You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
calculate network subnet (using method in base class)
Borrow paths and fields form the current network manager but update to use the config parser (don’t use any logic)
Add a field to the UnixInterfaceRecord to indicate the networking system the record data was retrieved from
Below is the design scheme with notes for linux:
windows/
_os.py
network.py
_os.py:
Still has the ips export for backwards compatibility
network.py
Can take inspiration from datetime namespace plugin.
Define a NetworkPlugin based on a base class with some defined exports.
It should be defined in plugins/general/network.py, so that the Default OS plugin can also make use of it.
The exported functions can just return empty iterators.
Should also have some @internal functions for interface lookup (similar to user_details)
- interfaces
- InterfaceRecord
- Base record for common stuff, OS specialized fields where applicable
- Can take inspiration from UserRecord/Browser*Record
- Fields (in no particular order):
- Type (TUN/TAP/Physical)
- Name
- Enabled/disabled
- MAC (optional)
- IP / subnet
- VLAN? (macOS/windows)
- Gateway
- DNS server / Search domain (Windows/macOS specific?)
- Proxy (at least macOS specific)
- Metric (Windows specific)
- Interface service order (macOS)
- Last connected (maybe only Windows?)
- Config source (similar to how we use the source field in other records)
- ips -> shorthand for getting all ips
- gateways/mac/dns/other common fields -> idem as ^
Linux notes:
- Need to parse information from static configuration files on disk
- Maybe not initially, but should also support parsing information from log files (e.g. messages/sysvol/journalctl) for similar information
- ips in LinuxPlugin already does this
- This is best effort information, but very valuable if dissect can do this for the analyst
- Could also be nice to extend with /proc information down the line
- Maybe each network manager can be its own "NetworkPlugin", and there's a "parent" network plugin that loads as many compatible sub-network plugins and just iterates over all of them.
- Like the browser/other similar namespace plugins
- Log based can be a separate one of these as well
- Can utilize unix config parser
The text was updated successfully, but these errors were encountered:
Task 5/5 for network interface plugin
UnixInterfaceRecord
to indicate the networking system the record data was retrieved fromThe text was updated successfully, but these errors were encountered: