#  1300, Fri 20 Oct 95
#
#  Rules to look at protocols by port
#
#  Nevil Brownlee,  ITSS Technology Development,  The University of Auckland
#
#  This rule set demonstrates a better way to classify IP ports.
#    It uses two groups of tests on SourceTransAddress and 
#    DestPeerAddress; these are optimised into hashed searches
#    by the meter.
#
SET 5
#
RULES
   SourcePeerType & 255 = dummy:      Ignore, 0;
   SourcePeerType & 255 = IP:         Pushto, IP_pkt;
   SourcePeerType & 255 = Novell:     Pushto, Novell_pkt;
   SourcePeerType & 255 = EtherTalk:  PushtoAct, AT_pkt;
   Null & 0 = 0:   GotoAct, Next;
   SourcePeerType & 255 = 0:      PushPkttoAct, Next;
   Null & 0 = 0:  Count, 0;  # Count others by protocol type
#
AT_pkt:  # Appletalk protocol type; no well-known ports
  SourceTransType & 255 = 0:      CountPkt, 0;
#
Novell_pkt:  # Novell 
n_451:
  SourceTransAddress & FF-FF = 04-51:   PushtoAct, n_trans_source;
n_452:
  SourceTransAddress & FF-FF = 04-52:   PushtoAct, n_trans_source;
n_453:
  SourceTransAddress & FF-FF = 04-53:   PushtoAct, n_trans_source;
n_455:
  SourceTransAddress & FF-FF = 04-55:   PushtoAct, n_trans_source;
n_4003:
  SourceTransAddress & FF-FF = 40-03:  PushtoAct, n_trans_source;
n_4008:
  SourceTransAddress & FF-FF = 40-08:  PushtoAct, n_trans_source;
#
  DestTransAddress & 255.255 = 1105:    GotoAct, n_451;
  DestTransAddress & 255.255 = 1106:    GotoAct, n_452;
  DestTransAddress & 255.255 = 1107:    GotoAct, n_453;
  DestTransAddress & 255.255 = 1109:    GotoAct, n_455;
  DestTransAddress & 255.255 = 16387:   GotoAct, n_4003;
  DestTransAddress & 255.255 = 16392:   GotoAct, n_4008;
#
  Null & 0 = 0:  GotoAct, n_bad;  #  'Unusual' port
n_bad:
  DestTransAddress   & 255.255 = 0: PushPktToAct, Next;
  SourceTransAddress & 255.255 = 0: PushPktToAct, Next;
n_trans_source:
  SourceTransType & 255 = 0:      CountPkt, 0;
#
IP_pkt:
  SourceTransType & 255 = tcp:    Pushto, tcp_udp;
  SourceTransType & 255 = udp:    Pushto, tcp_udp;
  SourceTransType & 255 = icmp:   PushtoAct, c_trans_only;
  SourceTransType & 255 = ospf:   PushtoAct, c_trans_only;
  Null & 0 = 0:  GotoAct, c_bad;  #  Unknown transport type
#
tcp_udp:
s_domain:
  SourceTransAddress & 255.255 = domain:  PushtoAct, c_trans_source;
s_finger:
  SourceTransAddress & 255.255 = 79:      PushtoAct, c_trans_source;
s_ftp:
  SourceTransAddress & 255.255 = ftp:     PushtoAct, c_trans_source;
s_ftpdata:
  SourceTransAddress & 255.255 = ftpdata: PushtoAct, c_trans_source;
s_gopher:
  SourceTransAddress & 255.255 = gopher:  PushtoAct, c_trans_source;
s_imap:
  SourceTransAddress & 255.255 = 113:     PushtoAct, c_trans_source;
s_login:
  SourceTransAddress & 255.255 = 513:     PushtoAct, c_trans_source;
s_netbios:
  SourceTransAddress & 255.255 = 138:     PushtoAct, c_trans_source;
s_news:
  SourceTransAddress & 255.255 = nntp:    PushtoAct, c_trans_source;
s_nfs
  SourceTransAddress & 255.255 = 2049:    PushtoAct, c_trans_source;
s_ntp:
  SourceTransAddress & 255.255 = ntp:     PushtoAct, c_trans_source;
s_pop:
  SourceTransAddress & 255.255 = 110:     PushtoAct, c_trans_source;
s_printer:
  SourceTransAddress & 255.255 = 515:     PushtoAct, c_trans_source;
s_smtp:
  SourceTransAddress & 255.255 = smtp:    PushtoAct, c_trans_source;
s_snmp:
  SourceTransAddress & 255.255 = snmp:    PushtoAct, c_trans_source;
s_telnet:
  SourceTransAddress & 255.255 = telnet:  PushtoAct, c_trans_source;
s_www:
  SourceTransAddress & 255.255 = www:     PushtoAct, c_trans_source;
s_xwin
  SourceTransAddress & 255.255 = 6000:    PushtoAct, c_trans_source;
#
  DestTransAddress & 255.255 = domain:    GotoAct, s_domain;
  DestTransAddress & 255.255 = 79:        GotoAct, s_finger;
  DestTransAddress & 255.255 = ftp:       GotoAct, s_ftp;
  DestTransAddress & 255.255 = ftpdata:   GotoAct, s_ftpdata;
  DestTransAddress & 255.255 = gopher:    GotoAct, s_gopher;
  DestTransAddress & 255.255 = 113:       GotoAct, s_imap;
  DestTransAddress & 255.255 = 513:       GotoAct, s_login;
  DestTransAddress & 255.255 = 138:       GotoAct, s_netbios;
  DestTransAddress & 255.255 = nntp:      GotoAct, s_news;
  DestTransAddress & 255.255 = 2049:      GotoAct, s_nfs;
  DestTransAddress & 255.255 = ntp:       GotoAct, s_ntp;
  DestTransAddress & 255.255 = 110:       GotoAct, s_pop;
  DestTransAddress & 255.255 = 515:       GotoAct, s_printer;
  DestTransAddress & 255.255 = smtp:      GotoAct, s_smtp;
  DestTransAddress & 255.255 = snmp:      GotoAct, s_snmp;
  DestTransAddress & 255.255 = telnet:    GotoAct, s_telnet;
  DestTransAddress & 255.255 = www:       GotoAct, s_www;
  DestTransAddress & 255.255 = 6000:      GotoAct, s_xwin;
#
  Null & 0 = 0:  GotoAct, c_bad;  #  'Unusual' port
c_bad:
  SourceTransAddress & 255.255 = 0: PushPktToAct, Next;
  DestTransAddress   & 255.255 = 0: PushPktToAct, Next;
c_trans_source:
c_trans_only:
  SourceTransType    & 255 = 0:     CountPkt, 0;
#
#
FORMAT
   FirstTime
   ToPDUs ToOctets "  " FromPDUs FromOctets "   "
   SourcePeerType SourceTransType SourceTransAddress DestTransAddress;
#
# end of file