Lua Tap plugin does not see all TLS Change Cipher Spec messages

asked 2024-07-17 15:04:36 +0000

studersi
3 ●1

I am attempting to implement a Lua Tap plugin to count the number of Change Cipher Spec messages sent by the client in an attempt to detect a certain type of Layer 7 DDoS attack.

The DDoS attack is described here: https://kb.mazebolt.com/knowledgebase... (a PCAP file is also accessible on this page).

If I open the PCAP file provided on the above mentioned page and apply the following filter, a total of 252 out of 1323 packets are shown: tls.record.content_type == 20. This appears to be correct.

When I attempt something similar in a Lua Tap plugin, however (see pseudocode below), I get a different result.

packet_change_cipher_spec = 0
f_tls_record_content_type = Field.new("tls.record.content_type")

function tap.packet(pinfo,tvb,tapinfo)
    local tls_record_content_type = f_tls_record_content_type()
    if tls_record_content_type and tls_record_content_type.value == 20 then
        packet_change_cipher_spec = packet_change_cipher_spec + 1
    end
end

Only half the packets are counted: 126.

It appears that the packets generally contain multiple TLS messages and tls_record_content_type.value contains the first of these messages, which in half the cases is not 20 but 22 instead.

I could not find a way to access the other TLS messages for a packet, though, it appears that Wireshark is perfectly capable of doing so, since they are all shown and dissected in the GUI.

Do I have to access these values differently or is this not possible with the Lua plugin API?

Any help or feedback is appreciated!

edit retag flag offensive close merge delete

add a comment

58 finfos = { field() } 59 60 if #finfos > 0 then 61 -- add our proto if we haven't already 62 if not tree then 63 tree = root:add(exproto) 64 end 65 66 for _, finfo in ipairs(finfos) do 67 -- get a TvbRange of the FieldInfo (fieldinfo.range in WSDG) 68 local ftvbr = finfo.tvb 69 tree:add(exfield_string, ftvbr:string(ENC_UTF_8)) 70 tree:add(exfield_hex,tostring(ftvbr:bytes())) 71 end 72 end

-- copy existing field(s) into table for processing finfo = { easypost_payload_f() } if (#finfo > 0) then if not subtree then subtree = tree:add(easypost_p) end for k, v in pairs(finfo) do -- process data and add results to the tree local field_data = string.format("%s", v):upper() subtree:add(pf.payload, field_data) end end

Comments

Oh, I see. This worked like a charm, thank you very much!

studersi ( 2024-07-19 07:55:03 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Lua Tap plugin does not see all TLS Change Cipher Spec messages

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Lua Tap plugin does not see all TLS Change Cipher Spec messages edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Lua Tap plugin does not see all TLS Change Cipher Spec messages