Free Web Hosting by Netfirms
Web Hosting by Netfirms | Free Domain Names by Netfirms

@RISK Online - The Security Blog

Free Web Hosting by Netfirms
Web Hosting by Netfirms | Free Domain Names by Netfirms

2 user(s) online.

iptraffic:


Database Schema

This is my initial attempt at putting together a schema to support my iptraffic project. I have Perl code to build these tables in MySQL. The fields here are derived straight from the PM documentation for each module, available via the Comprehensive Perl Archive Network (CPAN). The following modules are used in this application to provide protocol support:

  • NetPacket::ARP Assemble and disassemble ARP (Address Resolution Protocol) packets.
  • NetPacket::Ethernet Assemble and disassemble ethernet packets.
  • NetPacket::ICMP Assemble and disassemble ICMP (Internet Control Message Protocol) packets.
  • NetPacket::IGMP Assemble and disassemble IGMP (Internet Group Mangement Protocol) packets.
  • NetPacket::IP Assemble and disassemble IP (Internet Protocol) packets.
  • NetPacket::TCP Assemble and disassemble TCP (Transmission Control Protocol) packets.
  • NetPacket::UDP Assemble and disassemble UDP (User Datagram Protocol) packets.
  • NetPacket::LLC Assemble and disassemble IEEE 802.3 LLC protocol packets.
  • NetPacket::SpanningTree Assemble and disassemble IEEE 802.1D Spanning Tree protocol packets.

My initial table layouts follow the documentation provided for each module listed above at CPAN. The basic results are shown below:

Ethernet  
src_mac The source MAC address for the ethernet packet as a hex string.
dest_mac The destination MAC address for the ethernet packet as a hex string.
type The protocol type for the ethernet packet.
data The payload for the ethernet packet.
   
ARP  
htype Hardware type.
proto Protocol type.
hlen Header length.
plen Protocol length.
opcode One of the following constants:
  • ARP_OPCODE_REQUEST
  • ARP_OPCODE_REPLY
  • RARP_OPCODE_REQUEST
  • RARP_OPCODE_REPLY
  • sha Source hardware address.
    spa Source protocol address.
    tha Target hardware address.
    tpa Target protocol address.
       
    IP  
    ver The IP version number of this packet.
    hlen The IP header length of this packet.
    flags The IP header flags for this packet.
    foffset The IP fragment offset for this packet.
    tos The type-of-service for this IP packet.
    len The length (including length of header) in bytes for this packet.
    id The identification (sequence) number for this IP packet.
    ttl The time-to-live value for this packet.
    proto The IP protocol number for this packet.
    cksum The IP checksum value for this packet.
    src_ip The source IP address for this packet in dotted-quad notation.
    dest_ip The destination IP address for this packet in dotted-quad notation.
    options Any IP options for this packet.
    data The encapsulated data (payload) for this IP packet
       
    TCP  
    src_port The source TCP port for the packet.
    dest_port The destination TCP port for the packet.
    seqnum The TCP sequence number for this packet.
    acknum The TCP acknowledgement number for this packet.
    hlen The header length for this packet.
    reserved The 6-bit "reserved" space in the TCP header.
    flags Contains the urg, ack, psh, rst, syn, fin, ece and cwr flags for this packet.
    winsize The TCP window size for this packet.
    cksum The TCP checksum.
    urg The TCP urgent pointer.
    options Any TCP options for this packet in binary form.
    data The encapsulated data (payload) for this packet.
       
    UDP  
    src_port The source UDP port for the datagram.
    dest_port The destination UDP port for the datagram.
    len The length (including length of header) in bytes for this packet.
    cksum The checksum value for this packet.
    data The encapsulated data (payload) for this packet.
       
    ICMP  
    type The ICMP message type of this packet.
    code The ICMP message code of this packet.
    cksum The checksum for this packet.
    data The encapsulated data (payload) for this packet.
       
    IGMP  
    version The IGMP version of this packet.
    type The message type for this packet.
    len The length (including length of header) in bytes for this packet.
    subtype The message subtype for this packet.
    cksum The checksum for this packet.
    group_addr The group address specified in this packet.
    data The encapsulated data (payload) for this packet.
       
    LLC  
    max_age  
    message_age  
    bpdu_flags  
    bridge_id  
       
    SpanningTree  
    max_age  
    message_age  
    bpdu_flags A single octet, representing the topology change flag (TC) (LSB) and the topology change notification acknowledgement (TCA) (MSB). This parameter is contructed when encoding, please refer to the TC and TCA items to set the appropriate bits.
    bridge_mac This (along with bridge_priority) is used to build the bridge_id when encoding.
    bpdu_type  
    topology_change
    bridge_priority This (along with bridge_mac) is used to build the bridge_id when encoding.
    topology_change_ack  
    protocol_version  
    forward_delay  
    hello_time  
    port_num  
    root_priority This (along with root_mac) is used to build the root_id when encoding.
    root_path_cost  
    protocol_id This value should always be 0, defaults to 0.
    root_mac This (along with root_priority) is used to build the root_id when encoding.
    port_priority This (along with port_num) is used to build the port_id when encoding.
    root_id  
    port_id  
    bridge_id  
    Blogroll Me!

    Navigation:

    Home
    Archives
    About Me
    Articles
    Email
    News Feed
    Projects

    My Blogroll:

    Security Advisories:

    Anti-Phishing
    AUSCERT
    BugBlog
    CERIAS
    CERT
    CIAC
    Cisco Advisories
    F-Secure
    iDefense
    ISS XForce
    McAfee
    Windows Security
    Oracle Alerts
    Secunia
    Security Corporation
    Security Focus
    Security Tracker
    SGI Advisories
    Sun Alerts
    Symantec
    Trend Micro
    Zone-H

    Defacements Archive:

    Zone-H Digital Archive

    Security News:

    DShield
    Help Net Security
    Internet Storm Center
    Linux Security
    NewsNow: Encryption/Security
    NewsNow: Hacking
    Packet Storm
    Securiteam
    Security News Portal
    Security Stats
    Security Focus
    Risks Digest
    Zone-H

    Security Tools:

    Packet Storm
    Astalavista
    Help Net Security
    Packet Factory
    Security Focus

    Powered by Greymatter
    @RISK Online · ©1999-2004





    Locations of visitors to this page
    Where are visitors to this page?
    (Auto-update daily since 01-JAN-05)