feat: add packet_analysis rules for ARP/ICMP/OSPF/BGP with tshark field extraction

Author: yueguobin

packet_analysis/arp.yaml

@@ -0,0 +1,95 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# GNS3-Skills - Packet analysis rules for ARP/NDP
+#
+# Copyright (C) 2025 Yue Guobin
+#
+
+name: "ARP / NDP Packet Analysis"
+description: "ARP (Address Resolution Protocol) and IPv6 NDP (Neighbor Discovery Protocol) packet analysis rules"
+protocol: "arp or icmpv6.type == 135 or icmpv6.type == 136 or icmpv6.type == 133 or icmpv6.type == 134"
+display_filter: "arp or icmpv6.ns or icmpv6.na or icmpv6.rs or icmpv6.ra"
+
+fields:
+  - label: "Frame Number"
+    field: "frame.number"
+    description: "Packet sequence number in capture"
+
+  - label: "Source IP"
+    field: "arp.src.proto_ipv4"
+    description: "Sender protocol address (IPv4)"
+
+  - label: "Target IP"
+    field: "arp.dst.proto_ipv4"
+    description: "Target protocol address (IPv4)"
+
+  - label: "Source MAC"
+    field: "arp.src.hw_mac"
+    description: "Sender hardware address (MAC)"
+
+  - label: "Target MAC"
+    field: "arp.dst.hw_mac"
+    description: "Target hardware address (MAC, zero in requests)"
+
+  - label: "Opcode"
+    field: "arp.opcode"
+    description: "ARP operation code: 1=request, 2=reply, 3=reverse-request, 4=reverse-reply"
+
+  - label: "Duplicate Detected"
+    field: "arp.duplicate-address-detected"
+    description: "Duplicate IP address detection flag"
+
+  - label: "IPv6 Source"
+    field: "ipv6.src"
+    description: "IPv6 source address (for NDP)"
+
+  - label: "IPv6 Destination"
+    field: "ipv6.dst"
+    description: "IPv6 destination address (for NDP)"
+
+  - label: "ICMPv6 Type"
+    field: "icmpv6.type"
+    description: "ICMPv6 type: 133=RS, 134=RA, 135=NS, 136=NA, 137=Redirect"
+
+  - label: "ICMPv6 Target"
+    field: "icmpv6.target_address"
+    description: "NDP target address (NS/NA target)"
+
+  - label: "ICMPv6 Option Type"
+    field: "icmpv6.option.type"
+    description: "NDP option type: 1=Source Link-Layer, 2=Target Link-Layer, 3=Prefix Info, 5=MTU"
+
+  - label: "ICMPv6 Option MAC"
+    field: "icmpv6.option.lladdr"
+    description: "NDP link-layer address from option field"
+
+checks:
+  - name: "duplicate_ip"
+    severity: critical
+    message: "Duplicate IP detected: {arp.src.proto_ipv4} claimed by {arp.src.hw_mac} and existing entry"
+    condition: "arp.duplicate-address-detected is set to 1"
+
+  - name: "arp_no_reply"
+    severity: major
+    message: "No ARP reply received from {arp.dst.proto_ipv4}: {arp.src.proto_ipv4} keeps re-sending requests"
+    condition: "Same arp.dst.proto_ipv4 appears in more than 3 requests without a matching reply"
+
+  - name: "arp_flood"
+    severity: major
+    message: "Possible ARP scan or flooding from {arp.src.proto_ipv4}: {count} requests in short interval"
+    condition: "More than 20 ARP requests from same source within 5 seconds"
+
+  - name: "gratuitous_arp"
+    severity: minor
+    message: "Gratuitous ARP from {arp.src.proto_ipv4} (MAC: {arp.src.hw_mac}) for IP {arp.src.proto_ipv4}/{arp.dst.proto_ipv4}"
+    condition: "arp.opcode == 2 AND arp.src.proto_ipv4 == arp.dst.proto_ipv4"
+
+  - name: "ndp_no_neighbor_advertisement"
+    severity: major
+    message: "No NA reply for NS targeting {icmpv6.target_address} from {ipv6.src}"
+    condition: "icmpv6.type == 135 and no matching icmpv6.type == 136 within expected window"
+
+  - name: "ndp_duplicate_address"
+    severity: critical
+    message: "DAD (Duplicate Address Detection) indicates {icmpv6.target_address} may be in use"
+    condition: "icmpv6.type == 135 and icmpv6.target_address matches solicited-node multicast and NA received in response"

packet_analysis/bgp.yaml

@@ -0,0 +1,159 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# GNS3-Skills - Packet analysis rules for BGP
+#
+# Copyright (C) 2025 Yue Guobin
+#
+
+name: "BGP Packet Analysis"
+description: "BGP-4 packet analysis for session establishment, route exchange, and notification errors"
+protocol: "bgp"
+display_filter: "bgp"
+
+fields:
+  - label: "Frame Number"
+    field: "frame.number"
+    description: "Packet sequence number in capture"
+
+  - label: "Source IP"
+    field: "ip.src"
+    description: "BGP speaker source address (TCP 179 source or destination)"
+
+  - label: "Destination IP"
+    field: "ip.dst"
+    description: "BGP peer destination address"
+
+  - label: "BGP Message Type"
+    field: "bgp.type"
+    description: "BGP message type: 1=Open, 2=Update, 3=Notification, 4=Keepalive, 5=RouteRefresh"
+
+  - label: "BGP Message Length"
+    field: "bgp.length"
+    description: "Total BGP message length in bytes (header + data)"
+
+  - label: "BGP Marker"
+    field: "bgp.marker"
+    description: "BGP marker (all 0xFF for IPv4, used for synchronization)"
+
+  - label: "Open - BGP Identifier"
+    field: "bgp.router_id"
+    description: "BGP Router-ID (advertised in OPEN message)"
+
+  - label: "Open - AS Number"
+    field: "bgp.as_path"
+    description: "AS number from OPEN message (2-byte or 4-byte)"
+
+  - label: "Open - Hold Time"
+    field: "bgp.hold_time"
+    description: "Hold time advertised in OPEN (negotiated to lower of the two)"
+
+  - label: "Open - Optional Parameters"
+    field: "bgp.optional_parameter.type"
+    description: "Capabilities advertised: 2=4-byte AS, 64=Graceful Restart, 6=RouteRefresh, 1=Add-Path"
+
+  - label: "Update - Withdrawn Routes"
+    field: "bgp.withdrawn_prefix"
+    description: "Prefixes being withdrawn in UPDATE message"
+
+  - label: "Update - NLRI Prefixes"
+    field: "bgp.nlri_prefix"
+    description: "Prefixes being advertised in UPDATE message"
+
+  - label: "Update - Next Hop"
+    field: "bgp.next_hop"
+    description: "Next-hop IP address in UPDATE path attributes"
+
+  - label: "Update - AS Path"
+    field: "bgp.as_path"
+    description: "AS path attribute (AS sequence or AS set)"
+
+  - label: "Update - Origin"
+    field: "bgp.origin"
+    description: "Origin attribute: 0=IGP, 1=EGP, 2=Incomplete"
+
+  - label: "Update - Local Preference"
+    field: "bgp.local_pref"
+    description: "Local preference attribute (only within AS)"
+
+  - label: "Update - Multi-Exit Discriminator"
+    field: "bgp.med"
+    description: "MED attribute for inbound path selection"
+
+  - label: "Update - Communities"
+    field: "bgp.community"
+    description: "BGP community attribute"
+
+  - label: "Notification - Error Code"
+    field: "bgp.notification.code"
+    description: "Notification error code: 1=MsgHeader, 2=Open, 3=Update, 4=HoldTimer, 5=FSM, 6=Cease"
+
+  - label: "Notification - Error Subcode"
+    field: "bgp.notification.subcode"
+    description: "Notification error subcode (specific reason)"
+
+  - label: "Notification - Data"
+    field: "bgp.notification.data"
+    description: "Notification data (hex dump of offending data)"
+
+  - label: "Keepalive Interval"
+    field: "bgp.keepalive"
+    description: "Keepalive interval derived from negotiated hold time"
+
+  - label: "Route Refresh - AFI"
+    field: "bgp.route_refresh.afi"
+    description: "Address Family Identifier in Route Refresh"
+
+  - label: "Route Refresh - SAFI"
+    field: "bgp.route_refresh.safi"
+    description: "Subsequent AFI in Route Refresh"
+
+checks:
+  - name: "bgp_open_error"
+    severity: critical
+    message: "BGP OPEN error from {ip.src} to {ip.dst}: code {bgp.notification.code}, subcode {bgp.notification.subcode}"
+    condition: "bgp.type == 1 and followed by bgp.type == 3 (Notification)"
+
+  - name: "bgp_hold_timer_expired"
+    severity: critical
+    message: "BGP hold timer expired for session {ip.src}<->{ip.dst}, session reset"
+    condition: "bgp.notification.code == 4 (Hold Timer Expired)"
+
+  - name: "bgp_update_error"
+    severity: critical
+    message: "BGP UPDATE error from {ip.src}: code {bgp.notification.code}, subcode {bgp.notification.subcode}"
+    condition: "bgp.type == 2 and followed by bgp.type == 3 with notification.code == 3"
+
+  - name: "bgp_as_path_loop"
+    severity: critical
+    message: "AS path loop detected: AS_PATH {bgp.as_path} from {ip.src}"
+    condition: "bgp.type == 2 and AS path repeated across multiple UPDATEs (route withdrawn after previous advertisement)"
+
+  - name: "bgp_nexthop_unreachable"
+    severity: major
+    message: "BGP next-hop {bgp.next_hop} from {ip.src} may not be reachable via IGP"
+    condition: "bgp.type == 2 and subsequent routing table state shows NHL not resolved in RIB"
+
+  - name: "bgp_route_flap"
+    severity: minor
+    message: "BGP route flapping: prefix {bgp.nlri_prefix} withdrawn and re-advertised repeatedly by {ip.src}"
+    condition: "Same bgp.nlri_prefix appears in both withdrawn_prefix and nlri_prefix from same source in short interval"
+
+  - name: "bgp_notification_cease"
+    severity: critical
+    message: "BGP session terminated: Cease notification from {ip.src} (subcode {bgp.notification.subcode})"
+    condition: "bgp.notification.code == 6"
+
+  - name: "bgp_admin_reset"
+    severity: major
+    message: "BGP session administratively reset from {ip.src} to {ip.dst} (Cease subcode 2)"
+    condition: "bgp.notification.code == 6 and bgp.notification.subcode == 2"
+
+  - name: "bgp_max_prefix_exceeded"
+    severity: major
+    message: "BGP maximum prefix limit exceeded, session reset from {ip.src}"
+    condition: "bgp.notification.code == 6 and bgp.notification.subcode == 3 (max prefix reached)"
+
+  - name: "bgp_capability_mismatch"
+    severity: major
+    message: "BGP capability mismatch between {ip.src} and {ip.dst}: MISSING capability {bgp.optional_parameter.type}"
+    condition: "bgp.type == 1 and capabilities advertised differ between peers"

packet_analysis/icmp.yaml

@@ -0,0 +1,134 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# GNS3-Skills - Packet analysis rules for ICMP/ICMPv6
+#
+# Copyright (C) 2025 Yue Guobin
+#
+
+name: "ICMP / ICMPv6 Packet Analysis"
+description: "ICMP (Internet Control Message Protocol) v4 and v6 packet analysis for connectivity and PMTUD troubleshooting"
+protocol: "icmp or icmpv6"
+display_filter: "icmp or icmpv6"
+
+fields:
+  - label: "Frame Number"
+    field: "frame.number"
+    description: "Packet sequence number in capture"
+
+  - label: "Source IP"
+    field: "ip.src"
+    description: "IPv4 source address (present for IPv4 packets)"
+
+  - label: "Destination IP"
+    field: "ip.dst"
+    description: "IPv4 destination address"
+
+  - label: "IPv6 Source"
+    field: "ipv6.src"
+    description: "IPv6 source address (present for IPv6 packets)"
+
+  - label: "IPv6 Destination"
+    field: "ipv6.dst"
+    description: "IPv6 destination address"
+
+  - label: "ICMP Type (v4)"
+    field: "icmp.type"
+    description: "ICMPv4 type: 0=Echo Reply, 3=Dest Unreachable, 8=Echo, 11=TTL Exceeded, 5=Redirect"
+
+  - label: "ICMP Code (v4)"
+    field: "icmp.code"
+    description: "ICMPv4 code (sub-type for each type)"
+
+  - label: "ICMP Sequence (v4)"
+    field: "icmp.seq"
+    description: "ICMPv4 echo request/reply sequence number"
+
+  - label: "ICMPv6 Type"
+    field: "icmpv6.type"
+    description: "ICMPv6 type: 1=Unreach, 2=PacketTooBig, 3=TimeExceed, 128=EchoReq, 129=EchoRep"
+
+  - label: "ICMPv6 Code"
+    field: "icmpv6.code"
+    description: "ICMPv6 code (sub-type for each type)"
+
+  - label: "ICMPv6 Sequence"
+    field: "icmpv6.seq"
+    description: "ICMPv6 echo request/reply sequence number"
+
+  - label: "Unreachable Port (v4)"
+    field: "icmp.dstport.unreachable"
+    description: "Destination port in ICMPv4 unreachable message"
+
+  - label: "PMTU Value (v6)"
+    field: "icmpv6.mtu"
+    description: "Path MTU value in ICMPv6 Packet Too Big message"
+
+  - label: "Redirect Gateway"
+    field: "icmp.redirect.gateway"
+    description: "ICMP redirect: suggested alternative gateway address"
+
+checks:
+  - name: "ping_timeout"
+    severity: minor
+    message: "Ping timeout: no echo reply for seq {icmp.seq} from {ip.dst}"
+    condition: "icmp.type == 8 and no matching icmp.type == 0 within expected window"
+
+  - name: "icmp_unreachable_network"
+    severity: major
+    message: "Network unreachable: {ip.src} cannot reach {ip.dst} (ICMP type 3 code 0)"
+    condition: "icmp.type == 3 and icmp.code == 0"
+
+  - name: "icmp_unreachable_host"
+    severity: major
+    message: "Host unreachable: {ip.src} cannot reach {ip.dst} (ICMP type 3 code 1)"
+    condition: "icmp.type == 3 and icmp.code == 1"
+
+  - name: "icmp_unreachable_protocol"
+    severity: major
+    message: "Protocol unreachable: {ip.dst} does not support protocol requested by {ip.src} (ICMP type 3 code 2)"
+    condition: "icmp.type == 3 and icmp.code == 2"
+
+  - name: "icmp_unreachable_port"
+    severity: major
+    message: "Port unreachable: port {icmp.dstport.unreachable} on {ip.dst} not reachable from {ip.src}"
+    condition: "icmp.type == 3 and icmp.code == 3"
+
+  - name: "icmp_frag_needed"
+    severity: major
+    message: "Fragmentation needed but DF set: {ip.src} to {ip.dst} — PMTUD issue"
+    condition: "icmp.type == 3 and icmp.code == 4"
+
+  - name: "icmp_redirect"
+    severity: minor
+    message: "ICMP redirect from {ip.src}: use {icmp.redirect.gateway} instead of current gateway"
+    condition: "icmp.type == 5"
+
+  - name: "icmp_ttl_exceeded"
+    severity: minor
+    message: "TTL exceeded in transit: packet from {ip.src} to {ip.dst} expired at intermediate router"
+    condition: "icmp.type == 11 and icmp.code == 0"
+
+  - name: "icmpv6_unreachable_network"
+    severity: major
+    message: "IPv6 network unreachable: {ipv6.src} to {ipv6.dst} (ICMPv6 type 1 code 0)"
+    condition: "icmpv6.type == 1 and icmpv6.code == 0"
+
+  - name: "icmpv6_unreachable_port"
+    severity: major
+    message: "IPv6 port unreachable: {ipv6.dst} port not reachable from {ipv6.src}"
+    condition: "icmpv6.type == 1 and icmpv6.code == 4"
+
+  - name: "icmpv6_packet_too_big"
+    severity: major
+    message: "IPv6 Path MTU issue: {ipv6.src} to {ipv6.dst}, suggested MTU {icmpv6.mtu}"
+    condition: "icmpv6.type == 2"
+
+  - name: "icmpv6_ttl_exceeded"
+    severity: minor
+    message: "IPv6 Hop Limit exceeded: packet from {ipv6.src} to {ipv6.dst} expired in transit"
+    condition: "icmpv6.type == 3"
+
+  - name: "consecutive_ping_loss"
+    severity: minor
+    message: "Consecutive ping loss detected: {count} echo requests with no reply from {ip.dst}"
+    condition: "icmp.type == 8 and more than 3 consecutive seq numbers without matching icmp.type == 0"