ + + + + Rockwell RSBizWare Server Manager payload that tags TCP traffic over the destination port + + +
+ OPERATOR + Rockwell RSBizWare-Scheduler CTP Server +
+ + + + diff --git a/GM3/data/fingerprint/Rockwell RSSql.xml b/GM3/data/fingerprint/Rockwell RSSql.xml new file mode 100644 index 0000000..ebf3ad0 --- /dev/null +++ b/GM3/data/fingerprint/Rockwell RSSql.xml @@ -0,0 +1,53 @@ + + +
+ Rockwell RSSql + Default + This fingerprint looks for evidence of Rockwell RSSql Transaction Manager, Compression Server, and Configuration Server traffic. +
+ + 6 + 400 + + + 6 + 401 + + + 6 + 402 + + + Rockwell RSSql transaction that tags the source and destination ports + + +
+ ICS_HOST + Rockwell RSSql Transaction Manager +
+ + + + + Rockwell RSSql compression server that tags the source and destination ports + + +
+ ICS_HOST + Rockwell RSSql Compression Server +
+ + + + + Rockwell RSSql Configuration server that tags the source and destination ports + + +
+ ICS_HOST + Rockwell RSSql Configuration Server +
+ + + + diff --git a/GM3/data/fingerprint/Rockwell RSViewSE.xml b/GM3/data/fingerprint/Rockwell RSViewSE.xml new file mode 100644 index 0000000..4b32b76 --- /dev/null +++ b/GM3/data/fingerprint/Rockwell RSViewSE.xml @@ -0,0 +1,68 @@ + + +
+ Rockwell RSViewSE + Default + This fingerprint looks for evidence of RSviewSE HMI Server traffic. This fingerprint looks for evidence of RSViewSE Server Framework traffic. This fingerprint looks for evidence of RSViewSE HMI Activation traffic. This fingerprint looks for evidence of RSViewSE Directory Serve traffic. +
+ + 7720 + + + 7721 + + + 7721 + + + 7721 + + + Rockwell FactoryTalk RSView SE HMI Server + + +
+ HMI + SERVER + Rockwell RSView SE HMI Server +
+ + + + + Rockwell FactoryTalk RSView SE Server Framework + + +
+ HMI + SERVER + Rockwell RSView SE Server Framework +
+ + + + + Rockwell FactoryTalk RSView SE HMI Activation + + +
+ HMI + OTHER + Rockwell HMI Activation +
+ + + + + Rockwell FactoryTalk RSView SE Directory Server + + +
+ HMI + SERVER + Rockwell Directory Server +
+ + + + diff --git a/GM3/data/fingerprint/SAIA.xml b/GM3/data/fingerprint/SAIA.xml new file mode 100644 index 0000000..9591abd --- /dev/null +++ b/GM3/data/fingerprint/SAIA.xml @@ -0,0 +1,21 @@ + + +
+ SAIA S-BUS + Default + This fingerprint identifies evidence of SAIA S-BUS traffic. +
+ + 5050 + + + Communication Protocol between PDC and PLC by Saia-Burgess Controls. + + +
+ SAIA +
+ + + + diff --git a/GM3/data/fingerprint/SEL-351A.xml b/GM3/data/fingerprint/SEL-351A.xml new file mode 100644 index 0000000..9d862b2 --- /dev/null +++ b/GM3/data/fingerprint/SEL-351A.xml @@ -0,0 +1,32 @@ + + +
+ SEL-351A + Default + This fingerprint pulls out the version info transmitted from a SEL-351A ID command over telnet. +
+ + 6 + 2048 + 23 + + + Tags SEL-351A return traffic that is sending IP commands over telnet. + + 49440D0A020D0A224649443D + + + + +
+ ICS_HOST + SEL-351A +
+ + + + + + + + diff --git a/GM3/data/fingerprint/SNMP.xml b/GM3/data/fingerprint/SNMP.xml new file mode 100644 index 0000000..f6aa0f2 --- /dev/null +++ b/GM3/data/fingerprint/SNMP.xml @@ -0,0 +1,40 @@ + + +
+ SNMP + Default + This fingerprint looks for evidence of the Simple Network Management Protocol traffic. +
+ + 17 + 161 + + + 17 + 162 + + + Tags Simple Network Management Protocol over UDP port 161 and 162 for SNMPTRAP services. The payload looks for SNMP HEX pattern match that will extract the CommunityID and the RequestID from the DATA GET request header. + + +
+ SNMP +
+ + + + 302E02 + + +
+ + + + + + + + + + + diff --git a/GM3/data/fingerprint/Schleicher.xml b/GM3/data/fingerprint/Schleicher.xml new file mode 100644 index 0000000..8714cbc --- /dev/null +++ b/GM3/data/fingerprint/Schleicher.xml @@ -0,0 +1,36 @@ + + +
+ Schleicher + Default + This fingerprint identifies evidence of Schleicher XCX 300 traffic over 20547. This fingerprint identifies evidence of Invensys Sigma Port traffic. +
+ + 20547 + + + 3614 + + + Tags destination port known to the Schleicher XCX 300 PLC. + + +
+ PLC + XCX 300 +
+ + + + + Tags Schleicher Electric Invensys Sigma port trafifc. + + +
+ ICS_HOST + Invensys Sigma Port +
+ + + + \ No newline at end of file diff --git a/GM3/data/fingerprint/Server View.xml b/GM3/data/fingerprint/Server View.xml new file mode 100644 index 0000000..8db1f93 --- /dev/null +++ b/GM3/data/fingerprint/Server View.xml @@ -0,0 +1,22 @@ + + +
+ Server View + Default + This tries to find Server view dmbs access traffic. +
+ + 9212 + + + Tags the DBMS access from Server View. + + +
+ ICS_HOST + Server View DBMS access +
+ + + + diff --git a/GM3/data/fingerprint/ServerStart RemoteControl.xml b/GM3/data/fingerprint/ServerStart RemoteControl.xml index 381f643..eae6965 100644 --- a/GM3/data/fingerprint/ServerStart RemoteControl.xml +++ b/GM3/data/fingerprint/ServerStart RemoteControl.xml @@ -1,19 +1,22 @@
- ServerStart RemoteControl + ServerStart Default - This fingerprint looks for the evidence of ServerStart RemoteControl traffic. - Original + This fingerprint looks for evidence of ServerStart RemoteControl traffic.
- + 9213 - + + Tags inbound ServerStart RemoteControl traffic by source port - - + +
+ ICS_HOST + ServerStart RemoteControl +
- + \ No newline at end of file diff --git a/GM3/data/fingerprint/Siemens APOGEE.xml b/GM3/data/fingerprint/Siemens APOGEE.xml new file mode 100644 index 0000000..b606434 --- /dev/null +++ b/GM3/data/fingerprint/Siemens APOGEE.xml @@ -0,0 +1,403 @@ + + +
+ Siemens APOGEE + Default + This fingerprint finds the version number of the device in the APOGEE network. This fingerprint finds the AEM (APOGEE Ethernet Microserver). This fingerprint finds the hardware type of the device in the APOGEE network. This fingerprint finds the hardware type of the device in the APOGEE network. This fingerprint finds the last link date of the device in the APOGEE network. This fingerprint finds the Ethernet field nael traffic. This fingerprint finds the AEM device. This fingerprint finds the AEM device. This fingerprint finds the AEM device. This fingerprint finds the AEM device. This fingerprint finds the AEM device. This fingerprint finds the License Manager. This fingerprint finds the Device Field Panel. This fingerprint finds the Device Field Panel. This fingerprint finds the Insight Async Service. This fingerprint finds the Objectivity Database 1 and 2. This fingerprint finds the Objectivity Insight 1. This fingerprint finds the AMS Service and Lock server and AEM200. This fingerprint finds Dialogic Board. This fingerprint finds the utility cast manager. This fingerprint finds the UDP BACnet +
+ + 6 + 5033 + + + 6 + 5033 + + + 6 + 5033 + + + 6 + 5033 + + + 6 + 3001 + + + 6 + 3002 + + + 5099 + + + 6 + 5441 + + + 6 + 5442 + + + 6 + 6775 + + + 6 + 6888 + + + 6 + 6889 + + + 6 + 6780 + + + 6 + 6779 + + + 6 + 6780 + + + 6 + 999 + + + 6 + 12001 + + + 6 + 12002 + + + 6 + 12003 + + + 6 + 12004 + + + 6 + 12005 + + + 30400 + + + 47808 + + + Tags APOGEE network version number by HEX match and extracts the version number. + + 3C56657273696F6E4E756D6265723E + + + 3C + + + +
+ ICS_HOST + SERVER + APOGEE - Network Version Number +
+ + + + + + + + Tags APOGEE network hardware type by HEX match and extracts the model type + + 3C4861726477617265547970653E + + + 3C + + + +
+ ICS_HOST + SERVER + APOGEE-Network Hardware Type +
+ + + + + + + + + + + Tags APOGEE network panel name HEX match and extracts the panel name + + 3C50616E656C204E616D653D22 + + + 22 + + + +
+ ICS_HOST + SERVER + APOGEE - Network Panel Name +
+ + + + + + + + + + + Tags APOGEE network link date by HEX match and extracts the link date. + + 3C4C696E6B446174653E + + + 3C + + + +
+ ICS_HOST + SERVER + APOGEE - Network Link Date +
+ + + + + + + + + + + Tags APOGEE field panels. + + +
+ ICS_HOST + APOGEE Ethernet Field Panel +
+ + + + + Tags APOGEE AEM Device. + + +
+ ICS_HOST + APOGEE AEM Device +
+ + + + + Tags APOGEE License Manager. + + +
+ ICS_HOST + APOGEE License Manager +
+ + + + + Tags APOGEE Device Field Panel. + + +
+ ICS_HOST + APOGEE Device Field Panel +
+ + + + + Tags APOGEE Insight Async Service. + + +
+ ICS_HOST + APOGEE Insight Async Service +
+ + + + + Tags APOGEE Objectivity Database 1. + + +
+ ICS_HOST + SERVER + APOGEE Objectivity Database 1 +
+ + + + + Tags APOGEE Device Field Panel 2. + + +
+ ICS_HOST + SERVER + APOGEE Objectivity Database 2 +
+ + + + + Tags APOGEE Objectivity Insight 1. + + +
+ ICS_HOST + APOGEE Objectivity Insight 1 +
+ + + + + Tags APOGEE Objectivity Insight 2. + + +
+ ICS_HOST + APOGEE Objectivity Insight 2 +
+ + + + + Tags APOGEE Objectivity AMS Service. + + +
+ ICS_HOST + SERVER + APOGEE Objectivity AMS Service +
+ + + + + Tags APOGEE Objectivity Lock Server. + + +
+ ICS_HOST + SERVER + APOGEE Objectivity Lock Server +
+ + + + + Tags APOGEE AEM200 Communication. + + +
+ ICS_HOST + APOGEE AEM200 Communication +
+ + + + + Tags APOGEE Dialogic Board 1. + + +
+ ICS_HOST + APOGEE Dialogic Board 1 +
+ + + + + Tags APOGEE Dialogic Board 2. + + +
+ ICS_HOST + APOGEE Dialogic Board 2 +
+ + + + + Tags APOGEE Dialogic Board 3. + + +
+ ICS_HOST + APOGEE Dialogic Board 3 +
+ + + + + Tags APOGEE Dialogic Board 4. + + +
+ ICS_HOST + APOGEE Dialogic Board 4 +
+ + + + + Tags APOGEE Dialogic Board 5. + + +
+ ICS_HOST + APOGEE Dialogic Board +
+ + + + + Tags APOGEE Utility Cast Manager. + + +
+ ICS_HOST + APOGEE Utility Cast Manager +
+ + + + + Tags APOGEE BACnet Field Panels. + + +
+ ICS_HOST + APOGEE BACnet Field Panels +
+ + + + diff --git a/GM3/data/fingerprint/Siemens AuD SCP.xml b/GM3/data/fingerprint/Siemens AuD SCP.xml index 4bcf616..9ab3757 100644 --- a/GM3/data/fingerprint/Siemens AuD SCP.xml +++ b/GM3/data/fingerprint/Siemens AuD SCP.xml @@ -3,16 +3,19 @@
Siemens AuD SCP Default - This fingerprint looks for the evidence of Siemens AuD SCP traffic. - Original + This fingerprint looks for evidence of Siemens AuD SCP traffic.
- + 3820 - + + Tags Siemens AuD SCP traffic over known destination port. - - + +
+ ICS_HOST + AuD SCP +
diff --git a/GM3/data/fingerprint/Siemens S7Comm.xml b/GM3/data/fingerprint/Siemens S7Comm.xml new file mode 100644 index 0000000..93b88dd --- /dev/null +++ b/GM3/data/fingerprint/Siemens S7Comm.xml @@ -0,0 +1,46 @@ + + +
+ Siemens S7Comm + Default + ISO 8073 COTP 020f80 protocol usually rides on port 102. The first byte is always x32 as protocol identifier which is the protocol ID 020f80 32 +
+ + 102 + 6 + + + 102 + 6 + + + Payload matches on the ISO8073/X.224 COTP HEX pattern + + 02F08032 + + +
+ MTU + MASTER + COPT +
+ + + + + + Payload matches on the ISO8073/X.224 COTP HEX pattern + + 02F08032 + + +
+ PLC + SLAVE + COPT +
+ + + + + diff --git a/GM3/data/fingerprint/TCIM-control.xml b/GM3/data/fingerprint/TCIM-control.xml index 86c7bbf..918b355 100644 --- a/GM3/data/fingerprint/TCIM-control.xml +++ b/GM3/data/fingerprint/TCIM-control.xml @@ -1,17 +1,22 @@
- TCIM-control + TCIM-Control Default - This fingerprint looks for the evidence of TCIM Control traffic. - Original + This fingerprint looks for evidence of TCIM Control traffic.
- + 2729 - + + Tags TCIM-control traffic by destination port - + +
+ ICS_HOST + TCIM-Control +
+ diff --git a/GM3/data/fingerprint/TFTP.xml b/GM3/data/fingerprint/TFTP.xml new file mode 100644 index 0000000..8220af3 --- /dev/null +++ b/GM3/data/fingerprint/TFTP.xml @@ -0,0 +1,22 @@ + + +
+ TFTP + Default + This fingerprint identifies evidence of TFTP daemons that listen on UDP port 69, but respond but respond from a randomly allocated high port. +
+ + 17 + 69 + + + Tags TFTP traffic that listens on UDP port 69 + + +
+ TFTP +
+ + + + diff --git a/GM3/data/fingerprint/Trio Motion Control Port.xml b/GM3/data/fingerprint/Trio Motion Control Port.xml index d103c8e..9099ba5 100644 --- a/GM3/data/fingerprint/Trio Motion Control Port.xml +++ b/GM3/data/fingerprint/Trio Motion Control Port.xml @@ -1,18 +1,21 @@
- Trio Motion Control Port + Trio Motion Control Default - This fingerprint looks for the evidence of Trio Motion Control Port traffic. - Original + This fingerprint looks for evidence of Trio Motion Control Port traffic.
- + 3240 - + + Tags Trio Motion Control port traffic by destination port. - - + +
+ ICS_HOST + Trio Motion Control +
diff --git a/GM3/data/fingerprint/Trivial.xml b/GM3/data/fingerprint/Trivial.xml index 9bb03e6..f25c75a 100644 --- a/GM3/data/fingerprint/Trivial.xml +++ b/GM3/data/fingerprint/Trivial.xml @@ -3,25 +3,35 @@
Trivial Default - This fingerprint looks for the evidence of Trivial Network Management traffic.Low confidence that it is TFTP. TFTP is often used in embedded devices. + This fingerprint looks for evidence of Trivial Network Management traffic. Low confidence that it is TFTP. TFTP is often used in embedded devices.
- + 3686 - + 69 69 - + + Tags Trivial Network Management TNMPV-2 - - + +
+ ICS_HOST + TNMPV-2 +
- + + Tags Trivial File Transfer Protocol - + +
+ ICS_HOST + FTP +
+ diff --git a/GM3/data/fingerprint/UPNP Device Host.xml b/GM3/data/fingerprint/UPNP Device Host.xml new file mode 100644 index 0000000..6eb1261 --- /dev/null +++ b/GM3/data/fingerprint/UPNP Device Host.xml @@ -0,0 +1,22 @@ + + +
+ UPNP Device Host + Default + This fingerprint identifies evidence of UPNP device host discovery system service that implements all the components required for device registration, control, and responding to events for hsoted device. +
+ + 6 + 2869 + + + Tags upnp device host traffic over UDP port 2869 + + +
+ UPNP Device Host +
+ + + + diff --git a/GM3/data/fingerprint/Unitronics.xml b/GM3/data/fingerprint/Unitronics.xml new file mode 100644 index 0000000..33468a3 --- /dev/null +++ b/GM3/data/fingerprint/Unitronics.xml @@ -0,0 +1,51 @@ + + +
+ Unitronics + Default + This fingerprint identifies evidence of Unitronics Socket TCP slave communication. +
+ + 20256 + + + 502 + + + 20257 + + + PLC Socket Slave connection over TCP 20256 + + +
+ PLC + SLAVE + Socket1 +
+ + + + + PLC Socket Slave connection over TCP 502 + + +
+ Socket2 +
+ + + + + PLC Socket Slave connection over TCP 20257 + + +
+ PLC + SLAVE + Socket3 +
+ + + + diff --git a/GM3/data/fingerprint/WINS Replication.xml b/GM3/data/fingerprint/WINS Replication.xml new file mode 100644 index 0000000..1714a3a --- /dev/null +++ b/GM3/data/fingerprint/WINS Replication.xml @@ -0,0 +1,21 @@ + + +
+ WINS Replication + Default + This fingerprint identifies evidence of windows internet naming service that enables NetBIOS name resolution. +
+ + 42 + + + Tags WINS server that is communicating with network clients using NetBIOS name resolution + + +
+ WINS Replication +
+ + + + diff --git a/GM3/data/fingerprint/WWIO Talk.xml b/GM3/data/fingerprint/WWIO Talk.xml index 10ee74d..bd87bb9 100644 --- a/GM3/data/fingerprint/WWIO Talk.xml +++ b/GM3/data/fingerprint/WWIO Talk.xml @@ -3,16 +3,19 @@
WWIO Talk Default - This fingerprint looks for the evidence of WWIO Talk traffic. - Original + This fingerprint looks for evidence of WWIO Talk traffic.
- + 5413 - + + The host listening on 5413 - - + +
+ ICS_HOST + OTHER +
diff --git a/GM3/data/fingerprint/Who_Login.xml b/GM3/data/fingerprint/Who_Login.xml new file mode 100644 index 0000000..c44b0c8 --- /dev/null +++ b/GM3/data/fingerprint/Who_Login.xml @@ -0,0 +1,35 @@ + + +
+ Who_Login + Default + This fingerprint identifies evidence of who/login against tcp/udp traffic. This is a automatic authentication performed based on privileged port numbers and distributed databases which identify "authentication domains." Also the protocol maintains databases showing who's logged into the machines on a local network and the load average of the machine. +
+ + 513 + + + 513 + + + Tags version 1 type 1, WHO or LOGIN protocol over 513 tcp/udp traffic. + + +
+ WHO/Login +
+ + + + 1010 + + +
+ + + + + + + + diff --git a/GM3/data/fingerprint/Wonderware.xml b/GM3/data/fingerprint/Wonderware.xml new file mode 100644 index 0000000..371bd33 --- /dev/null +++ b/GM3/data/fingerprint/Wonderware.xml @@ -0,0 +1,36 @@ + + +
+ Wonderware + Default + This fingerprint looks for the devices using the wonderware protocol. +
+ + 5413 + + + 5413 + + + Wonderware IO Talk traffic that looks for the specific destination port. + + +
+ HMI + SuiteLink +
+ + + + + Wonderware IO Talk traffic that looks for the specific source port. + + +
+ HMI + SuiteLink +
+ + + + diff --git a/GM3/data/plugins/iadgov.csvimport/Plugin.java b/GM3/data/plugins/iadgov.csvimport/Plugin.java index 3804743..38d3b99 100644 --- a/GM3/data/plugins/iadgov.csvimport/Plugin.java +++ b/GM3/data/plugins/iadgov.csvimport/Plugin.java @@ -5,6 +5,7 @@ import java.util.ArrayList; import java.util.Collection; + /** * A plugin will be loaded by GrassMarlin if: * 1) The plugin is contained in a jar file located in the plugins directory diff --git a/GM3/data/plugins/iadgov.offlinepcap/PacketHandler.java b/GM3/data/plugins/iadgov.offlinepcap/PacketHandler.java index 81c627a..d1fd579 100644 --- a/GM3/data/plugins/iadgov.offlinepcap/PacketHandler.java +++ b/GM3/data/plugins/iadgov.offlinepcap/PacketHandler.java @@ -55,7 +55,7 @@ public int handle(final ByteBuffer bufPacket, final long msSinceEpoch, final int final byte protocol; final Cidr ipSource; final Cidr ipDest; - final byte ttl; + final int ttl; final int cbIp; final int idxLastIpByte; @@ -68,9 +68,15 @@ public int handle(final ByteBuffer bufPacket, final long msSinceEpoch, final int protocol = bufPacket.get(startCurrentHeader + 9); ipSource = new Cidr(((long)bufPacket.getInt(startCurrentHeader + 12)) & 0x00000000FFFFFFFFL); ipDest = new Cidr(((long)bufPacket.getInt(startCurrentHeader + 16)) & 0x00000000FFFFFFFFL); - ttl = bufPacket.get(startCurrentHeader + 8); + ttl = (int)bufPacket.get(startCurrentHeader + 8) & 0x000000FF; cbIp = (int)bufPacket.getShort(startCurrentHeader + 2) & 0x0000FFFF; - idxLastIpByte = startCurrentHeader + cbIp; + //if cbIp is 0 there is a good chance that TSO is happening, we'er just going to guess that the packet is + // the length of the buffer + if (cbIp > 0) { + idxLastIpByte = startCurrentHeader + cbIp; + } else { + idxLastIpByte = cbPacket; + } final int wFragment = bufPacket.getShort(startCurrentHeader + 6); final boolean hasMoreFragments = (wFragment & 0x20) == 0x20; @@ -212,7 +218,11 @@ public int handle(final ByteBuffer bufPacket, final long msSinceEpoch, final int } } - temp = new JBuffer(contents); + if (contents.length > 0) { + temp = new JBuffer(contents); + } else { + temp = null; + } meta = new PMetaData(source, msSinceEpoch, idxFrame, portSource, portDest, protocol, ipSource, macSource, ipDest, macDestination, -1, contents.length, etherType, -1, -1, ttl, -1, null); diff --git a/GM3/data/plugins/iadgov.offlinepcap/PcapFileParser.java b/GM3/data/plugins/iadgov.offlinepcap/PcapFileParser.java index e2163e1..6902018 100644 --- a/GM3/data/plugins/iadgov.offlinepcap/PcapFileParser.java +++ b/GM3/data/plugins/iadgov.offlinepcap/PcapFileParser.java @@ -72,7 +72,7 @@ protected void parseSource() throws IllegalStateException{ //final int majorVersion = intFromBytes(header, 5, 2, isSwapped); //final int minorVersion = intFromBytes(header, 7, 2, isSwapped); - final int secGmtOffset = intFromBytes(header, 9, 4, isSwapped); + final long secGmtOffset = intFromBytes(header, 9, 4, isSwapped); //TODO: SigFigs //TODO: SnapLen //TODO: Network @@ -81,10 +81,14 @@ protected void parseSource() throws IllegalStateException{ buffer = ByteBuffer.allocateDirect(16); buffer.mark(); - buffer.order(ByteOrder.LITTLE_ENDIAN); + if (isSwapped) { + buffer.order(ByteOrder.BIG_ENDIAN); + } else { + buffer.order(ByteOrder.LITTLE_ENDIAN); + } while(16 == reader.read(buffer)) { - final int sTimestamp = buffer.getInt(0);//intFromBytes(headerPacket, 0, 4, true); - final int usTimestamp = buffer.getInt(4);//intFromBytes(headerPacket, 4, 4, true); + final long sTimestamp = buffer.getInt(0);//intFromBytes(headerPacket, 0, 4, true); + final long usTimestamp = buffer.getInt(4);//intFromBytes(headerPacket, 4, 4, true); final int lengthPacket = buffer.getInt(8);//intFromBytes(headerPacket, 8, 4, true); //This is the captured length final ByteBuffer contentsPacket; @@ -103,7 +107,7 @@ protected void parseSource() throws IllegalStateException{ } contentsPacket.rewind(); - final int cbProcessed = handler.handle(contentsPacket, (sTimestamp + secGmtOffset) * 1000 + usTimestamp / 1000, idxFrame++); + final int cbProcessed = handler.handle(contentsPacket, (sTimestamp + secGmtOffset) * 1000L + usTimestamp / 1000, idxFrame++); source.recordTaskProgress(lengthPacket + 16 - cbProcessed); buffer.reset(); diff --git a/GM3/data/plugins/iadgov.offlinepcap/PcapNgFileParser.java b/GM3/data/plugins/iadgov.offlinepcap/PcapNgFileParser.java index 157d696..a7b9431 100644 --- a/GM3/data/plugins/iadgov.offlinepcap/PcapNgFileParser.java +++ b/GM3/data/plugins/iadgov.offlinepcap/PcapNgFileParser.java @@ -206,7 +206,7 @@ protected int processBlockHeader(SeekableByteChannel channel) throws IOException cbProcessed = handler.handle(bufPacket, ts * 1000L / timestampResolutions.get(idInterface), idxFrame++); //Variable length options will be included. source.recordTaskProgress(sizeBlock - cbProcessed); - return sizeBlock - (28 + cbProcessed); + return sizeBlock - (28 + cbCapture); case 4: //Name Resolution Block //TODO: Parse the name resolution block and use the data to augment nodes source.recordTaskProgress(sizeBlock); diff --git a/GM3/data/plugins/iadgov.sessioneventtest/Plugin.java b/GM3/data/plugins/iadgov.sessioneventtest/Plugin.java new file mode 100644 index 0000000..7674f4b --- /dev/null +++ b/GM3/data/plugins/iadgov.sessioneventtest/Plugin.java @@ -0,0 +1,50 @@ +package iadgov.sessioneventtest; + +import core.logging.Severity; +import javafx.scene.control.MenuItem; + +import java.lang.Override; + +/** + * This plugin adds hooks that produce messages in response to session events. + * It exists to aid in the testing of the SessionEventHooks interface. + */ +public class Plugin implements util.Plugin, util.Plugin.SessionEventHooks { + /** + * Constructor required as part of the util.Plugin interface to GrassMarlin. + */ + public Plugin() { + // No content + } + + /** + * Part of the util.Plugin interface. + * @return The pretty-print version of the Plugin's name. + */ + @Override + public String getName() { + return "Session Event Hooks"; + } + + /** + * Part of the util.Plugin interface. + * @return A MenuItem which will be added to the Tools->Plugin menu. If null is returned, a disabled item bearing the name of the plugin will be provided automatically. + */ + @Override + public MenuItem getMenuItem() { + return null; + } + + @Override + public void sessionCreated(core.document.Session session) { + core.logging.Logger.log(this, Severity.Success, "New Session: " + session); + } + @Override + public void sessionLoaded(core.document.Session session) { + core.logging.Logger.log(this, Severity.Success, "Loaded Session: " + session); + } + @Override + public void sessionCleared(core.document.Session session) { + core.logging.Logger.log(this, Severity.Success, "Cleared Session: " + session); + } +} diff --git a/GM3/data/reference/GRASSMARLIN_User_Guide3.2.pdf b/GM3/data/reference/GRASSMARLIN_User_Guide3.2.pdf index 89bd902..55f2d12 100644 Binary files a/GM3/data/reference/GRASSMARLIN_User_Guide3.2.pdf and b/GM3/data/reference/GRASSMARLIN_User_Guide3.2.pdf differ diff --git a/GM3/images/logical/country/Thumbs.db b/GM3/images/logical/country/Thumbs.db new file mode 100644 index 0000000..6f98ea6 Binary files /dev/null and b/GM3/images/logical/country/Thumbs.db differ diff --git a/GM3/images/physical/Thumbs.db b/GM3/images/physical/Thumbs.db new file mode 100644 index 0000000..1a494fb Binary files /dev/null and b/GM3/images/physical/Thumbs.db differ diff --git a/GM3/resource/images/Thumbs.db b/GM3/resource/images/Thumbs.db index 643d95d..9f07ea0 100644 Binary files a/GM3/resource/images/Thumbs.db and b/GM3/resource/images/Thumbs.db differ diff --git a/GM3/resource/images/microsoft/Thumbs.db b/GM3/resource/images/microsoft/Thumbs.db index 762f1e8..e157439 100644 Binary files a/GM3/resource/images/microsoft/Thumbs.db and b/GM3/resource/images/microsoft/Thumbs.db differ diff --git a/GM3/resource/raw_images/GRASSMARLIN User Guide.pdf b/GM3/resource/raw_images/GRASSMARLIN User Guide.pdf index 89bd902..55f2d12 100644 Binary files a/GM3/resource/raw_images/GRASSMARLIN User Guide.pdf and b/GM3/resource/raw_images/GRASSMARLIN User Guide.pdf differ diff --git a/GM3/resource/xsd/fingerprint3.xsd b/GM3/resource/xsd/fingerprint3.xsd index 2a33c1d..1852eb6 100644 --- a/GM3/resource/xsd/fingerprint3.xsd +++ b/GM3/resource/xsd/fingerprint3.xsd @@ -40,7 +40,7 @@ - + diff --git a/GM3/src/core/Configuration.java b/GM3/src/core/Configuration.java index 4eea163..d493a84 100644 --- a/GM3/src/core/Configuration.java +++ b/GM3/src/core/Configuration.java @@ -63,7 +63,11 @@ public enum Fields { DIR_IMAGES_ICON("dir.images.icon", () -> "images"), PATH_MANUFACTURER_DB("path.wireshark.manuf", () -> { if(SystemUtils.IS_OS_WINDOWS) { - return Paths.get(Paths.get(Configuration.getPreferenceString(Configuration.Fields.WIRESHARK_EXEC)).getParent().toString(), "manuf").toString(); + if (Configuration.getPreferenceString(Configuration.Fields.WIRESHARK_EXEC) != null) { + return Paths.get(Paths.get(Configuration.getPreferenceString(Configuration.Fields.WIRESHARK_EXEC)).getParent().toString(), "manuf").toString(); + } else { + return null; + } } else { return "/usr/share/wireshark/manuf"; } diff --git a/GM3/src/core/PcapDeviceList.java b/GM3/src/core/PcapDeviceList.java index 3dedab4..ab6c5e5 100644 --- a/GM3/src/core/PcapDeviceList.java +++ b/GM3/src/core/PcapDeviceList.java @@ -62,12 +62,13 @@ public static ObservableList get() { result.add(new DeviceEntry(device)); } } - + Pcap.freeAllDevs(devices, error); } catch (java.lang.UnsatisfiedLinkError ex) { result.clear(); Logger.log(PcapDeviceList.class, Severity.Error, "Live capture is unavailable do to insufficient permissions or a missing PCAP library."); - } finally { - Pcap.freeAllDevs(devices, error); + } catch(Exception ex) { + result.clear(); + Logger.log(PcapDeviceList.class, Severity.Error, "Live capture is unavailable."); } return result; diff --git a/GM3/src/core/Version.java b/GM3/src/core/Version.java index 1a94e70..d226276 100644 --- a/GM3/src/core/Version.java +++ b/GM3/src/core/Version.java @@ -9,13 +9,24 @@ import java.util.Map; public final class Version { - public static final String APPLICATION_VERSION = "3.2.0"; + public static final String APPLICATION_VERSION = "3.2.1"; public static final String APPLICATION_TITLE = "GrassMarlin " + APPLICATION_VERSION; - public static final int APPLICATION_REVISION = 2925; + public static final int APPLICATION_REVISION = 26; public static final String FILENAME_USER_GUIDE = "GRASSMARLIN_User_Guide3.2.pdf"; public static final Map> PATCH_NOTES = new ReadOnlyMapWrapper<>(new ObservableMapWrapper<>(new LinkedHashMap>() { { + this.put("3.2.1", Arrays.asList( + "While porting the Fingerprinting engine to version 3.3, a few low-risk-high-impact optimizations were found which were backported to 3.2.1; fingerprinting throughput is roughly doubled as a result.", + "Following the release of GrassMarlin 3.2.0 we have, with help from a wide base of users, identified and fixed several bugs.", + "Importing PcapNg files had some issues that have been addressed, specifically with ARP and files created with a certain Endianness.", + "Many bugs were fixed in Fingerprinting.", + "Additional Fingerprints have been added and existing Fingerprints have been updated.", + "If Wireshark is not auto-detected (or manually configured) properly, the application will no longer crash.", + "Improved support for builds that disable Live Pcap.", + "The packet list in the View Frames Dialog can now be exported to CSV.", + "The chart on the View Frames Dialog can be exported to SVG from the context menu; the chart component does not scale, it is effectively taken as a screenshot of the current display. It is slightly better than screenshot-and-crop, though." + )); this.put("3.2.0", Arrays.asList( "KNOWN ISSUES:", "Some context menu items are missing from the Physical Graph tree view; the missing commands are available from the Visualization context menu.", diff --git a/GM3/src/core/document/PhysicalTopology.java b/GM3/src/core/document/PhysicalTopology.java index b704654..7aa40dd 100644 --- a/GM3/src/core/document/PhysicalTopology.java +++ b/GM3/src/core/document/PhysicalTopology.java @@ -24,6 +24,8 @@ public class PhysicalTopology { */ public static final String TOKEN_WORKSTATION = "\\\\"; + private final ListChangeListener deviceListener; + public static class DirectConnection { private final Mac mac1; private final Mac mac2; @@ -97,7 +99,16 @@ public PhysicalTopology(NetworkGraph graphPhysical) this.graphPhysical = graphPhysical; devices = new ObservableListWrapper<>(new CopyOnWriteArrayList<>()); - devices.addListener(this::Handle_DeviceListModified); + this.deviceListener = this::Handle_DeviceListModified; + devices.addListener(this.deviceListener); + } + + public void startLoading() { + devices.removeListener(this.deviceListener); + } + + public void endLoading() { + devices.addListener(this.deviceListener); } public ObservableList getDevices() { diff --git a/GM3/src/core/document/fingerprint/FPDocument.java b/GM3/src/core/document/fingerprint/FPDocument.java index 07431e7..5a8fb7d 100644 --- a/GM3/src/core/document/fingerprint/FPDocument.java +++ b/GM3/src/core/document/fingerprint/FPDocument.java @@ -55,19 +55,23 @@ public FingerprintState load(Path fingerPrintPath) throws JAXBException { } else { try { Fingerprint[] fingerprint = FingerprintBuilder.loadFingerprint(fingerPrintPath); - //add names to Filter Groups if they don't have one for backwards compatibility - for (int i = 0; i < fingerprint[0].getFilter().size(); i++) { - if (fingerprint[0].getFilter().get(i).getName() == null) { - fingerprint[0].getFilter().get(i).setName("Filter Group " + i); - fingerprint[1].getFilter().get(i).setName("Filter Group " + 1); + if (fingerprint != null) { + //add names to Filter Groups if they don't have one for backwards compatibility + for (int i = 0; i < fingerprint[0].getFilter().size(); i++) { + if (fingerprint[0].getFilter().get(i).getName() == null) { + fingerprint[0].getFilter().get(i).setName("Filter Group " + i); + fingerprint[1].getFilter().get(i).setName("Filter Group " + 1); + } } + FingerprintState state = new FingerprintState(fingerprint[0], fingerPrintPath); + FingerprintState runningState = new FingerprintState(fingerprint[1], fingerPrintPath); + state.enabledProperty().setValue(true); + listFingerprints.add(state); + runningFingerprints.add(runningState); + return state; + } else { + return null; } - FingerprintState state = new FingerprintState(fingerprint[0], fingerPrintPath); - FingerprintState runningState = new FingerprintState(fingerprint[1], fingerPrintPath); - state.enabledProperty().setValue(true); - listFingerprints.add(state); - runningFingerprints.add(runningState); - return state; } catch (IOException ioe) { Alert ioAlert = new Alert(Alert.AlertType.ERROR, ioe.getMessage()); ioAlert.setHeaderText("Error Loading Fingerprint"); @@ -316,6 +320,9 @@ public boolean updatePayloadName(String fingerprintName, Path loadPath, String o .noneMatch(pl -> pl.getFor().equals(newName)); if (goodName) { payload.get().setFor(newName); + fpState.get().getFingerprint().getFilter().stream() + .filter(filter -> filter.getFor().equals(oldName)) + .forEach(filter -> filter.setFor(newName)); updated = true; fpState.get().dirtyProperty().setValue(true); } @@ -324,6 +331,28 @@ public boolean updatePayloadName(String fingerprintName, Path loadPath, String o return updated; } + public boolean updatePayloadDescription(String fingerprintName, Path loadPath, String payloadName, String description) { + boolean updated = false; + + Optional fpState = listFingerprints.stream() + .filter(state -> state.equals(fingerprintName, loadPath)) + .findFirst(); + + if (fpState.isPresent()) { + Optional payload = fpState.get().getFingerprint().getPayload().stream() + .filter(pl -> pl.getFor().equals(payloadName)) + .findFirst(); + + if (payload.isPresent()) { + payload.get().setDescription(description); + updated = true; + fpState.get().dirtyProperty().set(true); + } + } + + return updated; + } + public boolean updateAlways(String fingerprintName, Path loadPath, String payloadName, Fingerprint.Payload.Always always) { boolean updated = false; diff --git a/GM3/src/core/document/graph/LogicalGraph.java b/GM3/src/core/document/graph/LogicalGraph.java index 6997efa..e8c9836 100644 --- a/GM3/src/core/document/graph/LogicalGraph.java +++ b/GM3/src/core/document/graph/LogicalGraph.java @@ -7,6 +7,7 @@ import javafx.application.Platform; import javafx.collections.ListChangeListener; import javafx.collections.ObservableList; +import ui.dialog.ManageLogicalNetworksDialogFx; import util.Cidr; import java.io.IOException; @@ -24,11 +25,11 @@ public class LogicalGraph extends NetworkGraph { protected LogicalGraph(ObservableList cidrs) { this.cidrsLogical = cidrs; cidrsLogical.addListener(this::Handle_NetworksChanged); + ManageLogicalNetworksDialogFx.getInstance().itemsProperty().setValue(this.cidrsLogical); } public LogicalGraph() { - cidrsLogical = new CidrList(); - cidrsLogical.addListener(this::Handle_NetworksChanged); + this(new CidrList()); } private void Handle_NetworksChanged(ListChangeListener.Change c) { diff --git a/GM3/src/core/document/graph/LogicalNode.java b/GM3/src/core/document/graph/LogicalNode.java index 53d19f6..9bb02fc 100644 --- a/GM3/src/core/document/graph/LogicalNode.java +++ b/GM3/src/core/document/graph/LogicalNode.java @@ -212,7 +212,7 @@ public static Byte[] parseMac(String mac) { @Override public XmlElement toXml() { XmlElement xmlNode = INode.super.toXml(); - if(mac != null) { + if (mac != null) { xmlNode.addAttribute("mac").setValue(formatMac(mac)); } diff --git a/GM3/src/core/document/graph/PhysicalNode.java b/GM3/src/core/document/graph/PhysicalNode.java index ddfb269..257a1a5 100644 --- a/GM3/src/core/document/graph/PhysicalNode.java +++ b/GM3/src/core/document/graph/PhysicalNode.java @@ -6,10 +6,7 @@ import javafx.beans.property.StringProperty; import util.Mac; -import java.util.HashMap; -import java.util.HashSet; -import java.util.Map; -import java.util.Set; +import java.util.*; import java.util.stream.Collectors; public abstract class PhysicalNode implements INode { @@ -18,7 +15,7 @@ public abstract class PhysicalNode implements INode { public static final String FIELD_MAC = "MAC"; public static final String FIELD_VLAN = "VLan(s)"; - protected final Mac mac; + protected Mac mac; private final SimpleStringProperty title; private final SimpleStringProperty subtitle; private final SimpleBooleanProperty dirty; diff --git a/GM3/src/core/document/serialization/Grassmarlin_3_2.java b/GM3/src/core/document/serialization/Grassmarlin_3_2.java index e1c9852..fbde9fa 100644 --- a/GM3/src/core/document/serialization/Grassmarlin_3_2.java +++ b/GM3/src/core/document/serialization/Grassmarlin_3_2.java @@ -39,10 +39,8 @@ import java.io.Reader; import java.nio.charset.StandardCharsets; import java.nio.file.Paths; -import java.util.ArrayList; -import java.util.Enumeration; -import java.util.HashMap; -import java.util.List; +import java.util.*; +import java.util.stream.Collectors; import java.util.zip.ZipEntry; import java.util.zip.ZipFile; @@ -72,6 +70,8 @@ public boolean loadDocumentSax(ZipFile inFile, Session session, TabController ta } try { + session.getPhysicalTopologyMapper().startLoading(); + Reader sessionReader = new InputStreamReader(inFile.getInputStream(sessionEntry), StandardCharsets.UTF_8); InputSource sessionSource = new InputSource(sessionReader); sessionSource.setEncoding("UTF-8"); @@ -108,6 +108,8 @@ public boolean loadDocumentSax(ZipFile inFile, Session session, TabController ta meshReader = null; meshSource = null; + session.getPhysicalTopologyMapper().endLoading(); + // At this point the graphs have been restored and we now need to restore UI properties. //Modifying UI elements must happen in the UI thread. @@ -651,6 +653,7 @@ private class PhysicalLoadHandler extends DefaultHandler { private boolean inNode; private Attributes nodeAttributes; private PhysicalNode currentNode; + private HashMap groups; private boolean inGroup; private Attributes groupAttributes; @@ -683,14 +686,14 @@ public void startElement(String uri, String localName, String qName, Attributes inNode = true; if (inGraph && inNodes && inNode) { nodeAttributes = new AttributesImpl(attributes); - if (nodeAttributes != null) { - currentNode = buildPhysicalNode(nodeAttributes, devices); - } } break; case "group": inGroup = true; groupAttributes = new AttributesImpl(attributes); + if (groupAttributes != null && groups == null) { + groups = new HashMap<>(); + } break; case "edges": inEdges = true; @@ -719,16 +722,20 @@ public void endElement(String uri, String localName, String qName) throws SAXExc inNodes = false; break; case "node": - if (inGraph && inNodes && inNode && currentNode != null) { + if (inGraph && inNodes && inNode) { + if (nodeAttributes != null) { + currentNode = buildPhysicalNode(nodeAttributes, devices, groups); + } session.getPhysicalGraph().addNode(currentNode); } currentNode = null; nodeAttributes = null; + groups = null; inNode = false; break; case "group": - if (inGraph && inNodes && inNode && inGroup && currentNode != null && groupAttributes != null) { - currentNode.getGroups().put(groupAttributes.getValue("name"), groupChars); + if (inGraph && inNodes && inNode && inGroup && groupAttributes != null) { + groups.put(groupAttributes.getValue("name"), groupChars); } groupAttributes = null; groupChars = null; @@ -753,16 +760,19 @@ public void endElement(String uri, String localName, String qName) throws SAXExc } } - private PhysicalNode buildPhysicalNode(Attributes nodeAttributes, HashMap devices) { + private PhysicalNode buildPhysicalNode(Attributes nodeAttributes, HashMap devices, Map groups) { PhysicalNode node = null; switch(nodeAttributes.getValue("type")) { case "nic": - String[] deviceTokens = nodeAttributes.getValue("device").split(" "); + String[] deviceTokens = nodeAttributes.getValue("title").split(" "); if (deviceTokens.length == 2) { String macString = deviceTokens[1]; node = new PhysicalNic(new Mac(macString)); ((PhysicalNic) node).vendorProperty().setValue(nodeAttributes.getValue("vendor")); + ((PhysicalNic) node).deviceProperty().setValue(nodeAttributes.getValue("device")); + String vlans = groups.get(PhysicalNode.FIELD_VLAN); + node.getVLans().addAll(Arrays.stream(vlans.split(", ")).map(vlan -> Integer.parseInt(vlan)).collect(Collectors.toList())); } break; case "port": @@ -1208,9 +1218,11 @@ protected void layoutGraphNode(Attributes cellAttributes, List double y = Double.parseDouble(cellAttributes.getValue("y")); Cell cell = visualization.cellFor(nodeList.get(ref)); - if (!(cell.layoutXProperty().isBound() && cell.layoutYProperty().isBound())) { - cell.setLayoutX(x); - cell.setLayoutY(y); + if (!(cell instanceof CellNic || cell instanceof CellPort)) { + if (!(cell.layoutXProperty().isBound() || cell.layoutYProperty().isBound())) { + cell.setLayoutX(x); + cell.setLayoutY(y); + } } cell.autoLayoutProperty().setValue(layout); } diff --git a/GM3/src/core/document/serialization/ProgressTask.java b/GM3/src/core/document/serialization/ProgressTask.java index 8843594..fefaff2 100644 --- a/GM3/src/core/document/serialization/ProgressTask.java +++ b/GM3/src/core/document/serialization/ProgressTask.java @@ -79,6 +79,7 @@ public Thread start() { Platform.runLater(this::handleSuccess); } } catch (Exception e) { + e.printStackTrace(); if (Platform.isFxApplicationThread()) { this.handleFailure(); } else { diff --git a/GM3/src/core/fingerprint/FProcessor.java b/GM3/src/core/fingerprint/FProcessor.java index 1e70327..2096fbb 100644 --- a/GM3/src/core/fingerprint/FProcessor.java +++ b/GM3/src/core/fingerprint/FProcessor.java @@ -18,10 +18,113 @@ */ public class FProcessor { + private static class UnpackedFilter { + private Filter.FilterType type; + private T value; + + public UnpackedFilter (Filter.FilterType type, T value) { + this.type = type; + this.value = value; + } + + public Filter.FilterType getType() { + return this.type; + } + + public T getValue() { + return this.value; + } + } + + private static class UnpackedFilterGroup { + private String payloadName; + private List> filters; + + public UnpackedFilterGroup(String payloadName, List> filters) { + this.payloadName = payloadName; + this.filters = filters; + } + + public String getFor() { + return this.payloadName; + } + + public List> getFilters() { + return this.filters; + } + } + List fingerprints; + Map>> filtersByPayload; public FProcessor(List runningFingerprints) { this.fingerprints = Collections.unmodifiableList(new ArrayList<>(runningFingerprints)); + this.filtersByPayload = unpackFilters(this.fingerprints); + + } + + private synchronized static Map>> unpackFilters(List fingerprints) { + Map>> returnMap = new HashMap<>(); + for (Fingerprint fp : fingerprints) { + Map> groupByPayload = fp.getFilter().stream() + .map(group -> { + List> filters = group.getAckAndMSSAndDsize().stream() + .map(element -> { + UnpackedFilter filter = null; + switch (Filter.FilterType.valueOf(element.getName().toString().replaceAll(" ", "").toUpperCase())) { + case ACK: + filter = new UnpackedFilter<>(Filter.FilterType.ACK, (Long) element.getValue()); + break; + case DSIZE: + filter = new UnpackedFilter<>(Filter.FilterType.DSIZE, (Integer) element.getValue()); + break; + case DSIZEWITHIN: + filter = new UnpackedFilter<>(Filter.FilterType.DSIZEWITHIN, (Fingerprint.Filter.DsizeWithin) element.getValue()); + break; + case DSTPORT: + filter = new UnpackedFilter<>(Filter.FilterType.DSTPORT, (Integer) element.getValue()); + break; + case ETHERTYPE: + filter = new UnpackedFilter<>(Filter.FilterType.ETHERTYPE, (Integer) element.getValue()); + break; + case FLAGS: + filter = new UnpackedFilter<>(Filter.FilterType.FLAGS, (String) element.getValue()); + break; + case MSS: + filter = new UnpackedFilter<>(Filter.FilterType.MSS, (Integer) element.getValue()); + break; + case SEQ: + filter = new UnpackedFilter<>(Filter.FilterType.SEQ, (Integer) element.getValue()); + break; + case SRCPORT: + filter = new UnpackedFilter<>(Filter.FilterType.SRCPORT, (Integer) element.getValue()); + break; + case TRANSPORTPROTOCOL: + filter = new UnpackedFilter<>(Filter.FilterType.TRANSPORTPROTOCOL, (Short) element.getValue()); + break; + case TTL: + filter = new UnpackedFilter<>(Filter.FilterType.TTL, (Integer) element.getValue()); + break; + case TTLWITHIN: + filter = new UnpackedFilter<>(Filter.FilterType.TTLWITHIN, (Fingerprint.Filter.TTLWithin) element.getValue()); + break; + case WINDOW: + filter = new UnpackedFilter<>(Filter.FilterType.WINDOW, (Integer) element.getValue()); + break; + } + return filter; + }) + .filter(filter -> filter != null) + .collect(Collectors.toList()); + + return new UnpackedFilterGroup(group.getFor(), filters); + }) + .collect(Collectors.groupingBy(UnpackedFilterGroup::getFor)); + + returnMap.put(fp, groupByPayload); + } + + return returnMap; } public void process(PacketData data) { @@ -38,42 +141,41 @@ public void process(PacketData data) { private Stream filter(Fingerprint fp, PacketData data) { List payloadNames = new ArrayList<>(); - Map> filterByPayload = fp.getFilter().stream() - .collect(Collectors.groupingBy(filter -> filter.getFor())); + Map> filterByPayload = this.filtersByPayload.get(fp); for (String payload : filterByPayload.keySet()) { groupLoop: - for (Fingerprint.Filter filterGroup : filterByPayload.get(payload)) { - for(JAXBElement element : filterGroup.getAckAndMSSAndDsize()) { - switch (Filter.FilterType.valueOf(element.getName().toString().replaceAll(" ", "").toUpperCase())) { + for (UnpackedFilterGroup filterGroup : filterByPayload.get(payload)) { + for(UnpackedFilter filter : filterGroup.getFilters()) { + switch (filter.getType()) { case ACK: - if (data.getAck() != (Long)element.getValue()) { + if (data.getAck() != (Long)filter.getValue()) { continue groupLoop; } break; case DSIZE: - if (data.getdSize() != (Integer)element.getValue()) { + if (data.getdSize() != (Integer)filter.getValue()) { continue groupLoop; } break; case DSIZEWITHIN: - Fingerprint.Filter.DsizeWithin within = ((Fingerprint.Filter.DsizeWithin) element.getValue()); + Fingerprint.Filter.DsizeWithin within = ((Fingerprint.Filter.DsizeWithin) filter.getValue()); if (data.getdSize() < within.getMin().longValue() || data.getdSize() > within.getMax().longValue()) { continue groupLoop; } break; case DSTPORT: - if (data.getDestPort() != (Integer)element.getValue()) { + if (data.getDestPort() != (Integer)filter.getValue()) { continue groupLoop; } break; case ETHERTYPE: - if (data.getEthertype() != (Integer)element.getValue()) { + if (data.getEthertype() != (Integer)filter.getValue()) { continue groupLoop; } break; case FLAGS: - String flagList = (String)element.getValue(); + String flagList = (String)filter.getValue(); if (data.getFlags() != null) { for (String flag : flagList.split(" ")) { if (!data.getFlags().contains(flag)) { @@ -83,38 +185,38 @@ private Stream filter(Fingerprint fp, PacketData data) { } break; case MSS: - if (data.getMss() != (Integer)element.getValue()) { + if (data.getMss() != (Integer)filter.getValue()) { continue groupLoop; } break; case SEQ: - if (data.getSeqNum() != (Integer)element.getValue()) { + if (data.getSeqNum() != (Integer)filter.getValue()) { continue groupLoop; } break; case SRCPORT: - if (data.getSourcePort() != (Integer)element.getValue()) { + if (data.getSourcePort() != (Integer)filter.getValue()) { continue groupLoop; } break; case TRANSPORTPROTOCOL: - if (data.getTransportProtocol() != (Short)element.getValue()) { + if (data.getTransportProtocol() != (Short)filter.getValue()) { continue groupLoop; } break; case TTL: - if (data.getTtl() != (Integer)element.getValue()) { + if (data.getTtl() != (Integer)filter.getValue()) { continue groupLoop; } break; case TTLWITHIN: - Fingerprint.Filter.TTLWithin ttlWithin = (Fingerprint.Filter.TTLWithin)element.getValue(); + Fingerprint.Filter.TTLWithin ttlWithin = (Fingerprint.Filter.TTLWithin)filter.getValue(); if (data.getTtl() < ttlWithin.getMin().longValue() || data.getTtl() > ttlWithin.getMax().longValue()) { continue groupLoop; } break; case WINDOW: - if (data.getWindowNum() != (Integer)element.getValue()) { + if (data.getWindowNum() != (Integer)filter.getValue()) { continue groupLoop; } break; diff --git a/GM3/src/core/fingerprint/FingerprintBuilder.java b/GM3/src/core/fingerprint/FingerprintBuilder.java index 57dd3ca..a22f1f4 100644 --- a/GM3/src/core/fingerprint/FingerprintBuilder.java +++ b/GM3/src/core/fingerprint/FingerprintBuilder.java @@ -1,6 +1,8 @@ package core.fingerprint; import core.fingerprint3.Fingerprint; +import core.logging.Logger; +import core.logging.Severity; import org.xml.sax.SAXException; import javax.xml.XMLConstants; @@ -12,6 +14,8 @@ import java.net.URL; import java.nio.file.Files; import java.nio.file.Path; +import java.util.List; +import java.util.stream.Collectors; /** * 07.13.2015 - CC - New... @@ -40,6 +44,14 @@ public static Fingerprint[] loadFingerprint(Path fingerprintPath) throws JAXBExc writer.flush(); fingerprints[0] = (Fingerprint) unmarshaller.unmarshal(new StringReader(string.toString())); fingerprints[1] = (Fingerprint) unmarshaller.unmarshal(new StringReader(string.toString())); + + List payloads = fingerprints[0].getPayload().stream().map(payload -> payload.getFor()).collect(Collectors.toList()); + List filters = fingerprints[0].getFilter().stream().map(filter -> filter.getFor()).collect(Collectors.toList()); + + if (!payloads.containsAll(filters)) { + fingerprints = null; + Logger.log(FingerprintBuilder.class, Severity.Warning, "Malformed Fingerprint at " + fingerprintPath + ": Filter group without payload"); + } } return fingerprints; diff --git a/GM3/src/core/fingerprint/PacketData.java b/GM3/src/core/fingerprint/PacketData.java index a59877a..3ebe6ad 100644 --- a/GM3/src/core/fingerprint/PacketData.java +++ b/GM3/src/core/fingerprint/PacketData.java @@ -99,7 +99,7 @@ public int getInt(int offset, boolean bigEndian) { if (!bigEndian) { ArrayUtils.reverse(bytes); } - ret = new BigInteger(bytes).intValue(); + ret = new BigInteger(1, bytes).intValue(); } return ret; } @@ -111,7 +111,7 @@ public int getInt(int offset, int length, boolean bigEndian) { if (!bigEndian) { ArrayUtils.reverse(bytes); } - ret = new BigInteger(bytes).intValue(); + ret = new BigInteger(1, bytes).intValue(); } return ret; @@ -126,7 +126,11 @@ public int getInt(int offset, int length, boolean bigEndian) { */ public int match(byte[] search, int offset, int length) { int ret = -1; - if (payload != null) { + // you can not look at data at negative indexes + if (offset < 0) { + offset = 0; + } + if (payload != null && search.length <= length) { int searchLength = search.length; if (searchLength > 0) { int limit = Math.min(offset + length, payload.size()) - searchLength - offset; diff --git a/GM3/src/core/fingerprint/PayloadFunctions.java b/GM3/src/core/fingerprint/PayloadFunctions.java index d57b6e4..2748cfb 100644 --- a/GM3/src/core/fingerprint/PayloadFunctions.java +++ b/GM3/src/core/fingerprint/PayloadFunctions.java @@ -212,7 +212,7 @@ public static Map.Entry extractFunction(PacketData payload, Curs value = DatatypeConverter.printHexBinary(ext); break; case INTEGER: - value = new BigInteger(ext).toString(); + value = new BigInteger(1, ext).toString(); break; case RAW_BYTES: value = Arrays.toString(ext); @@ -292,25 +292,15 @@ public static boolean matchFunction(PacketData payload, CursorImpl cursor, int d if (relative) { offset += cursor.getMain(); } - if (depth > 0) { - offset = Math.min(depth, offset); - } - offset -= within; - if (offset < 0) { - offset = 0; - } int length; // find the end point - if (relative && (within > 0)) { - length = Math.min(payload.size(), cursor.getMain() + within); + if (depth > 0) { + length = Math.min(depth, payload.size() - offset); } else { - length = payload.size(); + length = payload.size() - offset; } - // set the length to the end point minus the starting point - length = length - offset; - if (patternString != null) { String string = new String(payload.getByteArray(offset, length), charset); Pattern pattern; diff --git a/GM3/src/core/importmodule/LogicalProcessor.java b/GM3/src/core/importmodule/LogicalProcessor.java index 89f107e..67b0b28 100644 --- a/GM3/src/core/importmodule/LogicalProcessor.java +++ b/GM3/src/core/importmodule/LogicalProcessor.java @@ -78,14 +78,17 @@ public void process(Host host) { public void run() { long start = System.currentTimeMillis(); IEdge edge = graph.apply(this.data); - LogicalNode source = edge.getSource(); - LogicalNode dest = edge.getDestination(); + LogicalNode edgeSource = edge.getSource(); + LogicalNode edgeDestination = edge.getDestination(); long end = System.currentTimeMillis(); data.getSource().edgeTime.addAndGet(end - start); - this.data.setSourceNode(source); - this.data.setDestNode(dest); + LogicalNode dataSource = edgeSource.getIp().equals(data.getSourceIp()) ? edgeSource : edgeDestination; + LogicalNode dataDestination = edgeDestination.getIp().equals(data.getDestIp()) ? edgeDestination : edgeSource; + + this.data.setSourceNode(dataSource); + this.data.setDestNode(dataDestination); start = System.currentTimeMillis(); this.processor.process(data); diff --git a/GM3/src/core/importmodule/inputIterators/pcap/PcapFileParser.java b/GM3/src/core/importmodule/inputIterators/pcap/PcapFileParser.java index df75a04..deb9471 100644 --- a/GM3/src/core/importmodule/inputIterators/pcap/PcapFileParser.java +++ b/GM3/src/core/importmodule/inputIterators/pcap/PcapFileParser.java @@ -25,7 +25,6 @@ import util.RateLimitedTask; import java.math.BigInteger; -import java.nio.ByteBuffer; import java.nio.file.Path; import java.util.Arrays; import java.util.Iterator; diff --git a/GM3/src/core/svg/Svg.java b/GM3/src/core/svg/Svg.java new file mode 100644 index 0000000..81a9818 --- /dev/null +++ b/GM3/src/core/svg/Svg.java @@ -0,0 +1,106 @@ +package core.svg; + +import core.document.serialization.xml.Escaping; +import core.svg.svg.*; +import javafx.geometry.Bounds; +import javafx.scene.Node; +import javafx.scene.Parent; +import javafx.scene.SnapshotParameters; +import javafx.scene.paint.Color; + +import java.util.LinkedList; + +// Yes, the package naming here is bad; adding the svg support back into the core code was a bit of a hack to add a single useful feature to the Frames Chart. Since 3.3 is built on a different codebase (as of this comment 3.3 has a working alpha that is showing a lot of promise), the ramifications of this hack are pretty minimal. It can't end up worse than WoD, right? +public class Svg { + public static String fillFromColor(Color color) { + if(color.getOpacity() == 1.0) { + return "fill:rgb(" + (int)(255.0 * color.getRed()) + "," + (int)(255.0 * color.getGreen()) + "," + (int)(255.0 * color.getBlue()) + ")"; + } else { + return "fill:rgb(" + (int)(255.0 * color.getRed()) + "," + (int)(255.0 * color.getGreen()) + "," + (int)(255.0 * color.getBlue()) + ");fill-opacity:" + color.getOpacity(); + } + } + public static String XmlString(String in) { + return Escaping.XmlString(in); + } + public static String fromColor(Color color) { + if(color == null || color.getOpacity() == 0.0) { + return "none"; + } else { + return "rgb(" + (int) (255.0 * color.getRed()) + "," + (int) (255.0 * color.getGreen()) + "," + (int) (255.0 * color.getBlue()) + ")"; + } + } + + public static String serialize(Parent object) { + StringBuilder result = new StringBuilder(); + + Bounds bounds = object.getLayoutBounds(); + TransformStack transforms = new TransformStack(); + transforms.push(bounds.getMinX() * -1.0, bounds.getMinY() * -1.0); + + result.append(""); + + result.append(fromNode(object).toSvg(transforms)); + result.append("\n"); + + return result.toString(); + } + + public static Entity fromNode(Node object) { + if(object == null || !object.isVisible() || object.getOpacity() < 1.0) { + return null; + } else if(object instanceof javafx.scene.shape.Polygon) { + return new Polygon((javafx.scene.shape.Polygon)object); + } else if(object instanceof javafx.scene.shape.Line) { + return new Line((javafx.scene.shape.Line)object); + } else if(object instanceof javafx.scene.shape.CubicCurve) { + return new Curve((javafx.scene.shape.CubicCurve)object); + } else if(object instanceof javafx.scene.Parent) { + javafx.scene.Parent parent = (javafx.scene.Parent)object; + + final LinkedList children = new LinkedList<>(); + for(Node child : parent.getChildrenUnmodifiable()) { + final Entity entity = fromNode(child); + if(entity != null) { + children.add(entity); + } + } + + if(children.isEmpty()) { + return null; + } else { + Container result = new Container(children); + + if(parent instanceof javafx.scene.layout.Region) { + //Region adds padding. + javafx.scene.layout.Region region = (javafx.scene.layout.Region)parent; + + result.setOffsetX(parent.getLayoutX() + region.getPadding().getLeft() - parent.getTranslateX()); + result.setOffsetY(parent.getLayoutY() + region.getPadding().getTop() - parent.getTranslateY()); + } else { + result.setOffsetX(parent.getLayoutX() - parent.getTranslateX()); + result.setOffsetY(parent.getLayoutY() - parent.getTranslateY()); + } + + return result; + } + } else if(object instanceof javafx.scene.shape.Rectangle) { + return new Rectangle( (javafx.scene.shape.Rectangle)object ); + } else if(object instanceof javafx.scene.image.ImageView) { + return new Image((javafx.scene.image.ImageView) object); + } else if(object instanceof javafx.scene.text.Text) { + //A Label is a Parent (covered above) which contains a Text + return new Text( (javafx.scene.text.Text)object ); + } else if(object instanceof javafx.scene.shape.Circle) { + return new Circle((javafx.scene.shape.Circle) object); + } else if(object instanceof javafx.scene.canvas.Canvas) { + return new Canvas((javafx.scene.canvas.Canvas)object); + } else { + System.out.println("Unable to convert Node to SVG: (" + object.getClass() + ")" + object); + return null; + } + } +} diff --git a/GM3/src/core/svg/svg/Canvas.java b/GM3/src/core/svg/svg/Canvas.java new file mode 100644 index 0000000..59af954 --- /dev/null +++ b/GM3/src/core/svg/svg/Canvas.java @@ -0,0 +1,60 @@ +package core.svg.svg; + +import javafx.scene.image.PixelFormat; +import javafx.scene.image.PixelReader; +import javafx.scene.image.WritableImage; +import javafx.scene.image.WritablePixelFormat; +import sun.awt.image.IntegerComponentRaster; + +import javax.imageio.ImageIO; +import java.awt.image.BufferedImage; +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.nio.IntBuffer; +import java.util.Base64; + +public class Canvas extends Entity { + private final javafx.scene.canvas.Canvas source; + + public Canvas(final javafx.scene.canvas.Canvas source) { + this.source = source; + } + + @Override + public String toSvg(final TransformStack transforms) { + final WritableImage image = source.snapshot(null, null); + + StringBuilder result = new StringBuilder(); + + result.append(""); + + return result.toString(); + } +} diff --git a/GM3/src/core/svg/svg/Circle.java b/GM3/src/core/svg/svg/Circle.java new file mode 100644 index 0000000..4f89ff7 --- /dev/null +++ b/GM3/src/core/svg/svg/Circle.java @@ -0,0 +1,24 @@ +package core.svg.svg; + +import core.svg.Svg; +import javafx.scene.paint.Color; + +public class Circle extends Entity { + private final javafx.scene.shape.Circle circle; + + public Circle(javafx.scene.shape.Circle source) { + this.circle = source; + } + + @Override + public String toSvg(final TransformStack transforms) { + return String.format("", + transforms.get().getX() + circle.getCenterX() + circle.getLayoutX(), + transforms.get().getY() + circle.getCenterY() + circle.getLayoutY(), + circle.getRadius(), + Svg.fromColor((Color) circle.getFill()), + ((Color) circle.getFill()).getOpacity(), + Svg.fromColor((Color) circle.getStroke()), + circle.getStrokeWidth()); + } +} diff --git a/GM3/src/core/svg/svg/Container.java b/GM3/src/core/svg/svg/Container.java new file mode 100644 index 0000000..ee7dbea --- /dev/null +++ b/GM3/src/core/svg/svg/Container.java @@ -0,0 +1,45 @@ +package core.svg.svg; + +import java.util.Collection; + +public class Container extends Entity { + + private final Collection components; + private double tX = 0.0; + private double tY = 0.0; + + public Container(final Collection components) { + this.components = components; + } + + public void setOffsetX(final double value) { + tX = value; + } + public void setOffsetY(final double value) { + tY = value; + } + + @Override + public String toSvg(final TransformStack transforms) { + final StringBuilder result = new StringBuilder(); + + //DEBUG: Add an indent and line break so visual parsing is easier. + String indent = "\n"; + for(int idx = transforms.depth(); idx >= 0; idx--) { + indent += " "; + } + + if(tX != 0.0 || tY != 0.0) { + transforms.push(tX, tY); + } + for(Entity child : components) { + result.append(indent); + result.append(child.toSvg(transforms)); + } + if(tX != 0.0 || tY != 0.0) { + transforms.pop(); + } + + return result.toString(); + } +} diff --git a/GM3/src/core/svg/svg/Curve.java b/GM3/src/core/svg/svg/Curve.java new file mode 100644 index 0000000..c1ac68c --- /dev/null +++ b/GM3/src/core/svg/svg/Curve.java @@ -0,0 +1,31 @@ +package core.svg.svg; + +import core.svg.Svg; +import javafx.geometry.Point2D; +import javafx.scene.paint.Color; + +public class Curve extends Entity { + private final javafx.scene.shape.CubicCurve source; + + public Curve(final javafx.scene.shape.CubicCurve source) { + this.source = source; + } + + @Override + public String toSvg(final TransformStack transforms) { + final Transform tr = transforms.get(); + Point2D[] arrPts = new Point2D[4]; + arrPts[0] = new Point2D(tr.getX() + source.getStartX(), tr.getY() + source.getStartY()); + arrPts[1] = new Point2D(tr.getX() + source.getControlX1(), tr.getY() + source.getControlY1()); + arrPts[2] = new Point2D(tr.getX() + source.getControlX2(), tr.getY() + source.getControlY2()); + arrPts[3] = new Point2D(tr.getX() + source.getEndX(), tr.getY() + source.getEndY()); + + return String.format("", + arrPts[0].getX(), arrPts[0].getY(), + arrPts[1].getX(), arrPts[1].getY(), + arrPts[2].getX(), arrPts[2].getY(), + arrPts[3].getX(), arrPts[3].getY(), + Svg.fromColor((Color) source.getStroke()), + source.getStrokeWidth()); + } +} diff --git a/GM3/src/core/svg/svg/Entity.java b/GM3/src/core/svg/svg/Entity.java new file mode 100644 index 0000000..5f1cb16 --- /dev/null +++ b/GM3/src/core/svg/svg/Entity.java @@ -0,0 +1,5 @@ +package core.svg.svg; + +public abstract class Entity { + public abstract String toSvg(final TransformStack transforms); +} diff --git a/GM3/src/core/svg/svg/Image.java b/GM3/src/core/svg/svg/Image.java new file mode 100644 index 0000000..87f9fa5 --- /dev/null +++ b/GM3/src/core/svg/svg/Image.java @@ -0,0 +1,62 @@ +package core.svg.svg; + +import javafx.geometry.Rectangle2D; +import javafx.scene.image.PixelFormat; +import javafx.scene.image.PixelReader; +import javafx.scene.image.WritablePixelFormat; +import sun.awt.image.IntegerComponentRaster; + +import javax.imageio.ImageIO; +import java.awt.image.BufferedImage; +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.nio.IntBuffer; +import java.util.Base64; + +public class Image extends Entity { + private final javafx.scene.image.ImageView image; + + public Image(final javafx.scene.image.ImageView image) { + this.image = image; + } + + @Override + public String toSvg(final TransformStack transforms) { + StringBuilder result = new StringBuilder(); + + result.append(""); + + return result.toString(); + } +} diff --git a/GM3/src/core/svg/svg/Line.java b/GM3/src/core/svg/svg/Line.java new file mode 100644 index 0000000..337988c --- /dev/null +++ b/GM3/src/core/svg/svg/Line.java @@ -0,0 +1,18 @@ +package core.svg.svg; + +import core.svg.Svg; +import javafx.scene.paint.Color; + +public class Line extends Entity { + private final javafx.scene.shape.Line source; + + public Line(final javafx.scene.shape.Line source) { + this.source = source; + } + + @Override + public String toSvg(final TransformStack transforms) { + final Transform tr = transforms.get(); + return ""; + } +} diff --git a/GM3/src/core/svg/svg/Polygon.java b/GM3/src/core/svg/svg/Polygon.java new file mode 100644 index 0000000..1c8b787 --- /dev/null +++ b/GM3/src/core/svg/svg/Polygon.java @@ -0,0 +1,33 @@ +package core.svg.svg; + +import core.svg.Svg; +import javafx.scene.paint.Color; + +public class Polygon extends Entity { + private final javafx.scene.shape.Polygon polygon; + + public Polygon(final javafx.scene.shape.Polygon polygon) { + this.polygon = polygon; + } + + @Override + public String toSvg(final TransformStack transforms) { + if(!polygon.isVisible() || polygon.getPoints().size() < 6) { + return ""; + } + + StringBuilder result = new StringBuilder(); + + result.append("", + Svg.fromColor((Color) polygon.getFill()), + ((Color) polygon.getFill()).getOpacity(), + Svg.fromColor((Color) polygon.getStroke()), + polygon.getStrokeWidth())); + + return result.toString(); + } +} diff --git a/GM3/src/core/svg/svg/Rectangle.java b/GM3/src/core/svg/svg/Rectangle.java new file mode 100644 index 0000000..6e36147 --- /dev/null +++ b/GM3/src/core/svg/svg/Rectangle.java @@ -0,0 +1,27 @@ +package core.svg.svg; + +import core.svg.Svg; +import javafx.scene.paint.Color; + +public class Rectangle extends Entity { + private final javafx.scene.shape.Rectangle rectangle; + + public Rectangle(final javafx.scene.shape.Rectangle rectangle) { + this.rectangle = rectangle; + } + + @Override + public String toSvg(final TransformStack transforms) { + return String.format("", + transforms.get().getX() + rectangle.getX(), + transforms.get().getY() + rectangle.getY(), + rectangle.getWidth(), + rectangle.getHeight(), + rectangle.getArcWidth(), + rectangle.getArcHeight(), + Svg.fromColor((Color) rectangle.getFill()), + ((Color) rectangle.getFill()).getOpacity(), + Svg.fromColor((Color) rectangle.getStroke()), + rectangle.getStrokeWidth()); + } +} diff --git a/GM3/src/core/svg/svg/Text.java b/GM3/src/core/svg/svg/Text.java new file mode 100644 index 0000000..be9df37 --- /dev/null +++ b/GM3/src/core/svg/svg/Text.java @@ -0,0 +1,23 @@ +package core.svg.svg; + +import core.svg.Svg; +import javafx.scene.paint.Color; + +public class Text extends Entity { + private final javafx.scene.text.Text text; + + public Text(final javafx.scene.text.Text text) { + this.text = text; + } + + @Override + public String toSvg(TransformStack transforms) { + return String.format("%s", + transforms.get().getX() + text.getLayoutX() + 2.0, + transforms.get().getY() + text.getLayoutY(), + Svg.fromColor((Color) text.getFill()), + Svg.XmlString(text.getFont().getFamily()), + (int)text.getFont().getSize(), + text.getText()); + } +} diff --git a/GM3/src/core/svg/svg/Transform.java b/GM3/src/core/svg/svg/Transform.java new file mode 100644 index 0000000..45386f4 --- /dev/null +++ b/GM3/src/core/svg/svg/Transform.java @@ -0,0 +1,24 @@ +package core.svg.svg; + +import javafx.geometry.Point2D; + +public final class Transform { + private final double tX; + private final double tY; + + public Transform(double x, double y) { + tX = x; + tY = y; + } + + public Point2D apply(Point2D point) { + return point.add(tX, tY); + } + + public double getX() { + return tX; + } + public double getY() { + return tY; + } +} diff --git a/GM3/src/core/svg/svg/TransformStack.java b/GM3/src/core/svg/svg/TransformStack.java new file mode 100644 index 0000000..b3251e5 --- /dev/null +++ b/GM3/src/core/svg/svg/TransformStack.java @@ -0,0 +1,33 @@ +package core.svg.svg; + +import javafx.geometry.Point2D; + +import java.util.Stack; + +public class TransformStack { + protected final Stack transforms; + + public TransformStack() { + transforms = new Stack<>(); + transforms.push(new Transform(0.0, 0.0)); + } + + public int depth() { + return transforms.size(); + } + public Transform get() { + return transforms.peek(); + } + public Transform pop() { + return transforms.pop(); + } + public Transform push(double tX, double tY) { + Transform top = transforms.peek(); + transforms.push(new Transform(top.getX() + tX, top.getY() + tY)); + return transforms.peek(); + } + + public Point2D apply(Point2D point) { + return transforms.peek().apply(point); + } +} diff --git a/GM3/src/ui/GrassMarlinFx.java b/GM3/src/ui/GrassMarlinFx.java index 9cfa54a..9129617 100644 --- a/GM3/src/ui/GrassMarlinFx.java +++ b/GM3/src/ui/GrassMarlinFx.java @@ -20,6 +20,7 @@ import javafx.beans.binding.When; import javafx.beans.property.*; import javafx.collections.ObservableList; +import javafx.event.Event; import javafx.geometry.Orientation; import javafx.scene.Node; import javafx.scene.Scene; @@ -33,7 +34,8 @@ import javafx.scene.layout.*; import javafx.stage.FileChooser; import javafx.stage.Stage; -import org.apache.commons.lang3.SystemUtils; +import javafx.stage.Window; +import javafx.stage.WindowEvent; import ui.custom.fx.ActiveButton; import ui.custom.fx.ActiveMenuItem; import ui.custom.fx.DynamicSubMenu; @@ -46,7 +48,8 @@ import util.Launcher; import util.Plugin; -import java.awt.*; +import java.awt.Toolkit; +import java.awt.Desktop; import java.io.*; import java.nio.file.Files; import java.nio.file.Path; @@ -124,7 +127,7 @@ public GrassMarlinFx() { tabController = new TabController(); fields = new BorderPane(); - dlgManageLogicalNetworks = new ManageLogicalNetworksDialogFx(); + dlgManageLogicalNetworks = ManageLogicalNetworksDialogFx.getInstance(); // Most of the initialization is handled in the start method. } @@ -153,6 +156,16 @@ public void start(Stage stage) { newDocument(); + stage.setOnCloseRequest(event -> { + if (document.get().isDirty()) { + event.consume(); + CheckSaveDocument(() -> { + document.get().dirtyProperty().setValue(false); + javafx.event.Event.fireEvent(stage, new WindowEvent((Window) event.getTarget(), event.getEventType())); + }); + } + }); + fields.setOnDragOver(event -> { if (event.getGestureSource() != this && event.getDragboard().hasFiles()) { event.acceptTransferModes(TransferMode.COPY_OR_MOVE); @@ -260,6 +273,7 @@ private void initComponents(Stage stage) { new SeparatorMenuItem(), new ActiveMenuItem("_Clear Topology", EmbeddedIcons.Vista_Refresh, (event) -> { document.get().clearTopology(); + tabController.clearTopology(); }).setAccelerator(KeyCodeCombination.CONTROL_DOWN, KeyCode.X), new SeparatorMenuItem(), new ActiveMenuItem("_Import Files...", EmbeddedIcons.Vista_Import, GrassMarlinFx.this::Handle_ShowImportDialog).setAccelerator(KeyCodeCombination.CONTROL_DOWN, KeyCode.I), @@ -270,7 +284,7 @@ private void initComponents(Stage stage) { }), new SeparatorMenuItem(), new ActiveMenuItem("E_xit", (action) -> { - stage.close(); + Event.fireEvent(stage, new WindowEvent(stage, WindowEvent.WINDOW_CLOSE_REQUEST)); }) ); } @@ -287,8 +301,8 @@ private void initComponents(Stage stage) { pathLog }); Logger.log(this, Severity.Success, "Displaying log file (" + pathLog + ") using " + viewerLog); - } catch(IOException | NullPointerException ex) { - Logger.log(this, Severity.Error, "Unable to display log file; Ensure the Text File viewer is correctly set in the Preferences (" + ex.getMessage() + ")"); + } catch(IOException ex) { + Logger.log(this, Severity.Error, "Unable to display log file: " + ex.getMessage()); } }), new SeparatorMenuItem(), @@ -298,7 +312,7 @@ private void initComponents(Stage stage) { new ActiveMenuItem("Logical _Connections Report", EmbeddedIcons.Vista_Report, (event) -> { new LogicalEdgeReportDialogFx(document.get().getLogicalGraph()).show(); }), - new ActiveMenuItem("Inter_group Connections Report", EmbeddedIcons.Vista_Report, event -> { + new ActiveMenuItem("Inter-_Group Connections Report", EmbeddedIcons.Vista_Report, event -> { new IntergroupConnectionReportDialogFx<>(document.get().getLogicalGraph()).show(); }), new SeparatorMenuItem(), @@ -392,12 +406,16 @@ private void initComponents(Stage stage) { header.getChildren().add(menu); cbPcapDevices = new ChoiceBox<>(); - cbPcapDevices.setItems(PcapDeviceList.get()); - if(cbPcapDevices.getItems().size() == 0) { - //If there are no pcap devices, disable pcap. - pcapAvailable.set(false); + if(pcapAvailable.get()) { + cbPcapDevices.setItems(PcapDeviceList.get()); + if (cbPcapDevices.getItems().size() == 0) { + //If there are no pcap devices, disable pcap. + pcapAvailable.set(false); + } else { + cbPcapDevices.getSelectionModel().select(0); + } } else { - cbPcapDevices.getSelectionModel().select(0); + cbPcapDevices.setDisable(true); } Pane paneToolbarSpacer = new Pane(); @@ -534,30 +552,19 @@ public void DisplayUserGuide() { String exec = Configuration.getPreferenceString(Configuration.Fields.PDF_VIEWER_EXEC); if (exec != null && !exec.isEmpty()) { // If the PDF Viewer path has been set, then use it, assuming that a single parameter for the PDF to open is accepted. - if(!Files.exists(Paths.get(exec))) { - Logger.log(this, Severity.Error, "Error opening User Guide: The PDF viewer specified in the PReferences dialog does not exist."); - return; - } try { Runtime.getRuntime().exec(new String[]{exec, path}); } catch (IOException ex) { - Logger.log(this, Severity.Error, "Error opening User Guide: " + ex.getMessage()); + Logger.log(this, Severity.Error, "Error opening User guide: " + ex.getMessage()); } } else { //PDF Viewer isn't set, so try desktop execute - if(SystemUtils.IS_OS_WINDOWS) { - if (Desktop.isDesktopSupported()) { - Logger.log(this, Severity.Warning, "PDF Viewer needs to be set in Preferences. Attempting fallback."); - try { - Desktop.getDesktop().open(fileMisc); - return; - } catch (IOException ex) { - Logger.log(Desktop.class, Severity.Error, "Unable to open User Guide (" + fileMisc.getPath() + "): " + ex.getMessage()); - return; - } - } + Logger.log(this, Severity.Warning, "PDF Viewer needs to be set in Preferences. Attempting fallback."); + try { + Desktop.getDesktop().open(fileMisc); + } catch (IOException ex) { + Logger.log(Desktop.class, Severity.Error, "Unable to open User Guide (" + fileMisc.getPath() + "): " + ex.getMessage()); } - Logger.log(this, Severity.Warning, "PDF Viewer needs to be set in Preferences. The user guide can be found at " + path + "."); } } catch(NullPointerException ex) { Logger.log(this, Severity.Error, "Unable to locate User Guide."); @@ -569,7 +576,6 @@ public void DisplayUserGuide() { * If the user elects to save, if a filename must be specified, then prompt as per "Save As...", otherwise Save * If the user declines to save, then return. * If the user cancels at any point, abort the save and return false. - * @return True if the user did not cancel, false otherwise. */ public void CheckSaveDocument(Runnable onSuccess) { if(document.get().isDirty()) { diff --git a/GM3/src/ui/TabController.java b/GM3/src/ui/TabController.java index 6f14559..50b40e3 100644 --- a/GM3/src/ui/TabController.java +++ b/GM3/src/ui/TabController.java @@ -1,5 +1,7 @@ package ui; +import com.sun.javafx.scene.control.behavior.TabPaneBehavior; +import com.sun.javafx.scene.control.skin.TabPaneSkin; import javafx.beans.property.SimpleStringProperty; import javafx.beans.value.ObservableValue; import javafx.scene.control.Tab; @@ -10,7 +12,9 @@ import java.util.Collection; import java.util.LinkedHashMap; +import java.util.List; import java.util.Map; +import java.util.stream.Collectors; /** * The TabController is responsible for managing the Tabs displayed in the main UI. @@ -86,6 +90,24 @@ public void clear() { paneTabs.getTabs().clear(); } + public void clearTopology() { + //Get all tabs that are closeable + List closable = paneTabs.getTabs().stream() + .filter(tab -> tab.isClosable()) + .collect(Collectors.toList()); + //remove graphs + closable.forEach(tab -> graphFromTabs.remove(tab)); + //close tabs + closable.forEach(tab -> { + if (tab.getTabPane().getSkin() instanceof TabPaneSkin) { + TabPaneBehavior behavior = ((TabPaneSkin) tab.getTabPane().getSkin()).getBehavior(); + if (behavior.canCloseTab(tab)) { + behavior.closeTab(tab); + } + } + }); + } + public Collection getGraphs() { return graphFromTabs.values(); } diff --git a/GM3/src/ui/custom/fx/Log10DoubleBinding.java b/GM3/src/ui/custom/fx/Log10DoubleBinding.java index 8793caf..54373d6 100644 --- a/GM3/src/ui/custom/fx/Log10DoubleBinding.java +++ b/GM3/src/ui/custom/fx/Log10DoubleBinding.java @@ -17,6 +17,6 @@ public Log10DoubleBinding(NumberBinding source) { @Override public double computeValue() { - return Math.log10(source.getValue().doubleValue()); + return Math.max(Math.log10(source.getValue().doubleValue()), 1); } } diff --git a/GM3/src/ui/custom/fx/ScalableChartWrapper.java b/GM3/src/ui/custom/fx/ScalableChartWrapper.java index 3c20e74..ba9d68d 100644 --- a/GM3/src/ui/custom/fx/ScalableChartWrapper.java +++ b/GM3/src/ui/custom/fx/ScalableChartWrapper.java @@ -1,6 +1,8 @@ package ui.custom.fx; import com.sun.javafx.collections.ObservableListWrapper; +import core.logging.Severity; +import core.svg.Svg; import javafx.collections.ObservableList; import javafx.geometry.Insets; import javafx.geometry.Point2D; @@ -12,12 +14,18 @@ import javafx.scene.paint.Color; import javafx.scene.shape.Circle; import javafx.scene.shape.Rectangle; +import javafx.stage.FileChooser; import util.Wireshark; +import java.io.BufferedWriter; +import java.io.File; +import java.io.FileWriter; +import java.io.IOException; import java.time.Instant; import java.time.ZoneId; import java.time.format.DateTimeFormatter; -import java.util.*; +import java.util.LinkedList; +import java.util.List; public class ScalableChartWrapper extends GridPane { protected class LegendEntry extends HBox { @@ -184,6 +192,23 @@ private void initComponents() { menu.getItems().addAll( + new ActiveMenuItem("_Export to SVG...", (event) -> { + final FileChooser dlgExportTo = new FileChooser(); + dlgExportTo.getExtensionFilters().addAll( + new FileChooser.ExtensionFilter("SVG Image Files (*.svg)", "*.svg"), + new FileChooser.ExtensionFilter("All Files", "*") + ); + final File exportTo = dlgExportTo.showSaveDialog(ScalableChartWrapper.this.getScene().getWindow()); + if(exportTo != null) { + try(BufferedWriter writer = new BufferedWriter(new FileWriter(exportTo))) { + writer.write( + Svg.serialize(ScalableChartWrapper.this).replaceAll("(\\s+\\n)+", "\n") + ); + } catch(IOException ex) { + core.logging.Logger.log(this, Severity.Error, "There was an error exporting the graph: " + ex.getMessage()); + } + } + }), new ActiveMenuItem("_Reset Zoom", (event) -> this.zoomReset()), new ActiveMenuItem("_Undo Zoom", (event) -> this.zoomPrevious()) .bindEnabled(new ListSizeBinding(zoomHistory).greaterThan(0)), diff --git a/GM3/src/ui/dialog/ConnectionDetailsDialogFx.java b/GM3/src/ui/dialog/ConnectionDetailsDialogFx.java index b94c03d..c24f559 100644 --- a/GM3/src/ui/dialog/ConnectionDetailsDialogFx.java +++ b/GM3/src/ui/dialog/ConnectionDetailsDialogFx.java @@ -11,6 +11,11 @@ import javafx.scene.chart.XYChart; import javafx.scene.control.*; import javafx.scene.control.cell.PropertyValueFactory; +import javafx.scene.layout.HBox; +import javafx.scene.layout.Pane; +import javafx.scene.layout.Priority; +import javafx.scene.layout.VBox; +import javafx.stage.FileChooser; import javafx.stage.Stage; import javafx.stage.Window; import ui.EmbeddedIcons; @@ -19,8 +24,10 @@ import ui.custom.fx.ChartPacketBytesOverTime; import ui.custom.fx.ScalableChartWrapper; import util.Cidr; +import util.Csv; import util.Wireshark; +import java.io.File; import java.time.Instant; import java.time.ZoneId; import java.time.ZonedDateTime; @@ -120,6 +127,7 @@ private void initComponents() { SplitPane pane = new SplitPane(); pane.setOrientation(Orientation.VERTICAL); + final VBox containerTable = new VBox(); TableView tbl = new TableView<>(); TableColumn colTimestamp = new TableColumn<>("Timestamp"); @@ -168,7 +176,29 @@ private void initComponents() { ); tbl.setContextMenu(menuTbl); - pane.getItems().addAll(tbl, chartControl); + final HBox toolbarTable = new HBox(); + final Pane spacerToolbar = new Pane(); + HBox.setHgrow(spacerToolbar, Priority.ALWAYS); + + final Button btnExportToCsv = new Button("Export CSV...", EmbeddedIcons.Vista_Save.getImage(16.0)); + btnExportToCsv.setOnAction(event -> { + final FileChooser dlgSave = new FileChooser(); + dlgSave.setTitle("Export To..."); + dlgSave.getExtensionFilters().addAll( + new FileChooser.ExtensionFilter("CSV Files (*.csv)", "*.csv"), + new FileChooser.ExtensionFilter("Data Files (*.csv, *.xls, *.xlsx, *.xml, *.prn, *ods)", "*.csv", "*.xls", "*.xlsx", "*.xml", "*.prn", "*.ods"), + new FileChooser.ExtensionFilter("All Files", "*") + ); + + File result = dlgSave.showSaveDialog(this.getOwner()); + if(result != null) { + Csv.ExportTableToFile(tbl, result); + } + }); + + toolbarTable.getChildren().addAll(spacerToolbar, btnExportToCsv); + containerTable.getChildren().addAll(toolbarTable, tbl); + pane.getItems().addAll(containerTable, chartControl); this.getDialogPane().setContent(pane); this.getDialogPane().getButtonTypes().addAll(ButtonType.CLOSE); } @@ -199,6 +229,7 @@ protected void Handle_RootNodeChanged(Observable o, LogicalNode rootOld, Logical chartControl.suspendLayout(true); try { chartControl.clearSeries(); + chartControl.zoomReset(); if (rootNew == null) { return; diff --git a/GM3/src/ui/dialog/LogicalNodeReportDialogFx.java b/GM3/src/ui/dialog/LogicalNodeReportDialogFx.java index 9580bda..0ab60f2 100644 --- a/GM3/src/ui/dialog/LogicalNodeReportDialogFx.java +++ b/GM3/src/ui/dialog/LogicalNodeReportDialogFx.java @@ -88,7 +88,7 @@ private void initComponents() { ) ); }); - optSource.setOnAction(event -> { + optDestination.setOnAction(event -> { nodesFiltered.setPredicate(logicalNode -> network.get().getEdgesInvolving(logicalNode).stream() .anyMatch(edge -> diff --git a/GM3/src/ui/dialog/ManageLogicalNetworksDialogFx.java b/GM3/src/ui/dialog/ManageLogicalNetworksDialogFx.java index 71c8a00..ee3a0b7 100644 --- a/GM3/src/ui/dialog/ManageLogicalNetworksDialogFx.java +++ b/GM3/src/ui/dialog/ManageLogicalNetworksDialogFx.java @@ -18,11 +18,13 @@ import java.util.List; public class ManageLogicalNetworksDialogFx extends Dialog { + private static ManageLogicalNetworksDialogFx instance = null; + private final ListView viewCidrs; private final TextField txtNewCidr; private final Button btnAddCidr; - public ManageLogicalNetworksDialogFx() { + private ManageLogicalNetworksDialogFx() { viewCidrs = new ListView<>(); txtNewCidr = new TextField(""); @@ -31,6 +33,14 @@ public ManageLogicalNetworksDialogFx() { initComponents(); } + public static ManageLogicalNetworksDialogFx getInstance() { + if (instance == null) { + instance = new ManageLogicalNetworksDialogFx(); + } + + return instance; + } + private void initComponents() { setTitle("Logical Networks"); Window stage = super.getDialogPane().getScene().getWindow(); diff --git a/GM3/src/ui/dialog/PreferencesDialogFx.java b/GM3/src/ui/dialog/PreferencesDialogFx.java index 0832687..cc73c28 100644 --- a/GM3/src/ui/dialog/PreferencesDialogFx.java +++ b/GM3/src/ui/dialog/PreferencesDialogFx.java @@ -196,9 +196,12 @@ private void initComponents() { } public void reloadValues() { - pathWireshark.set(Configuration.getPreferenceString(Configuration.Fields.WIRESHARK_EXEC)); - pathTextEditor.set(Configuration.getPreferenceString(Configuration.Fields.TEXT_EDITOR_EXEC)); - pathPdfViewer.set(Configuration.getPreferenceString(Configuration.Fields.PDF_VIEWER_EXEC)); + String ws = Configuration.getPreferenceString(Configuration.Fields.WIRESHARK_EXEC); + String te = Configuration.getPreferenceString(Configuration.Fields.TEXT_EDITOR_EXEC); + String pdf = Configuration.getPreferenceString(Configuration.Fields.PDF_VIEWER_EXEC); + pathWireshark.set(ws == null ? "" : ws); + pathTextEditor.set(te == null ? "" : te); + pathPdfViewer.set(pdf == null ? "" : pdf); colorNewNode.set(Color.web(Configuration.getPreferenceString(Configuration.Fields.COLOR_NODE_NEW))); colorModifiedNode.set(Color.web(Configuration.getPreferenceString(Configuration.Fields.COLOR_NODE_MODIFIED))); @@ -216,14 +219,14 @@ public void reloadValues() { public Map getUpdatedValues() { HashMap updatedValues = new HashMap<>(); - if(pathWireshark.get() == null || !pathWireshark.get().equals(Configuration.getPreferenceString(Configuration.Fields.WIRESHARK_EXEC))) { - updatedValues.put(Configuration.Fields.WIRESHARK_EXEC, pathWireshark.get()); + if(Configuration.getPreferenceString(Configuration.Fields.WIRESHARK_EXEC) == null || !pathWireshark.get().equals(Configuration.getPreferenceString(Configuration.Fields.WIRESHARK_EXEC))) { + updatedValues.put(Configuration.Fields.WIRESHARK_EXEC, pathWireshark.get().equals("") ? null : pathWireshark.get()); } - if(pathTextEditor.get() == null || !pathTextEditor.get().equals(Configuration.getPreferenceString(Configuration.Fields.TEXT_EDITOR_EXEC))) { - updatedValues.put(Configuration.Fields.TEXT_EDITOR_EXEC, pathTextEditor.get()); + if(Configuration.getPreferenceString(Configuration.Fields.TEXT_EDITOR_EXEC) == null|| !pathTextEditor.get().equals(Configuration.getPreferenceString(Configuration.Fields.TEXT_EDITOR_EXEC))) { + updatedValues.put(Configuration.Fields.TEXT_EDITOR_EXEC, pathTextEditor.get().equals("") ? null : pathTextEditor.get()); } - if(pathPdfViewer.get() == null || !pathPdfViewer.get().equals(Configuration.getPreferenceString(Configuration.Fields.PDF_VIEWER_EXEC))) { - updatedValues.put(Configuration.Fields.PDF_VIEWER_EXEC, pathPdfViewer.get()); + if(Configuration.getPreferenceString(Configuration.Fields.PDF_VIEWER_EXEC) == null || !pathPdfViewer.get().equals(Configuration.getPreferenceString(Configuration.Fields.PDF_VIEWER_EXEC))) { + updatedValues.put(Configuration.Fields.PDF_VIEWER_EXEC, pathPdfViewer.get().equals("") ? null : pathWireshark.get()); } // Colors give AARRGGBB, we want only RGB diff --git a/GM3/src/ui/dialog/importmanager/ImportDialog.java b/GM3/src/ui/dialog/importmanager/ImportDialog.java index ad514d2..ba4075a 100644 --- a/GM3/src/ui/dialog/importmanager/ImportDialog.java +++ b/GM3/src/ui/dialog/importmanager/ImportDialog.java @@ -157,7 +157,10 @@ private void initComponents() { row.getItem().setType(processor); }) ).collect(Collectors.toList()) - ) + ), + new ActiveMenuItem("Remove", event -> { + document.get().removePendingImport(row.getItem()); + }) ); row.contextMenuProperty().bind(new When(row.emptyProperty()).then((ContextMenu)null).otherwise(menuRow)); diff --git a/GM3/src/ui/fingerprint/FingerPrintGui.java b/GM3/src/ui/fingerprint/FingerPrintGui.java index 3355287..fdbbb3a 100644 --- a/GM3/src/ui/fingerprint/FingerPrintGui.java +++ b/GM3/src/ui/fingerprint/FingerPrintGui.java @@ -6,6 +6,8 @@ import core.fingerprint.FingerprintState; import core.fingerprint3.Fingerprint; import core.fingerprint3.ObjectFactory; +import core.logging.Logger; +import core.logging.Severity; import javafx.application.Application; import javafx.application.Platform; import javafx.beans.binding.Bindings; @@ -105,6 +107,7 @@ public void start(Stage primaryStage) throws Exception{ FPItem item = createTree(fp); return item; }) + .filter(item -> item != null) .collect(Collectors.toList()); this.rootItem.getChildren().addAll(items); @@ -431,13 +434,17 @@ private void processFingerprintAdded(List added) { TreeItem firstNewItem = null; for (FingerprintState fingerprint : added) { FPItem item = createTree(fingerprint); - this.rootItem.getChildren().add(item); - this.rootItem.getChildren().sort((ti1, ti2) -> ti1.getValue().compareTo(ti2.getValue())); - if (null == firstNewItem) { - firstNewItem = item; + if (item != null) { + this.rootItem.getChildren().add(item); + this.rootItem.getChildren().sort((ti1, ti2) -> ti1.getValue().compareTo(ti2.getValue())); + if (null == firstNewItem) { + firstNewItem = item; + } } } - this.tree.getSelectionModel().select(firstNewItem); + if (null != firstNewItem) { + this.tree.getSelectionModel().select(firstNewItem); + } } private FPItem createTree(FingerprintState fpState) { @@ -446,20 +453,25 @@ private FPItem createTree(FingerprintState fpState) { Fingerprint fp = fpState.getFingerprint(); FPItem item = new FPItem(fpState); - fp.getPayload().forEach(payload -> { + for (Fingerprint.Payload payload : fp.getPayload()) { PayloadItem payloadItem = new PayloadItem(payload); payloadMap.put(payload.getFor(), payloadItem); item.getChildren().add(payloadItem); - }); - fp.getFilter().forEach(group -> { + } + for (Fingerprint.Filter group : fp.getFilter()) { FilterGroupItem groupItem = new FilterGroupItem(group.getName()); group.getAckAndMSSAndDsize().forEach(filter -> { FilterItem newFilter = new FilterItem(Filter.FilterType.valueOf(filter.getName().toString().replaceAll(" ", "").toUpperCase()), group.getAckAndMSSAndDsize().indexOf(filter), this, filter); groupItem.getChildren().add(newFilter); }); PayloadItem payload = payloadMap.get(group.getFor()); - payload.getChildren().add(groupItem); - }); + if (payload != null) { + payload.getChildren().add(groupItem); + } else { + Logger.log(this, Severity.Warning, "Malformed Fingerprint: Filter group without payload"); + item = null; + } + } return item; } @@ -755,6 +767,11 @@ public static void selectAll(TextField field) { }); } + public void updatePayloadDescription(PayloadItem payload, String description) { + FPItem fp = getFPItem(payload); + this.document.updatePayloadDescription(fp.getName(), fp.pathProperty().get(), payload.getPayload().getFor(), description); + } + public void updateAlways(PayloadItem payload, Fingerprint.Payload.Always always) { FPItem fp = getFPItem(payload); this.document.updateAlways(fp.getName(), fp.pathProperty().get(), payload.getPayload().getFor(), always); diff --git a/GM3/src/ui/fingerprint/editorPanes/ExtractDialog.java b/GM3/src/ui/fingerprint/editorPanes/ExtractDialog.java index 999e346..e1b1fa3 100644 --- a/GM3/src/ui/fingerprint/editorPanes/ExtractDialog.java +++ b/GM3/src/ui/fingerprint/editorPanes/ExtractDialog.java @@ -13,6 +13,7 @@ import javafx.scene.layout.Pane; import javafx.scene.layout.Priority; import javafx.scene.layout.VBox; +import ui.fingerprint.FingerPrintGui; import ui.fingerprint.payload.Endian; import java.util.ArrayList; @@ -151,7 +152,7 @@ public ExtractRow(Extract extract, VBox parent) { this.from = extract.getFrom(); this.to = extract.getTo(); this.maxLength = extract.getMaxLength(); - this.endian = Endian.valueOf(extract.getEndian() != null ? extract.getEndian() : "BIG"); + this.endian = extract.getEndian() != null ? Endian.valueOf(extract.getEndian()) : Endian.getDefault(); this.post = extract.getPost(); } @@ -219,7 +220,7 @@ public ExtractRow(Extract extract, VBox parent) { fromPositionField.textProperty().addListener((observable, oldValue, newValue) -> { if (newValue == null || newValue.isEmpty()) { fromPositionField.setText("0"); - fromPositionField.selectAll(); + FingerPrintGui.selectAll(fromPositionField); } else { try { long index = Long.parseLong(newValue); @@ -266,7 +267,7 @@ public ExtractRow(Extract extract, VBox parent) { toPositionField.textProperty().addListener((observable, oldValue, newValue) -> { if (newValue == null || newValue.isEmpty()) { toPositionField.setText("0"); - toPositionField.selectAll(); + FingerPrintGui.selectAll(toPositionField); } else { try { long index = Long.parseLong(newValue); @@ -289,7 +290,7 @@ public ExtractRow(Extract extract, VBox parent) { HBox maxLengthBox = new HBox(2); Label maxLengthLabel = new Label("Max Length:"); - TextField maxLengthField = new TextField(Integer.toString(DEFAULT_MAX_LENGTH)); + TextField maxLengthField = new TextField(Integer.toString(this.maxLength)); maxLengthField.textProperty().addListener((observable, oldValue, newValue) -> { if (newValue == null || newValue.isEmpty()) { maxLengthField.setText("0"); @@ -299,6 +300,8 @@ public ExtractRow(Extract extract, VBox parent) { int length = Integer.parseInt(newValue); if (length < MIN_MAX_LENGTH || length > MAX_MAX_LENGTH) { maxLengthField.setText(oldValue); + } else { + this.maxLength = length; } } catch (NumberFormatException e) { maxLengthField.setText(oldValue); @@ -312,7 +315,8 @@ public ExtractRow(Extract extract, VBox parent) { HBox endianBox = new HBox(2); Label endianLabel = new Label("Endian:"); ChoiceBox endianChoiceBox = new ChoiceBox<>(FXCollections.observableArrayList(Endian.values())); - endianChoiceBox.setValue(Endian.BIG); + endianChoiceBox.setValue(this.endian); + endianChoiceBox.valueProperty().addListener(observable -> this.endian = endianChoiceBox.getValue()); endianBox.setAlignment(Pos.CENTER_LEFT); endianBox.getChildren().addAll(endianLabel, endianChoiceBox); diff --git a/GM3/src/ui/fingerprint/editorPanes/PayloadEditorPane.java b/GM3/src/ui/fingerprint/editorPanes/PayloadEditorPane.java index 7424166..344ae5a 100644 --- a/GM3/src/ui/fingerprint/editorPanes/PayloadEditorPane.java +++ b/GM3/src/ui/fingerprint/editorPanes/PayloadEditorPane.java @@ -29,6 +29,7 @@ public class PayloadEditorPane extends BorderPane implements ParentBox { private SimpleBooleanProperty hasAlways; private VBox childrenBox; private List children; + private TextField descField; private boolean loading; private PayloadEditorPane(PayloadItem item, FingerPrintGui gui) { @@ -46,13 +47,18 @@ private void buildPane() { HBox descBox = new HBox(2); Label descLabel = new Label("Description:"); - TextField descField = new TextField(this.boundItem.getDescription()); + descField = new TextField(this.boundItem.getDescription()); descBox.setAlignment(Pos.CENTER_LEFT); HBox.setHgrow(descField, Priority.ALWAYS); descBox.getChildren().addAll(descLabel, descField); descBox.setPadding(new Insets(0, 0, 10, 0)); + descField.textProperty().addListener(observable -> { + this.boundItem.getPayload().setDescription(descField.getText()); + update(); + }); + this.setTop(descBox); this.setCenter(childrenBox); @@ -110,6 +116,7 @@ public void removeChild(OpRow child) { if (child instanceof AlwaysRow) { this.gui.updateAlways(boundItem, null); this.boundItem.getPayload().setAlways(null); + this.hasAlways.set(false); } this.children.remove(child); } @@ -138,6 +145,7 @@ public void update() { .collect(Collectors.toList()); this.gui.updateOperations(boundItem, operationList); + this.gui.updatePayloadDescription(boundItem, this.descField.getText()); this.boundItem.getPayload().getOperation().clear(); this.boundItem.getPayload().getOperation().addAll(operationList); } diff --git a/GM3/src/ui/fingerprint/filters/TransportProtoFilter.java b/GM3/src/ui/fingerprint/filters/TransportProtoFilter.java index e4d24fe..8a03aea 100644 --- a/GM3/src/ui/fingerprint/filters/TransportProtoFilter.java +++ b/GM3/src/ui/fingerprint/filters/TransportProtoFilter.java @@ -51,7 +51,7 @@ public HBox getInput() { Label protoLabel = new Label("Protocol:"); ChoiceBox protoBox = new ChoiceBox<>(FXCollections.observableArrayList(supportedProtocols.keySet())); protoBox.setConverter(new ProtocolConverter()); - protoBox.setValue(TCP_PROTO_NUM); + protoBox.setValue(this.proto); protoBox.valueProperty().addListener(change -> { proto = protoBox.getValue(); diff --git a/GM3/src/ui/fingerprint/filters/WindowFilter.java b/GM3/src/ui/fingerprint/filters/WindowFilter.java index 19a36ee..bf174e8 100644 --- a/GM3/src/ui/fingerprint/filters/WindowFilter.java +++ b/GM3/src/ui/fingerprint/filters/WindowFilter.java @@ -9,20 +9,21 @@ import ui.fingerprint.FingerPrintGui; import javax.xml.bind.JAXBElement; +import java.math.BigInteger; -public class WindowFilter implements Filter { - private final static int MAX_VALUE = 255; +public class WindowFilter implements Filter { + private final static int MAX_VALUE = 1073725440; private final static int MIN_VALUE = 0; ObjectFactory factory; - short value; - SimpleObjectProperty> element; + BigInteger value; + SimpleObjectProperty> element; - public WindowFilter(JAXBElement value) { + public WindowFilter(JAXBElement value) { factory = new ObjectFactory(); element = new SimpleObjectProperty<>(); if (null == value) { - this.value = 0; + this.value = new BigInteger("0"); element.setValue(factory.createFingerprintFilterWindow(this.value)); } else { this.value = value.getValue(); @@ -40,14 +41,14 @@ public HBox getInput() { HBox input = new HBox(); Label windowLabel = new Label("Value:"); - TextField windowField = new TextField(Short.toString(value)); + TextField windowField = new TextField(value.toString()); windowField.textProperty().addListener((observable, oldValue, newValue) -> { if (!oldValue.equals(newValue)) { //don't allow wrong entries try { - short newWindow = Short.parseShort(newValue); - if (newWindow > MAX_VALUE || newWindow < MIN_VALUE) { + BigInteger newWindow = new BigInteger(newValue); + if (newWindow.intValue() > MAX_VALUE || newWindow.intValue() < MIN_VALUE) { windowField.setText(oldValue); } else { value = newWindow; @@ -83,7 +84,7 @@ public FilterType getType() { } @Override - public SimpleObjectProperty> elementProperty() { + public SimpleObjectProperty> elementProperty() { return element; } } diff --git a/GM3/src/ui/graphing/CellGroup.java b/GM3/src/ui/graphing/CellGroup.java index 9d2b3cf..72fd437 100644 --- a/GM3/src/ui/graphing/CellGroup.java +++ b/GM3/src/ui/graphing/CellGroup.java @@ -207,8 +207,7 @@ protected static List BuildHullFor(List points) { ptsPolygon.push(points.get(idxPoint)); } for(int idxPoint = points.size() - 2; idxPoint >= 0; idxPoint--) { - while(ptsPolygon.size() >= 2 && ptsPolygon.get(ptsPolygon.size() - 1).subtract(ptsPolygon.get(ptsPolygon.size() - 2)) - .crossProduct(points.get(idxPoint).subtract(ptsPolygon.get(ptsPolygon.size() - 2))).getZ() <= 0) { + while(ptsPolygon.size() >= 2 && ptsPolygon.get(ptsPolygon.size() - 1).subtract(ptsPolygon.get(ptsPolygon.size() - 2)).crossProduct(points.get(idxPoint).subtract(ptsPolygon.get(ptsPolygon.size() - 2))).getZ() <= 0) { ptsPolygon.pop(); } ptsPolygon.push(points.get(idxPoint)); diff --git a/GM3/src/ui/graphing/GraphTreeItem.java b/GM3/src/ui/graphing/GraphTreeItem.java index 36fe932..c3e43eb 100644 --- a/GM3/src/ui/graphing/GraphTreeItem.java +++ b/GM3/src/ui/graphing/GraphTreeItem.java @@ -85,6 +85,7 @@ public TEdge getEdge() { } private boolean initialized = false; + private String name; protected GraphTreeItem() { super(); @@ -92,9 +93,15 @@ protected GraphTreeItem() { protected GraphTreeItem(String title, EmbeddedIcons image) { super(title, image == null ? null : image.getImage(16.0)); + this.name = title; + valueProperty().bind(new ReadOnlyStringWrapper(title).concat(" (").concat(new ListSizeBinding(getChildren())).concat(" item[s])")); } + public String getName() { + return this.name; + } + public boolean requiresInitialization() { return !initialized; } diff --git a/GM3/src/ui/graphing/graphs/LogicalGraph.java b/GM3/src/ui/graphing/graphs/LogicalGraph.java index e57c11d..ec87e5e 100644 --- a/GM3/src/ui/graphing/graphs/LogicalGraph.java +++ b/GM3/src/ui/graphing/graphs/LogicalGraph.java @@ -10,6 +10,7 @@ import javafx.scene.control.TextInputDialog; import ui.custom.fx.ActiveMenuItem; import ui.dialog.ConnectionDetailsDialogFx; +import ui.dialog.ManageLogicalNetworksDialogFx; import ui.graphing.Cell; import ui.graphing.FactoryLayoutableCells; import ui.graphing.FactoryTreeItemsLogical; @@ -22,7 +23,6 @@ import java.io.IOException; import java.util.List; -import java.util.Optional; import java.util.zip.ZipOutputStream; public class LogicalGraph extends Graph { @@ -88,23 +88,7 @@ public Cell uiFor(LogicalNode logicalNode) { }); MenuItem miAddSubnet = new ActiveMenuItem("Add Subnet Group", event -> { - TextInputDialog dlgNewCidr = new TextInputDialog("Add Cidr"); - Optional result = dlgNewCidr.showAndWait(); - if(result.isPresent()) { - String txtNew = result.get(); - try { - Cidr cidrNew = new Cidr(txtNew); - if (!cidrs.add(cidrNew)) { - for(Cidr cidr : cidrs) { - if(cidr.overlaps(cidrNew)) { - Logger.log(this, Severity.Error, "Failed: " + txtNew + " conflicts with " + cidr.toString()); - } - } - } - } catch(Exception ex) { - Logger.log(this, Severity.Error, "Unable to add Cidr: " + ex.getMessage()); - } - } + ManageLogicalNetworksDialogFx.getInstance().showAndWait(); }); menuGraph.add(miAddSubnet); } diff --git a/GM3/src/ui/graphing/physical/PhysicalGraphTreeController.java b/GM3/src/ui/graphing/physical/PhysicalGraphTreeController.java index 44ce39b..4775578 100644 --- a/GM3/src/ui/graphing/physical/PhysicalGraphTreeController.java +++ b/GM3/src/ui/graphing/physical/PhysicalGraphTreeController.java @@ -79,7 +79,7 @@ public GraphTreeItem.GraphTreeNodeItem createVlanNod @Override protected void initializeGroup(GraphTreeItem.GraphTreeGroupItem nodeGroup) { - String nameGroup = nodeGroup.getValue(); + String nameGroup = nodeGroup.getName(); TreeItem root = rootClouds; if(devices.stream().filter(device -> device.nameProperty().get().equals(nameGroup)).findAny().isPresent()) { diff --git a/GM3/src/util/Csv.java b/GM3/src/util/Csv.java index 33e5a52..fc38bf7 100644 --- a/GM3/src/util/Csv.java +++ b/GM3/src/util/Csv.java @@ -56,7 +56,8 @@ public static void ExportTableToFile(TableView table, File destinat writer.write(","); } bFirst = false; - writer.write(fieldFromString(col.getCellObservableValue(row).getValue().toString())); + String fieldValue = col.getCellObservableValue(row).getValue() != null ? col.getCellObservableValue(row).getValue().toString() : ""; + writer.write(fieldFromString(fieldValue)); } writer.newLine(); } diff --git a/GM3/src/util/Launcher.java b/GM3/src/util/Launcher.java index 7d8461e..bf189f1 100644 --- a/GM3/src/util/Launcher.java +++ b/GM3/src/util/Launcher.java @@ -78,14 +78,16 @@ public static void main(String[] args) { } } - try { - // If jnetpcap can't be found then loadLibrary will result in an exception - System.loadLibrary("jnetpcap"); - Pcap.libVersion(); - } catch (Error | Exception var3) { - //We won't be able to do offline pcap either, but there are no hooks (yet) to prevent this. - Logger.log(Launcher.class, Severity.Warning, "Unable to initialize JNetPCap; packet capture functionality will be disabled."); - allowPcap = false; + if(allowPcap) { + try { + // If jnetpcap can't be found then loadLibrary will result in an exception + System.loadLibrary("jnetpcap"); + Pcap.libVersion(); + } catch (Error | Exception var3) { + //We won't be able to do offline pcap either, but there are no hooks (yet) to prevent this. + Logger.log(Launcher.class, Severity.Warning, "Unable to initialize JNetPCap; packet capture functionality will be disabled."); + allowPcap = false; + } } if(!Files.exists(Paths.get(Configuration.getPreferenceString(Configuration.Fields.WIRESHARK_EXEC)))) {