lanscope 0.1.2

Passive eBPF-powered IoT device fingerprinting & anomaly detection for your LAN
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

//! Userspace protocol decoders.
//!
//! Each decoder turns one raw [`Event`] payload into zero or more
//! [`Observation`]s — small, typed facts about a device. Decoders are pure
//! (`&[u8] -> Vec<...>`), so they are trivially unit-testable against captured
//! byte fixtures and carry no I/O or state.

use lanscope_common::{Event, EventKind, Ipv4Be, MacAddr};

pub mod dhcp;
pub mod dns;
pub mod mdns;
pub mod ssdp;

/// A typed fact extracted from a frame.
#[derive(Clone, PartialEq, Eq, Debug)]
pub enum Signal {
    /// Device announced/observed a hostname.
    Hostname(String),
    /// An advertised service string (mDNS service type, SSDP server, …).
    Service(String),
    /// DHCP option-55 parameter-request-list fingerprint (comma-joined codes).
    DhcpFingerprint(String),
    /// DHCP option-60 vendor class identifier.
    DhcpVendorClass(String),
    /// Presence only (ARP / first sighting).
    Seen,
}

/// A [`Signal`] tagged with the device it pertains to.
#[derive(Clone, PartialEq, Eq, Debug)]
pub struct Observation {
    pub mac: MacAddr,
    pub ip: Option<Ipv4Be>,
    pub signal: Signal,
}

/// Decode a single capture event into observations.
///
/// Dispatch is by [`EventKind`]; unknown kinds yield a bare `Seen` so presence
/// is still recorded.
pub fn decode_event(ev: &Event) -> Vec<Observation> {
    let ip = (ev.src_ip != 0).then_some(ev.src_ip);
    let mac = ev.src_mac;
    let payload = ev.payload();

    let signals: Vec<Signal> = match ev.kind() {
        EventKind::Dhcp => dhcp::decode(payload),
        EventKind::Mdns => mdns::decode(payload),
        EventKind::Ssdp => ssdp::decode(payload),
        EventKind::Arp | EventKind::NewHost => vec![Signal::Seen],
        EventKind::TlsHello => vec![Signal::Seen], // JA4 parsing lands in a later milestone
        EventKind::Unknown => vec![Signal::Seen],
    };

    signals
        .into_iter()
        .map(|signal| Observation { mac, ip, signal })
        .collect()
}