Skip to content

L4 Protocol Probe

Module Status

TODO

Monitor the network for potentially dangerous protocols in a IX network like DHCP broadcasts or routing protocol multicasts.

Functionality

This IXpect probe checks broadcast and multicast packets for potentially dangerous packets. It detects and reports the following protocol packets:

  • DHCP
    • DHCPDISCOVER
    • DCHPv6 SOLICIT
  • FHRP
    • CARP
    • GLBP
    • HSRP
    • VRRP
  • IGP
    • OSPF Hello
    • OSPFv3 Hello
    • RIPv1 Update
    • RIPv2 Update
    • RIPng Update

Events

  • L4P_DHCP_DETECTED
  • L4P_FHRP_DETECTED
  • L4P_IGP_DETECTED

Configuration

l4_protocol:
    dhcp_detect: true
    fhrp_detect: true
    igp_detect: true