Wireshark-bugs: [Wireshark-bugs] [Bug 8379] New: HPFEEDS protocol : honeypot protocol feeds supp

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Fri, 22 Feb 2013 11:35:55 +0000
Bug ID 8379
Summary HPFEEDS protocol : honeypot protocol feeds support added
Classification Unclassified
Product Wireshark
Version SVN
Hardware x86
OS All
Status UNCONFIRMED
Severity Enhancement
Priority Low
Component Dissection engine (libwireshark)
Assignee [email protected]
Reporter [email protected] 

Created attachment 10089 [details]
packet-hpfeeds patch

Build Information:

--
This is the first basic implementation of hpfeeds (lightweight authenticated
publish/subscribe protocol for exchanging live datafeed).
This protocol is especially used to exchange data between honeypots and provide
live updates to subscribed clients.
This protocol use TCP port 10000
The protocol is very easy, 5 types of messages exists so far.
All messages share a common header.

The decoder is very simple and passed fuzzing test.

Common used honeypots (dionaea, kippo, glastopf) provides support for this
protocol with additional modules.

Other information regarding this protocol can be found here:
https://redmine.honeynet.org/projects/hpfeeds/wiki

You are receiving this mail because:
  • You are watching all bug changes.