Anomaly detection

Flows, hosts, services and ARP pairs fed by every packet, the detectors (scans, sweeps, floods, failed and refused connections, DNS and HTTP errors, beacons, traffic spikes, protocol / port mismatches, DNS tunnels, ARP changes...), the live alerts, the w report and the s statistics with the packets-per-second chart.

Generated by make docs from the source and GCC's call graph. Back to the Function explorer.

src/anomaly/anom_alerts.c

Severity colors and labels, the live anomaly alerts printed after each tick, and the summary after a -I load

colors

static int colors(void)

src/anomaly/anom_alerts.c:16 · static · both builds

1 if the terminal shows colors, asked once

Called by: print_severity
Calls: term_colors, term_colors

severity_color

static char *severity_color(enum ANOM_SEVERITY sev)

src/anomaly/anom_alerts.c:25 · static · both builds

Called by: print_severity

print_severity

void print_severity(enum ANOM_SEVERITY sev, const char *text, int output_buffer)

src/anomaly/anom_alerts.c:34 · non-static · both builds

src/anomaly/anom_alerts.c Writes text in the severity's color when the terminal shows colors (from includes/anomaly.h)

Called by: print_severity_label, anomaly_load_summary, print_totals (anom_report.c), anomaly_print_tags, anom_chart_print
Calls: colors, severity_color, my_putstr

print_severity_label

void print_severity_label(enum ANOM_SEVERITY sev, int output_buffer)

src/anomaly/anom_alerts.c:44 · non-static · both builds

"[CRITICAL]", "[WARNING] ", "[INFO] " (colored) (from includes/anomaly.h)

Called by: anomaly_tick, anomaly_report, anomaly_print_packet
Calls: print_severity

list_base

static uint64_t list_base(netotter_t *netotter)

src/anomaly/anom_alerts.c:55 · static · both builds

The list's first capture time: the 'l' times count from it

Called by: anomaly_tick

anomaly_tick

void anomaly_tick(netotter_t *netotter)

src/anomaly/anom_alerts.c:60 · non-static · both builds

The new warning / critical anomalies as live alerts, ANOM_ALERTS_PER_TICK at most (the rest summed up). Settles the direct-IP checks first. (from includes/anomaly.h)

Called by: run_cli, run_interactive
Calls: print_severity_label, list_base, anom_direct_settle, anomaly_print, my_putstr, my_write

anomaly_load_summary

void anomaly_load_summary(netotter_t *netotter)

src/anomaly/anom_alerts.c:97 · non-static · both builds

After a -I load: one line with how many anomalies the capture holds (from includes/anomaly.h)

Called by: start_program
Calls: print_severity, anom_direct_settle, my_putunbr, my_putstr

src/anomaly/anom_arp.c

The passive ARP watch (an IP answering with another MAC, two MACs for one IP, one MAC for many IPs, the gateway's MAC) and the PTR bursts (one client resolving many addresses)

ip4_of

static void ip4_of(anom_ip_t *addr, const uint8_t ip[4])

src/anomaly/anom_arp.c:15 · static · both builds

Called by: raise_change, anom_arp_packet_anomaly
Library and system calls: memset

mac_of

static void mac_of(anom_ip_t *addr, const uint8_t mac[6])

src/anomaly/anom_arp.c:22 · static · both builds

A MAC stands in the key's first address (shared MACs)

Called by: count_mac_ip, anom_arp_packet_anomaly
Library and system calls: memcpy, memset

is_gateway

static int is_gateway(const anomalies_t *anom, const uint8_t mac[6])

src/anomaly/anom_arp.c:29 · static · both builds

1 if mac is the gateway's (the destination of traffic to the outside)

Called by: raise_change
Library and system calls: memcmp

anom_gateway_note

void anom_gateway_note(anomalies_t *anom, fpacket_t *packet, const anom_ip_t *dst)

src/anomaly/anom_arp.c:34 · non-static · both builds

An IP packet toward the outside: its Ethernet destination is the gateway's MAC (from includes/anomaly.h)

Called by: anomalies_packet
Calls: anom_ip_host, anom_ip_outside
Library and system calls: memcpy

count_mac_ip

static void count_mac_ip(anomalies_t *anom, const uint8_t mac[6], const uint8_t ip[4])

src/anomaly/anom_arp.c:45 · static · both builds

The MAC answers for one more address: a shared MAC past the limit

Called by: learn
Calls: mac_of, anom_table_get, anom_distinct_add, anomaly_raise, anomaly_key
Library and system calls: memcpy, memset

raise_change

static void raise_change(anomalies_t *anom, arp_entry_t *entry, const uint8_t mac[6])

src/anomaly/anom_arp.c:75 · static · both builds

The IP answered with another MAC: a change, or a conflict when the two MACs answer close together or the IP flips back

Called by: learn
Calls: ip4_of, is_gateway, anomaly_raise, anomaly_key
Library and system calls: memcmp, memcpy

learn

static void learn(anomalies_t *anom, const uint8_t ip[4], const uint8_t mac[6])

src/anomaly/anom_arp.c:103 · static · both builds

Who answers for ip: learned, or a change

Called by: anom_arp_packet
Calls: count_mac_ip, raise_change, anom_table_get
Library and system calls: memcmp, memcpy, memset

anom_arp_packet

void anom_arp_packet(anomalies_t *anom, fpacket_t *packet)

src/anomaly/anom_arp.c:127 · non-static · both builds

src/anomaly/anom_arp.c An ARP packet: learns who answers for which IP, raises ARP changes, conflicts and shared MACs (from includes/anomaly.h)

Called by: anomalies_packet
Calls: learn

anom_check_ptr

void anom_check_ptr(anomalies_t *anom, const l7_info_t *l7, const anom_ip_t *client, int1 own)

src/anomaly/anom_arp.c:134 · non-static · both builds

A reverse DNS query (PTR): counts the client's distinct names. local: the machine's own addresses (a burst from one of them is info). (from includes/anomaly.h)

Called by: anomalies_packet
Calls: anom_host, anom_distinct_add, anomaly_raise, anomaly_key
Library and system calls: calloc

anom_arp_packet_anomaly

const anomaly_t *anom_arp_packet_anomaly(const anomalies_t *anom, fpacket_t *packet, enum ANOM_KIND kind)

src/anomaly/anom_arp.c:158 · non-static · both builds

The anomaly of this kind an ARP packet is part of, NULL if none (from includes/anomaly.h)

Called by: anomaly_of_packet
Calls: ip4_of, mac_of, anom_table_find, anomaly_key

src/anomaly/anom_content.c

The content detectors: a standard port carrying another protocol (from the class of each flow's first data), and data hidden in DNS names (tunnelling)

port_class_of

const static_port_classes *port_class_of(uint8_t proto, uint16_t port)

src/anomaly/anom_content.c:14 · non-static · both builds

What the port should carry, NULL if it's not a well-known one

Called by: anom_check_class, print_content_subject

anom_check_class

void anom_check_class(anomalies_t *anom, flow_t *flow, int dir, uint8_t payload_class)

src/anomaly/anom_content.c:22 · non-static · both builds

src/anomaly/anom_content.c The first data of a flow in one direction: checked against what its port should carry (from includes/anomaly.h)

Called by: anomalies_packet
Calls: port_class_of, anomaly_raise, anomaly_key
Library and system calls: memset

anom_check_tunnel

void anom_check_tunnel(anomalies_t *anom, const l7_info_t *l7, const anom_ip_t *client)

src/anomaly/anom_content.c:51 · non-static · both builds

A DNS query: checked for data hidden in the names (from includes/anomaly.h)

Called by: anomalies_packet
Calls: anom_table_get, anom_rate_add, anom_rate_value, anom_distinct_add, anomaly_raise, anomaly_key
Library and system calls: memset

src/anomaly/anom_detect.c

The detectors, run on each new flow (request floods and bursts, brute force on login ports, ping sweeps), on its first reply (hosts outside the trusted networks, hosts reached without a name) and on failed attempts (port scans, sweeps)

auth_port

static int auth_port(uint8_t proto, uint16_t port)

src/anomaly/anom_detect.c:23 · static · both builds

Login services: a burst of connections to them is brute force

Called by: detect_flood

is_echo_request

static int is_echo_request(fpacket_t *packet)

src/anomaly/anom_detect.c:39 · static · both builds

An ICMP echo request (ping), IPv4 type 8 or ICMPv6 type 128

Called by: anom_detect_flow

chatty_port

static int chatty_port(uint8_t proto, uint16_t port)

src/anomaly/anom_detect.c:48 · static · both builds

Services that are chatty by nature: each DNS query is a new flow

Called by: detect_flood

ip_of

static void ip_of(anom_ip_t *addr, uint8_t v6, const uint8_t ip[16])

src/anomaly/anom_detect.c:54 · static · both builds

Called by: anom_detect_flow, anom_detect_failed, anom_detect_answered
Library and system calls: memset

set_peer

static void set_peer(anomaly_t *a, const anom_ip_t *peer)

src/anomaly/anom_detect.c:61 · static · both builds

Called by: detect_foreign, anom_direct_settle

detect_scan

static void detect_scan(anomalies_t *anom, const flow_t *flow, const anom_ip_t *client, const anom_ip_t *server)

src/anomaly/anom_detect.c:70 · static · both builds

Vertical scan: many ports of one host, from one source

Called by: anom_detect_failed
Calls: anom_table_get, anom_distinct_add, anomaly_raise, anomaly_key
Library and system calls: memset

detect_sweep

static void detect_sweep(anomalies_t *anom, const flow_t *flow, const anom_ip_t *client, const anom_ip_t *server)

src/anomaly/anom_detect.c:99 · static · both builds

Horizontal sweep: many hosts on one port (or pinged), from one source

Called by: anom_detect_flow, anom_detect_failed
Calls: anom_table_get, anom_distinct_add, anomaly_raise, anomaly_key, fnv1a
Library and system calls: memset

detect_flood

static void detect_flood(anomalies_t *anom, const flow_t *flow, const anom_ip_t *client, const anom_ip_t *server)

src/anomaly/anom_detect.c:128 · static · both builds

Flood (many clients) and burst / brute force (one client) on a service

Called by: anom_detect_flow
Calls: auth_port, chatty_port, anom_table_get, anom_rate_add, anom_rate_value, anom_beacon_event, anomaly_raise, anomaly_key
Library and system calls: memset

detect_foreign

static void detect_foreign(anomalies_t *anom, const anom_ip_t *addr, const anom_ip_t *peer)

src/anomaly/anom_detect.c:193 · static · both builds

A host outside the trusted networks (-T only): counted per flow

Called by: anom_detect_answered
Calls: set_peer, anom_ip_host, anom_ip_trusted, anomaly_raise, anomaly_key

queue_direct

static void queue_direct(anomalies_t *anom, const anom_ip_t *client, const anom_ip_t *server)

src/anomaly/anom_detect.c:212 · static · both builds

The server is outside the local networks: checked for a name once its grace time has passed (anom_direct_settle)

Called by: anom_detect_answered
Calls: anom_ip_host, anom_ip_outside, anom_table_find
Library and system calls: malloc, memset

count_endpoints

static void count_endpoints(anomalies_t *anom, const anom_ip_t *client, const anom_ip_t *server)

src/anomaly/anom_detect.c:244 · static · both builds

Called by: anom_detect_flow
Calls: anom_table_find
Library and system calls: memset

anom_detect_flow

void anom_detect_flow(anomalies_t *anom, flow_t *flow, fpacket_t *packet)

src/anomaly/anom_detect.c:261 · non-static · both builds

src/anomaly/anom_detect.c A new flow: scans, sweeps, floods and bursts (from includes/anomaly.h)

Called by: anomalies_packet
Calls: is_echo_request, ip_of, detect_sweep, detect_flood, count_endpoints

anom_detect_failed

void anom_detect_failed(anomalies_t *anom, flow_t *flow)

src/anomaly/anom_detect.c:277 · non-static · both builds

A failed connection attempt (refused, or no reply in time): scans and sweeps (from includes/anomaly.h)

Called by: anom_attempts_settle, refuse_udp, flow_reply
Calls: ip_of, detect_scan, detect_sweep

anom_attempt_queue

void anom_attempt_queue(anomalies_t *anom, flow_t *flow)

src/anomaly/anom_detect.c:288 · non-static · both builds

Waits for the reply of a new attempt (flow->attempt set) (from includes/anomaly.h)

Called by: anomalies_packet
Library and system calls: malloc

anom_attempts_settle

void anom_attempts_settle(anomalies_t *anom)

src/anomaly/anom_detect.c:308 · non-static · both builds

Fails the attempts that had no reply within ANOM_ATTEMPT_TIMEOUT_US (from includes/anomaly.h)

Called by: anomalies_packet
Calls: anom_detect_failed, anom_attempt_outcome, anom_table_find
Library and system calls: free

anom_detect_answered

void anom_detect_answered(anomalies_t *anom, flow_t *flow)

src/anomaly/anom_detect.c:336 · non-static · both builds

A flow that became a real connection (flow_established): foreign hosts and hosts reached without a name (from includes/anomaly.h)

Called by: anomalies_packet
Calls: ip_of, detect_foreign, queue_direct

anom_direct_settle

void anom_direct_settle(netotter_t *netotter)

src/anomaly/anom_detect.c:348 · non-static · both builds

Settles the direct-IP checks whose grace time has passed (from includes/anomaly.h)

Called by: anomaly_tick, anomaly_load_summary, anomaly_report
Calls: hostmap_find, set_peer, anomaly_raise, anomaly_key
Library and system calls: free

src/anomaly/anom_errors.c

The error detectors: services refusing or not answering their connections, SYN floods (half-open connections), failed DNS lookups and failing resolvers, routers reporting unreachable destinations, web servers answering errors

anom_service

service_t *anom_service(anomalies_t *anom, uint8_t v6, uint8_t proto, uint16_t port, const uint8_t ip[16])

src/anomaly/anom_errors.c:20 · non-static · both builds

The service of a flow, created if needed (NULL out of memory) (from includes/anomaly.h)

Called by: anom_attempt_started, anom_attempt_outcome, detect_http
Calls: anom_table_get
Library and system calls: memset

anom_host

host_stat_t *anom_host(anomalies_t *anom, const anom_ip_t *addr)

src/anomaly/anom_errors.c:34 · non-static · both builds

The host stats of an address, NULL if it's not tracked (from includes/anomaly.h)

Called by: anom_check_ptr, detect_dns, detect_icmp, anom_spike_packet
Calls: anom_table_find
Library and system calls: memset

service_ip

static void service_ip(anom_ip_t *addr, const service_t *service)

src/anomaly/anom_errors.c:43 · static · both builds

Called by: raise_service, a_extra_set
Library and system calls: memset

ratio_reached

static int ratio_reached(uint32_t part, uint32_t total)

src/anomaly/anom_errors.c:51 · static · both builds

1 if part is at least ANOM_ERR_RATIO_PCT % of total

Called by: anom_attempt_outcome, detect_dns, detect_http

raise_service

static void raise_service(anomalies_t *anom, enum ANOM_KIND kind, enum ANOM_SEVERITY sev, const service_t *service, uint32_t count, uint32_t total)

src/anomaly/anom_errors.c:57 · static · both builds

Raises (or updates) a service anomaly with count out of total

Called by: anom_attempt_outcome, detect_http
Calls: service_ip, anomaly_raise, anomaly_key

anom_attempt_started

void anom_attempt_started(anomalies_t *anom, const flow_t *flow)

src/anomaly/anom_errors.c:75 · non-static · both builds

Called by: anomalies_packet
Calls: anom_service, anom_rate_add

anom_attempt_outcome

void anom_attempt_outcome(anomalies_t *anom, const flow_t *flow, enum ANOM_OUTCOME outcome)

src/anomaly/anom_errors.c:84 · non-static · both builds

Called by: anom_attempts_settle, refuse_udp, flow_reply
Calls: anom_service, ratio_reached, raise_service, anom_rate_add, anom_rate_value

a_extra_set

static void a_extra_set(anomalies_t *anom, const service_t *service, uint32_t extra)

src/anomaly/anom_errors.c:118 · static · both builds

Sets the extra count of a service's HTTP errors anomaly (its 5xx)

Called by: detect_http
Calls: service_ip, anom_table_find, anomaly_key

detect_dns

static void detect_dns(anomalies_t *anom, const l7_info_t *l7, const anom_ip_t *resolver, const anom_ip_t *client)

src/anomaly/anom_errors.c:134 · static · both builds

A DNS answer: the client's failed lookups, the resolver's failures

Called by: anom_detect_l7
Calls: anom_host, ratio_reached, anom_rate_add, anom_rate_value, anom_distinct_add, anomaly_raise, anomaly_key
Library and system calls: calloc

port_unreachable

static int port_unreachable(const l7_info_t *l7, int1 v6)

src/anomaly/anom_errors.c:188 · static · both builds

1 for the "port unreachable" messages (ICMP 3/3, ICMPv6 1/4)

Called by: detect_icmp

refuse_udp

static void refuse_udp(anomalies_t *anom, const l7_info_t *l7)

src/anomaly/anom_errors.c:195 · static · both builds

A port unreachable refuses the UDP attempt it's about

Called by: detect_icmp
Calls: anom_detect_failed, anom_attempt_outcome, anom_table_find
Library and system calls: memset

detect_icmp

static void detect_icmp(anomalies_t *anom, fpacket_t *packet, const anom_ip_t *src)

src/anomaly/anom_errors.c:215 · static · both builds

Called by: anom_detect_l7
Calls: anom_host, port_unreachable, refuse_udp, anom_rate_add, anom_rate_value, anomaly_raise, anomaly_key

detect_http

static void detect_http(anomalies_t *anom, fpacket_t *packet, const anom_ip_t *server)

src/anomaly/anom_errors.c:246 · static · both builds

An HTTP response: the server's error ratio

Called by: anom_detect_l7
Calls: anom_service, ratio_reached, raise_service, a_extra_set, anom_rate_add, anom_rate_value

anom_detect_l7

void anom_detect_l7(anomalies_t *anom, fpacket_t *packet, const anom_ip_t *src, const anom_ip_t *dst)

src/anomaly/anom_errors.c:275 · non-static · both builds

The DNS, ICMP and HTTP facts of a packet: lookups, resolvers, ICMP errors (a port unreachable refuses its UDP flow), web servers (from includes/anomaly.h)

Called by: anomalies_packet
Calls: detect_dns, detect_icmp, detect_http

src/anomaly/anom_net.c

Address classes for the anomaly detectors (globally reachable, host or not), and the trusted networks given with -T

in_v4

static int in_v4(const uint8_t ip[4], uint8_t a, uint8_t b, uint8_t c, int prefix)

src/anomaly/anom_net.c:20 · static · both builds

1 if ip (4 bytes) is in net/prefix

Called by: v4_global, anom_ip_host
Calls: get32

same_prefix

static int same_prefix(const uint8_t *a, const uint8_t *b, int prefix)

src/anomaly/anom_net.c:32 · static · both builds

1 if the first prefix bits of a and b are the same

Called by: v6_global, anom_ip_trusted
Library and system calls: memcmp

v4_global

static int v4_global(const uint8_t ip[4])

src/anomaly/anom_net.c:47 · static · both builds

IANA IPv4 special-purpose registry: not globally reachable

Called by: anom_ip_global
Calls: in_v4

v6_global

static int v6_global(const uint8_t ip[16])

src/anomaly/anom_net.c:60 · static · both builds

Global unicast is 2000::/3, minus documentation (2001:db8::/32) and the IETF protocol assignments (2001::/23)

Called by: anom_ip_global
Calls: same_prefix

anom_ip_global

int anom_ip_global(const anom_ip_t *addr)

src/anomaly/anom_net.c:70 · non-static · both builds

src/anomaly/anom_net.c 1 if the address is reachable from the Internet (not private, shared, loopback, link-local, multicast, documentation... per the IANA special-purpose registries) (from includes/anomaly.h)

Called by: anom_ip_outside
Calls: v4_global, v6_global

anom_ip_host

int anom_ip_host(const anom_ip_t *addr)

src/anomaly/anom_net.c:75 · non-static · both builds

1 for unicast addresses that can be a host (not multicast, broadcast, unspecified, loopback or link-local) (from includes/anomaly.h)

Called by: anom_gateway_note, detect_foreign, queue_direct, print_talkers, print_outside, flow_is_attempt
Calls: in_v4
Library and system calls: memcmp

anom_ip_trusted

int anom_ip_trusted(const anomalies_t *anom, const anom_ip_t *addr)

src/anomaly/anom_net.c:90 · non-static · both builds

1 if the address is in one of the trusted networks (-T) (from includes/anomaly.h)

Called by: detect_foreign, anom_ip_outside
Calls: same_prefix

anom_ip_outside

int anom_ip_outside(const anomalies_t *anom, const anom_ip_t *addr)

src/anomaly/anom_net.c:100 · non-static · both builds

1 if the address is outside the local networks: the trusted networks with -T, the non-global ranges without it (from includes/anomaly.h)

Called by: anom_gateway_note, queue_direct, print_outside
Calls: anom_ip_global, anom_ip_trusted

parse_net

static int parse_net(char *text, anom_net_t *net)

src/anomaly/anom_net.c:109 · static · both builds

"192.0.2.0/24", "2001:db8::/32" or a single address into net. 0 on success, 1 if it's malformed.

Called by: trusted_parse
Calls: filter_parse_ipv4, filter_parse_ipv6
Library and system calls: memset, strchr

line_trim

static char *line_trim(char *line)

src/anomaly/anom_net.c:141 · static · both builds

The line without its comment and surrounding blanks

Called by: trusted_parse
Calls: my_strlen
Library and system calls: strchr

trusted_error

static int trusted_error(const char *path, int line_no, const char *text, const char *why)

src/anomaly/anom_net.c:157 · static · both builds

Called by: trusted_parse
Calls: my_putstr, my_write

trusted_parse

static int trusted_parse(anomalies_t *anom, const char *path, char *data)

src/anomaly/anom_net.c:173 · static · both builds

Called by: anom_trusted_load
Calls: parse_net, line_trim, trusted_error, my_putstr, my_strtok, tab_free

anom_trusted_load

int anom_trusted_load(anomalies_t *anom, const char *path)

src/anomaly/anom_net.c:202 · non-static · both builds

Reads the -T file (one network per line, # comments). 0 on success, 1 on an error (printed on stderr). (from includes/anomaly.h)

Called by: parse_arg
Calls: trusted_parse, my_putstr
Library and system calls: _errno, close, free, malloc, open, read, strerror

anom_trusted_print

void anom_trusted_print(const anomalies_t *anom, int output_buffer)

src/anomaly/anom_net.c:237 · non-static · both builds

Called by: print_outside
Calls: print_ipv4_raw, print_ipv6_raw, my_putunbr, my_putstr

src/anomaly/anom_report.c

The anomaly report ('w', most severe first), the statistics ('s': totals, top talkers, services, flows, outside hosts), and the anomaly tags / lines of the 'l' and 'i' output

print_addr in anom_report

static int print_addr(const anom_ip_t *addr, int output_buffer)

src/anomaly/anom_report.c:26 · static · both builds

Called by: print_service, print_error_subject, print_timing_subject, print_content_subject, print_arp_subject, print_subject
Calls: print_ipv4_raw, print_ipv6_raw

key_addr

static void key_addr(anom_ip_t *addr, const anomaly_key_t *key, int1 b)

src/anomaly/anom_report.c:33 · static · both builds

Called by: print_subject
Library and system calls: memset

proto_label

static char *proto_label(uint8_t proto)

src/anomaly/anom_report.c:40 · static · both builds

Called by: print_proto_suffix, print_subject

print_proto_suffix

static void print_proto_suffix(uint8_t proto, int output_buffer)

src/anomaly/anom_report.c:54 · static · both builds

"/tcp", or "/proto 47"

Called by: print_service, print_subject
Calls: proto_label, my_putunbr, my_putstr

print_service

static void print_service(const anom_ip_t *addr, uint16_t port, uint8_t proto, int output_buffer)

src/anomaly/anom_report.c:67 · static · both builds

"address:port/tcp" ("[v6]:port/tcp")

Called by: print_error_subject, print_timing_subject, print_content_subject, print_subject
Calls: print_addr (anom_report.c), print_proto_suffix, my_putunbr, my_putstr

print_count

static void print_count(uint32_t count, char *one, char *many, int output_buffer)

src/anomaly/anom_report.c:78 · static · both builds

Called by: print_error_subject, print_timing_subject, print_content_subject, print_arp_subject, print_subject, anomaly_report
Calls: my_putunbr, my_putstr

print_label

static void print_label(enum ANOM_KIND kind, int output_buffer)

src/anomaly/anom_report.c:85 · static · both builds

Called by: anomaly_print
Calls: my_putstr, my_strlen, my_write

print_ratio

static void print_ratio(uint32_t count, uint32_t total, char *what, int output_buffer)

src/anomaly/anom_report.c:96 · static · both builds

"40 of 50 <what> (80%)"

Called by: print_error_subject
Calls: my_putunbr, my_putstr

print_error_subject

static void print_error_subject(const anomaly_t *a, const anom_ip_t *ip_a, int output_buffer)

src/anomaly/anom_report.c:109 · static · both builds

The error kinds (refused, unanswered, SYN flood, DNS, unreachable, HTTP)

Called by: print_subject
Calls: print_addr (anom_report.c), print_service, print_count, print_ratio, my_putunbr, my_putstr

print_ms

static void print_ms(uint32_t ms, int output_buffer)

src/anomaly/anom_report.c:154 · static · both builds

"1.234 s" from a count of milliseconds

Called by: print_timing_subject
Calls: print_padded, my_putunbr, my_putstr, my_write

print_timing_subject

static void print_timing_subject(const anomaly_t *a, const anom_ip_t *ip_a, const anom_ip_t *ip_b, int output_buffer)

src/anomaly/anom_report.c:163 · static · both builds

Beaconing and spikes

Called by: print_subject
Calls: print_addr (anom_report.c), print_service, print_count, print_ms, my_putunbr, my_putstr, my_write

print_content_subject

static void print_content_subject(const anomaly_t *a, const anom_ip_t *ip_a, int output_buffer)

src/anomaly/anom_report.c:192 · static · both builds

A standard port carrying another protocol, data in DNS names

Called by: print_subject
Calls: port_class_of, print_addr (anom_report.c), print_service, print_count, my_putunbr, my_putstr

print_arp_subject

static void print_arp_subject(const anomaly_t *a, const anom_ip_t *ip_a, int output_buffer)

src/anomaly/anom_report.c:219 · static · both builds

The ARP watch and PTR bursts

Called by: print_subject
Calls: print_mac, print_addr (anom_report.c), print_count, my_putstr

print_subject

static void print_subject(const anomaly_t *a, int output_buffer)

src/anomaly/anom_report.c:267 · static · both builds

What the anomaly is about and its evidence, by kind

Called by: anomaly_print
Calls: print_addr (anom_report.c), key_addr, proto_label, print_proto_suffix, print_service, print_count, print_error_subject, print_timing_subject, print_content_subject, print_arp_subject, my_putunbr, my_putstr

anomaly_print

void anomaly_print(const anomalies_t *anom, const anomaly_t *a, uint64_t base_us, int output_buffer)

src/anomaly/anom_report.c:358 · non-static · both builds

One anomaly in a line, without its severity label (from includes/anomaly.h)

Called by: anomaly_tick, anomaly_report, anomaly_print_packet
Calls: print_rel_time, print_label, print_subject, my_putstr

compare_anomalies

static int compare_anomalies(const void *left, const void *right)

src/anomaly/anom_report.c:375 · static · both builds

Most severe first, then in the order they were found

Called by: nothing

count_packets

static void count_packets(netotter_t *netotter)

src/anomaly/anom_report.c:389 · static · both builds

Counts each anomaly's packets: a packet counts for every anomaly it's part of, including the ones before it was found

Called by: anomaly_report
Calls: anomaly_of_packet

print_totals in anom_report

static void print_totals(const anomalies_t *anom, int output_buffer)

src/anomaly/anom_report.c:405 · static · both builds

Called by: anomaly_report
Calls: print_severity, my_putunbr, my_putstr

print_kind_names

static void print_kind_names(int output_buffer)

src/anomaly/anom_report.c:427 · static · both builds

Called by: anomaly_report
Calls: my_putstr

anomaly_report

void anomaly_report(netotter_t *netotter, int output_buffer)

src/anomaly/anom_report.c:437 · non-static · both builds

src/anomaly/anom_report.c 'w': every anomaly, most severe first (from includes/anomaly.h)

Called by: run_cli, warnings_command
Calls: print_severity_label, anom_direct_settle, print_count, anomaly_print, count_packets, print_totals (anom_report.c), print_kind_names, my_putunbr, my_putstr
Library and system calls: free, malloc, qsort

anomaly_print_tags

void anomaly_print_tags(const anomalies_t *anom, fpacket_t *packet, int output_buffer)

src/anomaly/anom_report.c:483 · non-static · both builds

The 'l' tags of a packet (" !scan,flood"), nothing if it has none (from includes/anomaly.h)

Called by: print_packet_line
Calls: print_severity, anomaly_packet_kinds, anomaly_packet_severity, my_strappend

anomaly_print_packet

void anomaly_print_packet(const anomalies_t *anom, fpacket_t *packet, uint64_t base_us, int output_buffer)

src/anomaly/anom_report.c:504 · non-static · both builds

The 'i' line(s): every anomaly the packet is part of (from includes/anomaly.h)

Called by: print_packet_info
Calls: print_severity_label, anomaly_print, anomaly_of_packet, my_putstr

src/anomaly/anom_stats.c

The traffic statistics ('s', and at the end of -c): totals, top talkers, services and flows, and the hosts outside the local networks

top_add

static void top_add(top_t top[ANOM_TOP], const anom_entry_t *entry, uint64_t value)

src/anomaly/anom_stats.c:23 · static · both builds

Keeps the ANOM_TOP biggest values in top (sorted, biggest first)

Called by: print_talkers, print_services, print_flows, print_outside
Library and system calls: memmove

print_size

static void print_size(uint64_t bytes, int output_buffer)

src/anomaly/anom_stats.c:38 · static · both builds

"512 B", "1.5 KiB", "12.0 MiB"...

Called by: print_totals (anom_stats.c), print_talkers, print_flows, print_outside
Calls: my_putunbr, my_putstr, my_write

print_addr in anom_stats

static int print_addr(int1 v6, const uint8_t *ip, int output_buffer)

src/anomaly/anom_stats.c:60 · static · both builds

Called by: print_endpoint, print_talkers, print_flows, print_outside
Calls: print_ipv4_raw, print_ipv6_raw

addr_len

static int addr_len(int1 v6, const uint8_t *ip)

src/anomaly/anom_stats.c:68 · static · both builds

Length of an address as print_addr writes it

Called by: endpoint_len, print_talkers, print_flows, print_outside
Calls: format_ip_text

pad_to

static void pad_to(int len, int width, int output_buffer)

src/anomaly/anom_stats.c:79 · static · both builds

Called by: print_endpoint, print_talkers, print_flows, print_outside
Calls: my_write

proto_name

static char *proto_name(uint8_t proto)

src/anomaly/anom_stats.c:85 · static · both builds

Called by: endpoint_len, print_endpoint

endpoint_len

static int endpoint_len(int1 v6, const uint8_t *ip, uint16_t port, uint8_t proto)

src/anomaly/anom_stats.c:98 · static · both builds

Called by: print_services, print_flows
Calls: addr_len, proto_name, my_strlen, my_nlen

print_endpoint

static void print_endpoint(int1 v6, const uint8_t *ip, uint16_t port, uint8_t proto, int width, int output_buffer)

src/anomaly/anom_stats.c:109 · static · both builds

"address:port/tcp" padded to width

Called by: print_services, print_flows
Calls: print_addr (anom_stats.c), pad_to, proto_name, my_putunbr, my_putstr, my_strlen, my_nlen, my_write

print_totals in anom_stats

static void print_totals(netotter_t *netotter, int output_buffer)

src/anomaly/anom_stats.c:129 · static · both builds

Called by: anomaly_stats
Calls: print_rel_time, print_size, my_putunbr, my_putstr

print_talkers

static void print_talkers(anomalies_t *anom, int output_buffer)

src/anomaly/anom_stats.c:155 · static · both builds

Called by: anomaly_stats
Calls: anom_ip_host, top_add, print_size, print_addr (anom_stats.c), addr_len, pad_to, my_putunbr, my_putstr

print_services

static void print_services(anomalies_t *anom, int output_buffer)

src/anomaly/anom_stats.c:192 · static · both builds

Called by: anomaly_stats
Calls: top_add, endpoint_len, print_endpoint, my_putunbr, my_putstr

print_flows

static void print_flows(anomalies_t *anom, int output_buffer)

src/anomaly/anom_stats.c:225 · static · both builds

Called by: anomaly_stats
Calls: print_rel_time, top_add, print_size, print_addr (anom_stats.c), addr_len, pad_to, endpoint_len, print_endpoint, my_putunbr, my_putstr

print_outside

static void print_outside(netotter_t *netotter, int output_buffer)

src/anomaly/anom_stats.c:268 · static · both builds

The hosts outside the local networks, with the name the traffic showed for them

Called by: anomaly_stats
Calls: hostmap_find, anom_ip_host, anom_ip_outside, anom_trusted_print, top_add, print_size, print_addr (anom_stats.c), addr_len, pad_to, my_putunbr, my_putstr

anomaly_stats

void anomaly_stats(netotter_t *netotter, int output_buffer)

src/anomaly/anom_stats.c:309 · non-static · both builds

's': totals, top talkers, services, flows, external hosts (from includes/anomaly.h)

Called by: run_cli, stats_command
Calls: print_totals (anom_stats.c), print_talkers, print_services, print_flows, print_outside, anom_chart_print

src/anomaly/anom_table.c

The anomaly detectors' hash tables (fixed key, least recently used entry forgotten past their size) and sliding-window rates

anom_table_init

void anom_table_init(anom_table_t *table, int key_len, int entry_size, uint32_t max, void (*release)(anom_entry_t *))

src/anomaly/anom_table.c:13 · non-static · both builds

src/anomaly/anom_table.c (from includes/anomaly.h)

Called by: anomalies_init
Library and system calls: memset

anom_table_free

void anom_table_free(anom_table_t *table)

src/anomaly/anom_table.c:23 · non-static · both builds

Called by: anomalies_free
Library and system calls: free

entry_key

static const uint8_t *entry_key(const anom_entry_t *entry)

src/anomaly/anom_table.c:41 · static · both builds

Called by: anom_table_find

anom_table_find

anom_entry_t *anom_table_find(const anom_table_t *table, const void *key)

src/anomaly/anom_table.c:46 · non-static · both builds

The entry with this key, NULL if there's none. Doesn't touch the LRU. (from includes/anomaly.h)

Called by: anom_arp_packet_anomaly, queue_direct, count_endpoints, anom_attempts_settle, anom_host, a_extra_set, refuse_udp, anom_table_get, anomaly_raise, flow_of, service_anomaly, packet_anomaly
Calls: entry_key, fnv1a
Library and system calls: memcmp

lru_unlink

static void lru_unlink(anom_table_t *table, anom_entry_t *entry)

src/anomaly/anom_table.c:62 · static · both builds

Called by: evict_oldest, anom_table_get

lru_push

static void lru_push(anom_table_t *table, anom_entry_t *entry)

src/anomaly/anom_table.c:76 · static · both builds

Called by: anom_table_get

evict_oldest

static void evict_oldest(anom_table_t *table)

src/anomaly/anom_table.c:88 · static · both builds

Forgets the least recently used entry

Called by: anom_table_get
Calls: lru_unlink
Library and system calls: free

anom_table_get

anom_entry_t *anom_table_get(anom_table_t *table, const void *key, int1 evict, int1 *created)

src/anomaly/anom_table.c:108 · non-static · both builds

The entry with this key, created (zeroed, key copied) if needed, and made the newest. created says whether it's new. NULL if out of memory, or for a table without eviction (release == NULL and max reached) when it's full. (from includes/anomaly.h)

Called by: count_mac_ip, learn, anom_check_tunnel, detect_scan, detect_sweep, detect_flood, anom_service, anom_client, anomaly_raise, host_count, flow_of
Calls: anom_table_find, lru_unlink, lru_push, evict_oldest, fnv1a
Library and system calls: calloc, memcpy

rate_roll

static void rate_roll(anom_rate_t *rate, uint64_t now_us)

src/anomaly/anom_table.c:146 · static · both builds

Moves the window forward to now_us: a window ago or more, the current count becomes the previous one, two windows ago both are gone

Called by: anom_rate_add, anom_rate_value

anom_rate_add

void anom_rate_add(anom_rate_t *rate, uint64_t now_us)

src/anomaly/anom_table.c:163 · non-static · both builds

Called by: anom_check_tunnel, detect_flood, anom_attempt_started, anom_attempt_outcome, detect_dns, detect_icmp, detect_http
Calls: rate_roll

anom_rate_value

uint32_t anom_rate_value(const anom_rate_t *rate, uint64_t now_us)

src/anomaly/anom_table.c:169 · non-static · both builds

Called by: anom_check_tunnel, detect_flood, anom_attempt_outcome, detect_dns, detect_icmp, detect_http
Calls: rate_roll

mix32

static uint32_t mix32(uint32_t value)

src/anomaly/anom_table.c:181 · static · both builds

Called by: set_put

set_put

static void set_put(uint32_t *values, uint32_t slots, uint32_t value, uint32_t *total)

src/anomaly/anom_table.c:192 · static · both builds

Puts value in the slots (without growing), counting it when it's new. Slots hold value + 1 (0 is empty): 0xFFFFFFFF shares its slot value with 0xFFFFFFFE, a collision a hash can afford.

Called by: set_grow, set_add
Calls: mix32

set_grow

static int set_grow(anom_distinct_t *set)

src/anomaly/anom_table.c:208 · static · both builds

Doubles the slots once they're half full. 0 on success, 1 when out of memory or at ANOM_DISTINCT_MAX.

Called by: set_add
Calls: set_put
Library and system calls: calloc, free

set_add

static void set_add(anom_distinct_t *set, uint32_t value)

src/anomaly/anom_table.c:230 · static · both builds

Called by: anom_distinct_add
Calls: set_put, set_grow

distinct_expire

static void distinct_expire(anom_distinct_t *set, uint64_t now_us)

src/anomaly/anom_table.c:237 · static · both builds

Forgets the values last seen more than a window before now_us

Called by: anom_distinct_add

anom_distinct_add

int anom_distinct_add(anom_distinct_t *set, uint32_t value, uint64_t now_us, int threshold)

src/anomaly/anom_table.c:249 · non-static · both builds

Adds value (a port, or a host / domain hash). Returns 1 the first time threshold distinct values are seen within the window. Out of memory, or past ANOM_DISTINCT_MAX, total stops growing. (from includes/anomaly.h)

Called by: count_mac_ip, anom_check_ptr, anom_check_tunnel, detect_scan, detect_sweep, detect_dns
Calls: set_add, distinct_expire
Library and system calls: memmove

anom_distinct_free

void anom_distinct_free(anom_distinct_t *set)

src/anomaly/anom_table.c:284 · non-static · both builds

Called by: release_host, release_mac, release_pair, release_sweep, release_tunnel
Library and system calls: free

src/anomaly/anom_timing.c

The time-based detectors: beaconing (a client reaching a server at regular times) and traffic spikes (a second far busier than usual), and the packets-per-second chart of the statistics

anom_client

client_t *anom_client(anomalies_t *anom, const flow_t *flow)

src/anomaly/anom_timing.c:20 · non-static · both builds

The client entry of a flow (created if needed), for its events (from includes/anomaly.h)

Called by: udp_event
Calls: anom_table_get
Library and system calls: memset

periodic_port

static int periodic_port(uint8_t proto, uint16_t port)

src/anomaly/anom_timing.c:35 · static · both builds

Periodic by design: NTP, DHCP, NetBIOS, SSDP, mDNS, LLMNR

Called by: anom_beacon_event

sort_u32

static void sort_u32(uint32_t *values, uint32_t count)

src/anomaly/anom_timing.c:42 · static · both builds

Called by: median_u32

median_u32

static uint32_t median_u32(uint32_t *values, uint32_t count)

src/anomaly/anom_timing.c:55 · static · both builds

Called by: anom_beacon_event
Calls: sort_u32

anom_beacon_event

void anom_beacon_event(anomalies_t *anom, client_t *client)

src/anomaly/anom_timing.c:64 · non-static · both builds

src/anomaly/anom_timing.c A connection start of a client: checks its channel for beaconing (from includes/anomaly.h)

Called by: detect_flood, udp_event
Calls: periodic_port, median_u32, anomaly_raise, anomaly_key
Library and system calls: memcpy, memset

chart_add

static void chart_add(anomalies_t *anom, uint32_t value)

src/anomaly/anom_timing.c:114 · static · both builds

Appends the packet count of a second to the chart

Called by: anom_spike_packet
Library and system calls: realloc

raise_spike

static void raise_spike(anomalies_t *anom, uint32_t packets)

src/anomaly/anom_timing.c:142 · static · both builds

A second far above the baseline: a spike, named after its busiest sender

Called by: second_done
Calls: anomaly_raise, anomaly_key

second_done

static int second_done(anomalies_t *anom, uint32_t packets)

src/anomaly/anom_timing.c:161 · static · both builds

One finished second: a spike, or part of the baseline

Called by: anom_spike_packet
Calls: raise_spike

anom_spike_packet

void anom_spike_packet(anomalies_t *anom, fpacket_t *packet, const anom_ip_t *src, const anom_ip_t *dst, int1 has_ips)

src/anomaly/anom_timing.c:181 · non-static · both builds

Counts a packet in its second; a finished second is checked for a spike (from includes/anomaly.h)

Called by: anomalies_packet
Calls: anom_host, chart_add, second_done

chart_columns

static void chart_columns(const anomalies_t *anom, uint32_t *columns, int *count, uint32_t *per_column)

src/anomaly/anom_timing.c:224 · static · both builds

The chart's columns: the busiest second of each (with its spike flag)

Called by: anom_chart_print
Library and system calls: memset

anom_chart_print

void anom_chart_print(const anomalies_t *anom, int output_buffer)

src/anomaly/anom_timing.c:245 · non-static · both builds

The 's' rate chart (from includes/anomaly.h)

Called by: anomaly_stats
Calls: print_severity, chart_columns, my_putunbr, my_putstr, my_write

src/anomaly/anomaly.c

The anomaly detection state: every new packet updates the flow and host tables, new flows go to the detectors, and a packet can be matched back to the anomalies it's part of

release_host

static void release_host(anom_entry_t *entry)

src/anomaly/anomaly.c:18 · static · both builds

Called by: nothing
Calls: anom_distinct_free
Library and system calls: free

release_mac

static void release_mac(anom_entry_t *entry)

src/anomaly/anomaly.c:30 · static · both builds

Called by: nothing
Calls: anom_distinct_free

release_pair

static void release_pair(anom_entry_t *entry)

src/anomaly/anomaly.c:35 · static · both builds

Called by: nothing
Calls: anom_distinct_free

release_sweep

static void release_sweep(anom_entry_t *entry)

src/anomaly/anomaly.c:40 · static · both builds

Called by: nothing
Calls: anom_distinct_free

release_tunnel

static void release_tunnel(anom_entry_t *entry)

src/anomaly/anomaly.c:45 · static · both builds

Called by: nothing
Calls: anom_distinct_free

anomalies_init

void anomalies_init(anomalies_t *anom)

src/anomaly/anomaly.c:50 · non-static · both builds

src/anomaly/anomaly.c (from includes/anomaly.h)

Called by: netotter_new
Calls: anom_table_init
Library and system calls: memset

anomalies_free

void anomalies_free(anomalies_t *anom)

src/anomaly/anomaly.c:75 · non-static · both builds

Called by: netotter_delete
Calls: anom_table_free
Library and system calls: free

anomaly_raise

anomaly_t *anomaly_raise(anomalies_t *anom, const anomaly_key_t *key, enum ANOM_SEVERITY sev, uint64_t now_us)

src/anomaly/anomaly.c:108 · non-static · both builds

The anomaly of this key, created (severity sev, at now_us) if needed. NULL if ANOM_MAX was reached. (from includes/anomaly.h)

Called by: count_mac_ip, raise_change, anom_check_ptr, anom_check_class, anom_check_tunnel, detect_scan, detect_sweep, detect_flood, detect_foreign, anom_direct_settle, raise_service, detect_dns, detect_icmp, anom_beacon_event, raise_spike
Calls: anom_table_find, anom_table_get

anom_packet_ips

int anom_packet_ips(fpacket_t *packet, anom_ip_t *src, anom_ip_t *dst)

src/anomaly/anomaly.c:138 · non-static · both builds

The packet's IP endpoints into src / dst. 0 if it's not IPv4 / IPv6. (from includes/anomaly.h)

Called by: anomalies_packet, anomaly_of_packet
Library and system calls: memset

packet_proto

static uint8_t packet_proto(fpacket_t *packet)

src/anomaly/anomaly.c:158 · static · both builds

The IP protocol after the IPv6 extension headers

Called by: flow_of, service_anomaly, packet_anomaly

packet_ip_len

static uint32_t packet_ip_len(fpacket_t *packet)

src/anomaly/anomaly.c:168 · static · both builds

The packet's size at the IP layer (its header included)

Called by: anomalies_packet

host_count

static void host_count(anomalies_t *anom, const anom_ip_t *addr, uint32_t len, int1 out, uint64_t ts)

src/anomaly/anomaly.c:177 · static · both builds

Called by: anomalies_packet
Calls: anom_table_get
Library and system calls: memset

flow_key_set

static void flow_key_set(flow_key_t *key, uint8_t proto, const anom_ip_t *client, uint16_t port_c, const anom_ip_t *server, uint16_t port_s)

src/anomaly/anomaly.c:201 · static · both builds

Called by: flow_of
Library and system calls: memset

src_is_client

static int src_is_client(fpacket_t *packet)

src/anomaly/anomaly.c:216 · static · both builds

1 if the packet's source started its connection: a SYN without ACK, not a SYN-ACK, else the higher port (clients use ephemeral ports)

Called by: flow_of

flow_of

static flow_t *flow_of(anomalies_t *anom, fpacket_t *packet, const anom_ip_t *src, const anom_ip_t *dst, int *dir, int1 *created)

src/anomaly/anomaly.c:232 · static · both builds

The packet's flow, created when it's new (then *created is set), and which way it goes (*dir: 0 client -> server)

Called by: anomalies_packet
Calls: anom_table_find, anom_table_get, packet_proto, flow_key_set, src_is_client

flow_is_attempt

static int flow_is_attempt(const flow_t *flow, fpacket_t *packet, const anom_ip_t *dst)

src/anomaly/anomaly.c:261 · static · both builds

A new flow is a connection attempt when the client opened it, to a host (not a multicast or broadcast address): a TCP SYN without ACK, or the first UDP datagram

Called by: anomalies_packet
Calls: anom_ip_host

flow_reply

static void flow_reply(anomalies_t *anom, flow_t *flow, fpacket_t *packet)

src/anomaly/anomaly.c:274 · static · both builds

A packet from the server: a RST before any other reply refuses the attempt, anything else answers it (the connection happened)

Called by: anomalies_packet
Calls: anom_detect_failed, anom_attempt_outcome

flow_established

static int flow_established(const flow_t *flow)

src/anomaly/anomaly.c:296 · static · both builds

1 once the flow is a real connection: the client acknowledged the server's SYN-ACK (spoofed SYNs never do), or, joined mid-stream, both sides talked without a SYN or a RST

Called by: anomalies_packet

udp_event

static void udp_event(anomalies_t *anom, const flow_t *flow)

src/anomaly/anomaly.c:309 · static · both builds

Called by: anomalies_packet
Calls: anom_client, anom_beacon_event

anomalies_packet

void anomalies_packet(netotter_t *netotter, fpacket_t *packet)

src/anomaly/anomaly.c:317 · non-static · both builds

Feeds one packet (just added to the list) to every detector (from includes/anomaly.h)

Called by: packets_add
Calls: local_find, anom_gateway_note, anom_arp_packet, anom_check_ptr, anom_check_class, anom_check_tunnel, anom_detect_flow, anom_attempt_queue, anom_attempts_settle, anom_detect_answered, anom_attempt_started, anom_detect_l7, anom_spike_packet, anom_packet_ips, packet_ip_len, host_count, flow_of, flow_is_attempt, flow_reply, flow_established, udp_event

key_set

static void key_set(anomaly_key_t *key, enum ANOM_KIND kind, uint8_t proto, uint16_t port, const anom_ip_t *a, const anom_ip_t *b)

src/anomaly/anomaly.c:388 · static · both builds

The key of an anomaly

Called by: service_anomaly, packet_anomaly, anomaly_key
Library and system calls: memset

service_anomaly

static anom_entry_t *service_anomaly(const anomalies_t *anom, fpacket_t *packet, enum ANOM_KIND kind, const anom_ip_t *src, const anom_ip_t *dst)

src/anomaly/anomaly.c:403 · static · both builds

The packets of a service anomaly: to or from the service, and the ICMP errors about packets sent to it

Called by: packet_anomaly
Calls: anom_table_find, packet_proto, key_set
Library and system calls: memset

packet_anomaly

static const anomaly_t *packet_anomaly(const anomalies_t *anom, fpacket_t *packet, enum ANOM_KIND kind, const anom_ip_t *src, const anom_ip_t *dst)

src/anomaly/anomaly.c:430 · static · both builds

The anomaly of this kind the packet is part of, NULL if none: each kind is keyed the way the detectors raise it, tried both ways

Called by: anomaly_of_packet
Calls: anom_table_find, packet_proto, key_set, service_anomaly
Library and system calls: memset

anomaly_packet_kinds

uint32_t anomaly_packet_kinds(const anomalies_t *anom, fpacket_t *packet)

src/anomaly/anomaly.c:510 · non-static · both builds

Bit (1 << kind) for every anomaly this packet is part of (from includes/anomaly.h)

Called by: anomaly_match, anomaly_print_tags
Calls: anomaly_of_packet

anomaly_packet_severity

int anomaly_packet_severity(const anomalies_t *anom, fpacket_t *packet)

src/anomaly/anomaly.c:522 · non-static · both builds

The highest severity among those kinds' anomalies of this packet, -1 if none (from includes/anomaly.h)

Called by: anomaly_print_tags
Calls: anomaly_of_packet

anomaly_of_packet

const anomaly_t *anomaly_of_packet(const anomalies_t *anom, fpacket_t *packet, enum ANOM_KIND kind)

src/anomaly/anomaly.c:538 · non-static · both builds

The anomaly of this kind a packet is part of, for the report and 'i'

Called by: count_packets, anomaly_print_packet, anomaly_packet_kinds, anomaly_packet_severity
Calls: anom_arp_packet_anomaly, anom_packet_ips, packet_anomaly

anomaly_key

void anomaly_key(anomaly_key_t *key, enum ANOM_KIND kind, uint8_t proto, uint16_t port, const anom_ip_t *a, const anom_ip_t *b)

src/anomaly/anomaly.c:552 · non-static · both builds

The key of an anomaly (b NULL when it has a single address) (from includes/anomaly.h)

Called by: count_mac_ip, raise_change, anom_check_ptr, anom_arp_packet_anomaly, anom_check_class, anom_check_tunnel, detect_scan, detect_sweep, detect_flood, detect_foreign, anom_direct_settle, raise_service, a_extra_set, detect_dns, detect_icmp, anom_beacon_event, raise_spike
Calls: key_set