Skip to content

Commit b4562a0

Browse files
yueguobinclaude
yueguobin
and
claude
committed
refactor: split condition into condition + description, fix bugs
Split each check's condition field into: - condition: pure tshark filter (null when inexpressible) - description: natural language intent (for LLM fallback) Also fix bugs found during review: - ssl.yaml: label→name, self-referencing condition, wrong field ref - esp.yaml, lacp.yaml: label→name in check entries - ospf.yaml: LSA Sequence field ospf.db.dd_sequence → ospf.lsa.seqnum - dhcp.yaml: remove duplicate dhcp.type field - snmp.yaml: remove duplicate snmp.value.oid field - arp.yaml: uppercase AND → lowercase and - llc.yaml: add missing checks (was the only file without any) - tcp.yaml: register tcp.analysis.* fields in fields list Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
1 parent af214ba commit b4562a0

58 files changed

Lines changed: 2981 additions & 4231 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/scripts/validate_tshark_fields.py‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,9 +97,11 @@ def validate_fields(yaml_files: list[Path], registered: set) -> tuple:
9797
else:
9898
errors.append((yf.name, fname, field.get("label", "")))
9999

100-
# Check {field} references in conditions/messages
100+
# Check {field} references in conditions/messages/description
101101
for check in data.get("checks", []):
102-
check_text = check.get("message", "") + " " + check.get("condition", "")
102+
check_text = (check.get("message", "") + " " +
103+
(check.get("condition") or "") + " " +
104+
(check.get("description") or ""))
103105
refs = re.findall(r'\{([^}]+)\}', check_text)
104106
for ref in refs:
105107
if ref.startswith("count") or ref in {"expected", "prev"}:

‎packet_analysis/ah.yaml‎

Lines changed: 44 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,47 @@
1-
# SPDX-License-Identifier: GPL-3.0-or-later
2-
#
3-
# GNS3-Skills - Packet analysis rules for AH
4-
#
5-
# Copyright (C) 2025 Yue Guobin
6-
#
7-
8-
name: "IPsec AH Packet Analysis"
9-
description: "IPsec AH (Authentication Header) packet analysis for VPN integrity checking"
10-
11-
# Protocol identifier - LLM uses this to query the protocol definition
12-
protocol_key: "ah"
13-
14-
# tshark display filter - used for -Y parameter
15-
display_filter: "ah"
16-
17-
# tshark fields that LLM can use for analysis
1+
name: IPsec AH Packet Analysis
2+
description: IPsec AH (Authentication Header) packet analysis for VPN integrity checking
3+
protocol_key: ah
4+
display_filter: ah
185
fields:
19-
- label: "Frame Number"
20-
tshark_field: "frame.number"
21-
description: "Packet sequence number in capture"
22-
23-
- label: "Next Header"
24-
tshark_field: "ah.next_header"
25-
description: "Next header protocol after AH"
26-
27-
- label: "Length"
28-
tshark_field: "ah.length"
29-
description: "AH header length"
30-
31-
- label: "SPI"
32-
tshark_field: "ah.spi"
33-
description: "Security Parameters Index"
34-
35-
- label: "Sequence Number"
36-
tshark_field: "ah.sequence"
37-
description: "AH sequence number (anti-replay)"
38-
39-
- label: "ICV"
40-
tshark_field: "ah.icv"
41-
description: "Integrity Check Value"
42-
6+
- label: Frame Number
7+
tshark_field: frame.number
8+
description: Packet sequence number in capture
9+
- label: Next Header
10+
tshark_field: ah.next_header
11+
description: Next header protocol after AH
12+
- label: Length
13+
tshark_field: ah.length
14+
description: AH header length
15+
- label: SPI
16+
tshark_field: ah.spi
17+
description: Security Parameters Index
18+
- label: Sequence Number
19+
tshark_field: ah.sequence
20+
description: AH sequence number (anti-replay)
21+
- label: ICV
22+
tshark_field: ah.icv
23+
description: Integrity Check Value
4324
filter_examples:
44-
- name: "Specific SPI"
45-
filter: "ah.spi == 0x12345678"
46-
description: "Filter for specific AH SPI"
47-
48-
- name: "AH transport mode"
49-
filter: "ah.next_header == 4 or ah.next_header == 6 or ah.next_header == 17"
50-
description: "Filter for AH transport mode (direct protocol)"
51-
52-
- name: "AH tunnel mode"
53-
filter: "ah.next_header == 4"
54-
description: "Filter for AH tunnel mode (IP-in-IP)"
55-
56-
- name: "AH with IPv4"
57-
filter: "ah and ip"
58-
description: "Filter for AH with IPv4 payload"
59-
25+
- name: Specific SPI
26+
filter: ah.spi == 0x12345678
27+
description: Filter for specific AH SPI
28+
- name: AH transport mode
29+
filter: ah.next_header == 4 or ah.next_header == 6 or ah.next_header == 17
30+
description: Filter for AH transport mode (direct protocol)
31+
- name: AH tunnel mode
32+
filter: ah.next_header == 4
33+
description: Filter for AH tunnel mode (IP-in-IP)
34+
- name: AH with IPv4
35+
filter: ah and ip
36+
description: Filter for AH with IPv4 payload
6037
checks:
61-
- name: "ah_sequence_gap"
62-
severity: major
63-
message: "AH sequence gap: possible replay or packet loss"
64-
condition: "ah.sequence jumps by more than expected window"
65-
66-
- name: "ah_replay_attack"
67-
severity: critical
68-
message: "AH possible replay attack: duplicate sequence {ah.sequence}"
69-
condition: "Duplicate ah.sequence for same ah.spi"
38+
- name: ah_sequence_gap
39+
severity: major
40+
message: 'AH sequence gap: possible replay or packet loss'
41+
description: ah.sequence jumps by more than expected window
42+
condition: null
43+
- name: ah_replay_attack
44+
severity: critical
45+
message: 'AH possible replay attack: duplicate sequence {ah.sequence}'
46+
description: Duplicate ah.sequence for same ah.spi
47+
condition: null

‎packet_analysis/arp.yaml‎

Lines changed: 18 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,5 @@
1-
# SPDX-License-Identifier: GPL-3.0-or-later
2-
#
3-
# GNS3-Skills - Packet analysis rules
4-
#
5-
# Copyright (C) 2025 Yue Guobin
6-
#
7-
81
name: ARP / NDP Packet Analysis
9-
description: ARP (Address Resolution Protocol) and IPv6 NDP (Neighbor Discovery Protocol)
10-
packet analysis rules
2+
description: ARP (Address Resolution Protocol) and IPv6 NDP (Neighbor Discovery Protocol) packet analysis rules
113
protocol_key: arp
124
display_filter: arp or icmpv6.ns or icmpv6.na or icmpv6.rs or icmpv6.ra
135
fields:
@@ -46,8 +38,7 @@ fields:
4638
description: NDP target address (NS/NA target)
4739
- label: ICMPv6 Option Type
4840
tshark_field: icmpv6.opt.type
49-
description: 'NDP option type: 1=Source Link-Layer, 2=Target Link-Layer, 3=Prefix
50-
Info, 5=MTU'
41+
description: 'NDP option type: 1=Source Link-Layer, 2=Target Link-Layer, 3=Prefix Info, 5=MTU'
5142
filter_examples:
5243
- name: ARP requests only
5344
filter: arp.opcode == 1
@@ -70,33 +61,30 @@ filter_examples:
7061
checks:
7162
- name: duplicate_ip
7263
severity: critical
73-
message: 'Duplicate IP detected: {arp.src.proto_ipv4} claimed by {arp.src.hw_mac}
74-
and existing entry'
75-
condition: arp.duplicate-address-detected is set to 1
64+
message: 'Duplicate IP detected: {arp.src.proto_ipv4} claimed by {arp.src.hw_mac} and existing entry'
65+
description: arp.duplicate-address-detected is set to 1
66+
condition: null
7667
- name: arp_no_reply
7768
severity: major
78-
message: 'No ARP reply received from {arp.dst.proto_ipv4}: {arp.src.proto_ipv4}
79-
keeps re-sending requests'
80-
condition: Same arp.dst.proto_ipv4 appears in more than 3 requests without a matching
81-
reply
69+
message: 'No ARP reply received from {arp.dst.proto_ipv4}: {arp.src.proto_ipv4} keeps re-sending requests'
70+
description: Same arp.dst.proto_ipv4 appears in more than 3 requests without a matching reply
71+
condition: null
8272
- name: arp_flood
8373
severity: major
84-
message: 'Possible ARP scan or flooding from {arp.src.proto_ipv4}: {count} requests
85-
in short interval'
86-
condition: More than 20 ARP requests from same source within 5 seconds
74+
message: 'Possible ARP scan or flooding from {arp.src.proto_ipv4}: {count} requests in short interval'
75+
description: More than 20 ARP requests from same source within 5 seconds
76+
condition: null
8777
- name: gratuitous_arp
8878
severity: minor
89-
message: 'Gratuitous ARP from {arp.src.proto_ipv4} (MAC: {arp.src.hw_mac}) for IP
90-
{arp.src.proto_ipv4}/{arp.dst.proto_ipv4}'
91-
condition: arp.opcode == 2 AND arp.src.proto_ipv4 == arp.dst.proto_ipv4
79+
message: 'Gratuitous ARP from {arp.src.proto_ipv4} (MAC: {arp.src.hw_mac}) for IP {arp.src.proto_ipv4}/{arp.dst.proto_ipv4}'
80+
condition: arp.opcode == 2 and arp.src.proto_ipv4 == arp.dst.proto_ipv4
9281
- name: ndp_no_neighbor_advertisement
9382
severity: major
9483
message: No NA reply for NS targeting {icmpv6.nd.ns.target_address} from {ipv6.src}
95-
condition: icmpv6.type == 135 and no matching icmpv6.type == 136 within expected
96-
window
84+
description: icmpv6.type == 135 and no matching icmpv6.type == 136 within expected window
85+
condition: icmpv6.type == 135
9786
- name: ndp_duplicate_address
9887
severity: critical
99-
message: DAD (Duplicate Address Detection) indicates {icmpv6.nd.ns.target_address} may
100-
be in use
101-
condition: icmpv6.type == 135 and icmpv6.target_address matches solicited-node multicast
102-
and NA received in response
88+
message: DAD (Duplicate Address Detection) indicates {icmpv6.nd.ns.target_address} may be in use
89+
description: icmpv6.type == 135 and icmpv6.target_address matches solicited-node multicast and NA received in response
90+
condition: icmpv6.type == 135

‎packet_analysis/auto_rp.yaml‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,5 @@
1-
# SPDX-License-Identifier: GPL-3.0-or-later
2-
#
3-
# GNS3-Skills - Packet analysis rules
4-
#
5-
# Copyright (C) 2025 Yue Guobin
6-
#
7-
81
name: Auto-RP Packet Analysis
9-
description: Auto-RP (Auto-Rendezvous Point) packet analysis for Cisco multicast RP
10-
discovery
2+
description: Auto-RP (Auto-Rendezvous Point) packet analysis for Cisco multicast RP discovery
113
protocol_key: auto_rp
124
display_filter: autorp
135
fields:
@@ -28,8 +20,10 @@ checks:
2820
- name: autor_rp_spoof
2921
severity: major
3022
message: 'Auto-RP spoofing: unauthorized RP {ip.src} announced'
31-
condition: Auto-RP announcement from unexpected source
23+
description: Auto-RP announcement from unexpected source
24+
condition: null
3225
- name: autor_same_rp_announce
3326
severity: minor
3427
message: 'Auto-RP duplicate RP: {ip.src} announced by multiple sources'
35-
condition: Same autorp.rp_addr from different sources
28+
description: Same autorp.rp_addr from different sources
29+
condition: null

‎packet_analysis/bootp.yaml‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,5 @@
1-
# SPDX-License-Identifier: GPL-3.0-or-later
2-
#
3-
# GNS3-Skills - Packet analysis rules
4-
#
5-
# Copyright (C) 2025 Yue Guobin
6-
#
7-
81
name: BOOTP Packet Analysis
9-
description: BOOTP (Bootstrap Protocol) packet analysis for legacy IP assignment and
10-
PXE boot
2+
description: BOOTP (Bootstrap Protocol) packet analysis for legacy IP assignment and PXE boot
113
protocol_key: bootp
124
display_filter: bootp
135
fields:
@@ -73,8 +65,10 @@ checks:
7365
- name: bootp_no_reply
7466
severity: major
7567
message: 'BOOTP request without reply: XID {dhcp.id}'
76-
condition: bootp.type == 1 and no matching bootp.type == 2 within timeout
68+
description: bootp.type == 1 and no matching bootp.type == 2 within timeout
69+
condition: bootp.type == 1
7770
- name: bootp_relay_mismatch
7871
severity: minor
7972
message: 'BOOTP relay mismatch: giaddr {dhcp.ip.relay} different from source'
80-
condition: bootp.ip.relay is set and doesn't match client subnet
73+
description: bootp.ip.relay is set and doesn't match client subnet
74+
condition: null

‎packet_analysis/cdp.yaml‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,3 @@
1-
# SPDX-License-Identifier: GPL-3.0-or-later
2-
#
3-
# GNS3-Skills - Packet analysis rules
4-
#
5-
# Copyright (C) 2025 Yue Guobin
6-
#
7-
81
name: CDP Packet Analysis
92
description: CDP (Cisco Discovery Protocol) packet analysis for Cisco neighbor discovery
103
protocol_key: cdp
@@ -81,16 +74,20 @@ checks:
8174
- name: cdp_neighbor_timeout
8275
severity: minor
8376
message: 'CDP neighbor timeout: no CDP from {cdp.deviceid} within TTL'
84-
condition: No CDP frames from neighbor within cdp.ttl seconds
77+
description: No CDP frames from neighbor within cdp.ttl seconds
78+
condition: null
8579
- name: cdp_native_vlan_mismatch
8680
severity: major
8781
message: 'CDP native VLAN mismatch: neighbor {cdp.deviceid} has VLAN {cdp.native_vlan}'
88-
condition: cdp.native_vlan differs from local configuration
82+
description: cdp.native_vlan differs from local configuration
83+
condition: null
8984
- name: cdp_duplex_mismatch
9085
severity: major
9186
message: 'CDP duplex mismatch: neighbor {cdp.deviceid} shows {cdp.duplex}'
92-
condition: cdp.duplex differs from local interface setting
87+
description: cdp.duplex differs from local interface setting
88+
condition: null
9389
- name: cdp_device_id_change
9490
severity: minor
9591
message: 'CDP device ID change: new device {cdp.deviceid} on port'
96-
condition: Different cdp.deviceid from same source MAC
92+
description: Different cdp.deviceid from same source MAC
93+
condition: null

‎packet_analysis/dhcp.yaml‎

Lines changed: 10 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,5 @@
1-
# SPDX-License-Identifier: GPL-3.0-or-later
2-
#
3-
# GNS3-Skills - Packet analysis rules
4-
#
5-
# Copyright (C) 2025 Yue Guobin
6-
#
7-
81
name: DHCP Packet Analysis
9-
description: DHCP (Dynamic Host Configuration Protocol) packet analysis for IP assignment
10-
troubleshooting
2+
description: DHCP (Dynamic Host Configuration Protocol) packet analysis for IP assignment troubleshooting
113
protocol_key: dhcp
124
display_filter: bootp
135
fields:
@@ -16,8 +8,7 @@ fields:
168
description: Packet sequence number in capture
179
- label: Message Type
1810
tshark_field: dhcp.type
19-
description: 'DHCP message type: 1=Discover, 2=Offer, 3=Request, 4=Decline, 5=ACK,
20-
6=NAK, 7=Release, 8=Inform'
11+
description: 'DHCP message type: 1=Discover, 2=Offer, 3=Request, 4=Decline, 5=ACK, 6=NAK, 7=Release, 8=Inform'
2112
- label: Hardware Type
2213
tshark_field: dhcp.hw.type
2314
description: 'Hardware type: 1=Ethernet'
@@ -78,9 +69,6 @@ fields:
7869
- label: Requested IP Address
7970
tshark_field: dhcp.option.requested_ip_address
8071
description: Requested IP address option
81-
- label: Message Type
82-
tshark_field: dhcp.type
83-
description: DHCP message type option
8472
filter_examples:
8573
- name: DHCP Discover
8674
filter: dhcp.option.message_type == 1
@@ -110,8 +98,8 @@ checks:
11098
- name: dhcp_no_offer
11199
severity: major
112100
message: 'DHCP Discover without Offer: client {dhcp.hw.mac_addr} (XID: {dhcp.id})'
113-
condition: dhcp.option.message_type == 1 and no matching dhcp.option.message_type
114-
== 2 with same dhcp.id
101+
description: dhcp.option.message_type == 1 and no matching dhcp.option.message_type == 2 with same dhcp.id
102+
condition: dhcp.option.message_type == 1
115103
- name: dhcp_nak
116104
severity: major
117105
message: 'DHCP NAK: server rejected request for {dhcp.option.requested_ip_address}'
@@ -123,12 +111,15 @@ checks:
123111
- name: dhcp_relay_issue
124112
severity: minor
125113
message: 'DHCP relay issue: giaddr {dhcp.ip.relay} but no response'
126-
condition: dhcp.ip.relay is set and no matching response
114+
description: dhcp.ip.relay is set and no matching response
115+
condition: dhcp.ip.relay
127116
- name: dhcp_duplicate_ip
128117
severity: critical
129118
message: 'DHCP duplicate IP detected: {dhcp.ip.your} already assigned'
130-
condition: dhcp.option.message_type == 4 (Decline)
119+
description: dhcp.option.message_type == 4 (Decline)
120+
condition: dhcp.option.message_type == 4
131121
- name: dhcp_server_unresponsive
132122
severity: major
133123
message: 'DHCP server unresponsive: {count} timeouts for client {dhcp.hw.mac_addr}'
134-
condition: Multiple DHCP requests without response from same server
124+
description: Multiple DHCP requests without response from same server
125+
condition: null

0 commit comments

Comments
 (0)