N Code Triggers |
N Code Triggers[ identA = ] identB ( [ identC | identD : expression ] [ , identE | ... ].. ) IdentA will be assigned the internal cookie value representing the trigger condition. That value may be used in the 'off' statement, to delete the trigger. IdentB identifies the trigger family. Currently the families are 'packet', 'ip', 'upd', and 'tcp'. Shortly, 'icmp' will also be added. Within the parenthesis are comma separated lists of qualifiers for the trigger. The qualifier names, and their values are controlled by the trigger family, allowing an extensible way of describing details about the particular event the trigger is intended to monitor. There are two forms for any qualifier, the first form is simply an identifier name, the second form associates an expression with an identifier. That expression can by of any type, but the trigger family will check for the semantics of the expression when the trigger is constructed. Triggers appear in two places in the syntax of .nfr. The first is inside the `filter' descriptions. The second is in the 'on' statement. Although these two forms are very similar, there is a minor difference; the 'filter' form of the trigger must be evaluated at the time the procedure is declared, and must therefore contain expressions which can be evaluated at compile time. The expressions which appear on the 'on' statement will be evaluated when the 'on' statement is performed. The expressions on the 'on' trigger can have values computed during the execution of the .nfr code. Triggers describe network sniffing events, for example, packet arrival, or udp packet on port 23 arrival, or more data in a tcp stream.... etc. The syntax for triggers is very rich. Examples: udp ( port : 23 ), packet (), tcp( start: "GET " ) The syntax for triggers looks like:
The `tname' is the name of some component protocol stack, which recognizes triggers. Current examples include, packet, udp, tcp. The `tid's are recognized as part of the protocol stack, and will vary depending on the value of `tname'. Here are udp's trigger `tid's:
Having no parameters-pairs inside the parentheses is also legal, and matches every packet. Here's some examples: udp ( host : 122.12.34.4 ) udp ( host : 122.12.3.4:255.255.255.0 ) udp ( host : [ 122.12.3.0:255.255.255.0 , 141.12.4.23:255.255.255.0 ] ) `tvalue' expressions are evaluated either at the time the filter is created, or when the `on' statement is executed. Complicated expressions can be included even as part of the filter declaration, but every value must be evaluated at the time of compilation for the filter trigger to be used. Examples are provided in the following Filter section and in the On Statement section. Tcp's triggers
Packet triggers You can use 'packet' as a tname, but currently there are no tid's associated with packets. We may decide to include some triggers, depending on arising needs. For example, trigger on packet length, or packet type (ie: ethernet). Timeout triggers Timeout triggers provide a preliminary mechanism to have procedures called at specific time intervals. A common usage would be to have some code executed once a minute, or once an hour.
|
|