Skip to content

Commit

Permalink
Update method for computing sha256 of packets
Browse files Browse the repository at this point in the history
This commit changes how packet hashes are computed. First, uses the
packet metadata timestamp as a salt. Second, it uses the entire packet
rahter than the UDP payload.
  • Loading branch information
chazlever committed Apr 9, 2021
1 parent aa2dbe8 commit 6ae42b3
Showing 1 changed file with 7 additions and 1 deletion.
8 changes: 7 additions & 1 deletion parser/parse.go
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,13 @@ PACKETLOOP:
schema.SourcePort = uint16(udp.SrcPort)
schema.DestinationPort = uint16(udp.DstPort)
schema.Udp = true
schema.Sha256 = fmt.Sprintf("%x", sha256.Sum256(udp.Payload))

// Hash and salt packet for grouping related records
tsSalt, err := packet.Metadata().Timestamp.MarshalBinary()
if err != nil {
log.Errorf("Could not marshal timestamp: #{err}\n")
}
schema.Sha256 = fmt.Sprintf("%x", sha256.Sum256(append(tsSalt, packet.Data()...)))
}

// This means we did not attempt to parse a DNS payload and
Expand Down

0 comments on commit 6ae42b3

Please sign in to comment.