Implements user script for ip reassociation alerts

Addresses #4614
This commit is contained in:
Simone Mainardi 2020-10-22 16:49:50 +02:00
parent ebe8731ea5
commit 2e29a8d246
8 changed files with 98 additions and 13 deletions

View file

@ -0,0 +1,8 @@
--
-- (C) 2020 - ntop.org
--
return {
description = "Trigger alerts when an IP address, previously seen with a MAC address, is now seen with another MAC address. This alert might indicate an ARP spoof attempt. Only works for the builtin alert recipient.", --
title = "IP Reassignment",
}

View file

@ -0,0 +1,10 @@
--
-- (C) 2019-20 - ntop.org
--
return {
title = "Remote to Remote",
description = "Detects remote to remote flows and triggers alerts",
author = "ntop",
dependencies = {},
}

View file

@ -0,0 +1,69 @@
--
-- (C) 2019-20 - ntop.org
--
local flow_consts = require("flow_consts")
local user_scripts = require("user_scripts")
-- #################################################################
local IP_REASSIGNMENT_KEY = "ntopng.prefs.ip_reassignment_alerts"
-- #################################################################
local function dummy()
-- Nothing to do here, the plugin is only meant to set a preference which is then
-- read from C.
return
end
-- #################################################################
local script = {
-- Script category
category = user_scripts.script_categories.network,
-- Off by default
default_enabled = false,
-- NOTE: hooks defined below
hooks = {
min = dummy
},
gui = {
i18n_title = "ip_reassignment.title",
i18n_description = "ip_reassignment.description",
}
}
-- #################################################################
function script.onLoad(hook, hook_config)
if hook_config and hook_config.enabled then
ntop.setPref(IP_REASSIGNMENT_KEY, "1")
end
end
-- #################################################################
function script.onUnload(hook, hook_config)
ntop.delCache(IP_REASSIGNMENT_KEY)
end
-- #################################################################
function script.onEnable(hook, hook_config)
ntop.setPref(IP_REASSIGNMENT_KEY, "1")
end
-- #################################################################
function script.onDisable(hook, hook_config)
ntop.delCache(IP_REASSIGNMENT_KEY)
end
-- #################################################################
return script