Mirror/rayhunter
1
0
Fork 0
mirror of https://github.com/EFForg/rayhunter.git synced 2026-04-30 17:39:58 -07:00
Code Issues Packages Projects Releases Wiki Activity

append packet num in harness & fix packet count

Browse Source
This commit is contained in:
Brad Warren
2025-09-02 09:29:02 -07:00
committed by Cooper Quintin
parent 87d6d1691a
commit e2bc3a0a67
8 changed files with 35 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
lib/src/analysis/imsi_requested.rs
View File

@@ -58,10 +58,7 @@ impl ImsiRequestedAnalyzer {
(State::AuthAccept, State::IdentityRequest) => {
self.flag = Some(Event {
event_type: EventType::High,
message: format!(
"Identity requested after auth request (frame {})",
packet_num
),
message: "Identity requested after auth request".to_string(),
});
}
@@ -69,10 +66,7 @@ impl ImsiRequestedAnalyzer {
(State::Disconnect, State::IdentityRequest) => {
self.flag = Some(Event {
event_type: EventType::High,
message: format!(
"Identity requested without Attach Request (frame {})",
packet_num
),
message: "Identity requested without Attach Request".to_string(),
});
}
@@ -80,10 +74,7 @@ impl ImsiRequestedAnalyzer {
(State::IdentityRequest, State::Disconnect) => {
self.flag = Some(Event {
event_type: EventType::High,
message: format!(
"Disconnected after Identity Request without Auth Accept (frame {})",
packet_num
),
message: "Disconnected after Identity Request without Auth Accept".to_string(),
});
}
@@ -91,11 +82,7 @@ impl ImsiRequestedAnalyzer {
(_, State::IdentityRequest) => {
self.flag = Some(Event {
event_type: EventType::Informational,
message: format!(
"Identity Request happened but its not suspicious yet. (frame {})",
packet_num
)
.to_string(),
message: "Identity Request happened but its not suspicious yet.".to_string(),
});
self.timeout_counter = 0;
}
@@ -187,11 +174,7 @@ impl Analyzer for ImsiRequestedAnalyzer {
if self.timeout_counter >= TIMEOUT_THRESHHOLD {
self.flag = Some(Event {
event_type: EventType::Informational {},
message: format!(
"Identity request happened without auth request followup (frame {})",
packet_num
)
.to_string(),
message: "Identity request happened without auth request followup".to_string(),
});
self.timeout_counter = 0;
}