Process the GRE payload

[Carter Bullard]

Your patch seems to be based on an earler version of argus
(2011-02-25 dated ArgusModeler.c) ?? Were you using argus-3.0.8
as a base ??  

I’ll push out argus-3.0.8.1 or argus-3.0.9 in a few weeks, which will
have your fix, and announce on the list.

Carter


> On Apr 2, 2015, at 12:54 PM, MING FU <fuming188 at yahoo.ca> wrote:
> 
> Hi Carter,
> 
> 
> I sure will test it. Just point me to the new code. 
> 
> Thanks,
> Ming
> 
> 
> ----- Original Message -----
> From: Carter Bullard <carter at qosient.com>
> To: MING FU <fuming188 at yahoo.ca>
> Cc: Argus <argus-info at lists.andrew.cmu.edu>
> Sent: Thursday, April 2, 2015 12:10 PM
> Subject: Re: [ARGUS] Process the GRE payload
> 
> Hey Ming,
> I’ve modified your patch so that we deal with any occurence of
> ETHERTYPE_TRANSPARENT_BRIDGE protocol packets, whether it comes
> from GRE or whatever tunnels.
> 
> So the processing is done in ArgusProcessPacketHdrs() rather
> than in ArgusProcessGreHdr().  If you can test this when I
> put out the next version, that would be great !!!
> 
> Thanks again for your patch !!!!
> Carter
> 
> 
>> On Mar 31, 2015, at 1:52 PM, MING FU <fuming188 at yahoo.ca> wrote:
>> 
>> Hi,
>> 
>> I was using argus to monitor the L3 SPAN from VMWare. The VMWare sends the packet from its virtual LAN wrapped in GRE tunnel to the monitor port. The GRE Header type field is 0x6558. The GRE payload is the original packet from the virtual LAN start from the Ethernet header. The ArgusProcessGreHdr should return Ethernet for the tunnel payload to be recoganized as Ethernet.
>> 
>> Here is a patch for this change:
>> 
>> --- dist-plain/argus/ArgusModeler.c2011-02-25 18:36:33.000000000 +0000
>> +++ dist-track/argus/ArgusModeler.c2015-03-31 17:25:12.000000000 +0000
>> @@ -809,6 +809,8 @@
>> #define GRE_RECRS       0x0700          /* recursion count */
>> #define GRE_AP          0x0080          /* acknowledgment# present */
>> 
>> +#define GRE_TRANSPARENT_ETHERNET_BRIDGING       0x6558 /* VMWare L3 SPAN */
>> +
>> int
>> ArgusProcessGreHdr (struct ArgusModelerStruct *model, struct ip *ip, int length)
>> {
>> @@ -897,6 +899,16 @@
>>   ArgusDebug (8, "ArgusProcessGreHdr(%p, %p, %d) returning 0x%x\n", model, ip, length, retn);
>> #endif 
>> 
>> +   switch (retn) {
>> +   case GRE_TRANSPARENT_ETHERNET_BRIDGING:
>> +#ifdef ARGUSDEBUG
>> +   ArgusDebug (8, "VMWare L3 SPAN GRE decap.\n");
>> +#endif 
>> +        retn = ARGUS_ETHER_HDR;
>> +        break;
>> +   default:
>> +       break;
>> +   }
>>   return (retn);
>> 
>> }
>> 
>> Regards,
>> Ming
>> 
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6837 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20150402/0915e910/attachment.bin>