diff --git a/.clang-format b/.clang-format new file mode 100644 index 0000000..8963135 --- /dev/null +++ b/.clang-format @@ -0,0 +1 @@ +.clang_format_style": "{ BasedOnStyle: Google, BraceWrapping: { AfterFunction: false } }" \ No newline at end of file diff --git a/.vscode/c_cpp_properties.json b/.vscode/c_cpp_properties.json deleted file mode 100644 index c2098a2..0000000 --- a/.vscode/c_cpp_properties.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "configurations": [ - { - "name": "linux-gcc-x64", - "includePath": [ - "${workspaceFolder}/**" - ], - "compilerPath": "/usr/bin/gcc", - "cStandard": "${default}", - "cppStandard": "${default}", - "intelliSenseMode": "linux-gcc-x64", - "compilerArgs": [ - "" - ] - } - ], - "version": 4 -} \ No newline at end of file diff --git a/.vscode/launch.json b/.vscode/launch.json deleted file mode 100644 index 3b374ad..0000000 --- a/.vscode/launch.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "version": "0.2.0", - "configurations": [ - { - "name": "Run MyApp", - "type": "cppdbg", - "request": "launch", - "program": "${workspaceRoot}/d/sh3env/bin/snort", - "args": [], - "stopAtEntry": false, - "cwd": "${workspaceFolder}", - "environment": [ - { - "name": "LD_LIBRARY_PATH", - "value": "${workspaceFolder}" - } - ], - "externalConsole": false, - "MIMode": "gdb", - "miDebuggerPath": "/usr/bin/gdb", - "setupCommands": [ - { - "description": "Enable pretty printing", - "text": "-enable-pretty-printing", - "ignoreFailures": true - } - ] - }, - { - "name": "C/C++ Runner: Debug Session", - "type": "cppdbg", - "request": "launch", - "program": "${workspaceRoot}/d/sh3env/bin/snort", - "cwd": "${workspaceRoot}/d/sh3env", - "environment": [ - { - "name": "LD_LIBRARY_PATH", - "value": "${workspaceRoot}/d/sh3env/lib" - }, - ], - "MIMode": "gdb", - "miDebuggerPath": "/usr/bin/gdb", - "args": [ - "-v", - "--warn-all", - "--plugin-path", - "${workspaceRoot}/d/sh3env/p/tm.so", - "-c", - "${workspaceRoot}/d/sh3env/cfg.lua", - "--pcap-list", - "${workspaceRoot}/d/sh3env/testdata/DNP3_0000.pcap" - ], - "setupCommands": [ - { - "description": "Enable pretty-printing for gdb", - "text": "-enable-pretty-printing", - "ignoreFailures": true - } - ], - "stopAtEntry": false, - "stopAtConnect": true, - "logging": { - "engineLogging": true, - "trace": true, - "traceResponse": true - } - } - ] -} \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json deleted file mode 100644 index af69870..0000000 --- a/.vscode/settings.json +++ /dev/null @@ -1,132 +0,0 @@ -{ - "files.associations": { - "array": "cpp", - "atomic": "cpp", - "bit": "cpp", - "bitset": "cpp", - "cctype": "cpp", - "charconv": "cpp", - "chrono": "cpp", - "cinttypes": "cpp", - "clocale": "cpp", - "cmath": "cpp", - "compare": "cpp", - "concepts": "cpp", - "condition_variable": "cpp", - "csignal": "cpp", - "cstdarg": "cpp", - "cstddef": "cpp", - "cstdint": "cpp", - "cstdio": "cpp", - "cstdlib": "cpp", - "cstring": "cpp", - "ctime": "cpp", - "cwchar": "cpp", - "cwctype": "cpp", - "deque": "cpp", - "forward_list": "cpp", - "list": "cpp", - "map": "cpp", - "set": "cpp", - "string": "cpp", - "unordered_map": "cpp", - "unordered_set": "cpp", - "vector": "cpp", - "exception": "cpp", - "algorithm": "cpp", - "functional": "cpp", - "iterator": "cpp", - "memory": "cpp", - "memory_resource": "cpp", - "numeric": "cpp", - "optional": "cpp", - "random": "cpp", - "ratio": "cpp", - "regex": "cpp", - "string_view": "cpp", - "system_error": "cpp", - "tuple": "cpp", - "type_traits": "cpp", - "utility": "cpp", - "format": "cpp", - "fstream": "cpp", - "future": "cpp", - "initializer_list": "cpp", - "iomanip": "cpp", - "iosfwd": "cpp", - "iostream": "cpp", - "istream": "cpp", - "limits": "cpp", - "mutex": "cpp", - "new": "cpp", - "numbers": "cpp", - "ostream": "cpp", - "semaphore": "cpp", - "shared_mutex": "cpp", - "span": "cpp", - "sstream": "cpp", - "stdexcept": "cpp", - "stop_token": "cpp", - "streambuf": "cpp", - "thread": "cpp", - "typeinfo": "cpp", - "variant": "cpp" - }, - "C_Cpp_Runner.cCompilerPath": "gcc", - "C_Cpp_Runner.cppCompilerPath": "g++", - "C_Cpp_Runner.debuggerPath": "gdb", - "C_Cpp_Runner.cStandard": "", - "C_Cpp_Runner.cppStandard": "", - "C_Cpp_Runner.msvcBatchPath": "", - "C_Cpp_Runner.useMsvc": false, - "C_Cpp_Runner.warnings": [ - "-Wall", - "-Wextra", - "-Wpedantic", - "-Wshadow", - "-Wformat=2", - "-Wcast-align", - "-Wconversion", - "-Wsign-conversion", - "-Wnull-dereference" - ], - "C_Cpp_Runner.msvcWarnings": [ - "/W4", - "/permissive-", - "/w14242", - "/w14287", - "/w14296", - "/w14311", - "/w14826", - "/w44062", - "/w44242", - "/w14905", - "/w14906", - "/w14263", - "/w44265", - "/w14928" - ], - "C_Cpp_Runner.enableWarnings": true, - "C_Cpp_Runner.warningsAsError": false, - "C_Cpp_Runner.compilerArgs": [], - "C_Cpp_Runner.linkerArgs": [], - "C_Cpp_Runner.includePaths": [], - "C_Cpp_Runner.includeSearch": [ - "*", - "**/*" - ], - "C_Cpp_Runner.excludeSearch": [ - "**/build", - "**/build/**", - "**/.*", - "**/.*/**", - "**/.vscode", - "**/.vscode/**" - ], - "C_Cpp_Runner.useAddressSanitizer": false, - "C_Cpp_Runner.useUndefinedSanitizer": false, - "C_Cpp_Runner.useLeakSanitizer": false, - "C_Cpp_Runner.showCompilationTime": false, - "C_Cpp_Runner.useLinkTimeOptimization": false, - "C_Cpp_Runner.msvcSecureNoWarnings": false -} \ No newline at end of file diff --git a/.vscode/tasks.json b/.vscode/tasks.json deleted file mode 100644 index 08d9005..0000000 --- a/.vscode/tasks.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "tasks": [ - { - "type": "cppbuild", - "label": "C/C++: gcc build active file", - "command": "/usr/bin/gcc", - "args": [ - "-fdiagnostics-color=always", - "-g", - "${file}", - "-o", - "${fileDirname}/${fileBasenameNoExtension}" - ], - "options": { - "cwd": "${fileDirname}" - }, - "problemMatcher": [ - "$gcc" - ], - "group": { - "kind": "build", - "isDefault": true - }, - "detail": "Task generated by Debugger." - } - ], - "version": "2.0.0" -} \ No newline at end of file diff --git a/plugins/trout_wizard/ai_training/to_detect.lua b/plugins/trout_wizard/ai_training/to_detect.lua new file mode 100644 index 0000000..ad5b959 --- /dev/null +++ b/plugins/trout_wizard/ai_training/to_detect.lua @@ -0,0 +1,63 @@ + +serializer_csv = { item_separator = " ", + if_item_blank_then_output = "-", + } + +-- logger file output set from command line +logger_file = { serializer = 'serializer_csv' } + +trout_wizard = { tag = 'NA', + inference = true, + logger = 'logger_file', + data_set ={ + {protocol ="tftp", + tgm_set = "313335,333530"}, + {protocol ="smb", + tgm_set = "100,1,10000"}, + {protocol ="cip", + tgm_set = "100,1"}, + {protocol ="s7comm", + tgm_set = "f000,10203,c10201,16,400,2f080,1,10002,2,20100,1611,10000,c20201,f00000,100c2,2c001,f00300,1b,f003,300c0,11d000,80000,800,10001,320100,ff,1b02,f08032,e00000,401,803203,3,320300,f0,19,c102,20300,11e000,300,c202,200,803201,1611e0,100,1611d0,1902,100f0,30000,1b02f0,c001,102c0,20102,20000,1902f0"}, + {protocol ="omron", + tgm_set = "2d4400,c8,172a10,ef05,43,c00002,1,3000a,20000,3031,4c3230,435031,50314c,300000,454c32,80000,303000,440000,50100,2e3036,314c2d,44522d,4c2d45,100800,c000,312e30,4350,30,c800,20,a17,2020,2d454c,300,360000,304452,522d44,30312e,100,2a1008,203031,323044,202030,2e3030,202020,800002,10000,a172a,303600,10003,200"}, + {protocol ="eip", + tgm_set = "100,10000"}, + {protocol ="s7", + tgm_set = "2f080,1,10000,300,3,2,30000,20000,4,c001,200,100,c0010a,400,10ac1,320300,800,f08032,11d000,10002,f00000,ff,5,1b,f000,80000,16,803203,f0,1611d0,1b02,20300,1611,1b02f0,c202"}, + {protocol ="fins", + tgm_set = "12001,70180,7a0701,60000,7a0305,50000,7a08,10180,ffff,7a0220,7a07,434480,cc0001,98cccc,800200,10300,18000,424344,ff0100,4e0000,cdce00,1011b,195cc,10101,50180,10580,cccc00,cccc,190cc,4142,580cc,10200,7a0402,434445,7a0603,1bcccc,20103,80000,101,ff80,cccdce,90cccc,20000,20901,10201,200080,2,81cccd,10182,10192,62000,480ff,141,198cc,10280,7a0308,210000,18002,444546,10103,196cc,101cc,16161,60380,30600,534e,418000,10185,81cccc,448000,130000,7a0101,97cccc,194cc,10193,103cc,7a0601,ffff50,3cccc,90120,280,7a02,801100,1010a,300cc,7a0620,4,414243,801000,7a0102,10190,82cccc,40100,7a0401,10105,22000,7a0202,ff8000,200cc,110000,7a0103,10191,185cc,200102,22100,5cccc,182cc,70209,50100,7a04,48000,ffff40,cc0002,38000,ce0010,94cccc,50201,544180,ff4441,18013,7a0104,10196,92cccc,ffffff,ff,ff0000,ff00,a0001,504153,200000,192cc,105cc,10080,100,7a01,85cccc,7a0501,538000,18012,7a0105,10197,20180,100000,20a,1080,7a06,30500,91cccc,181cc,62001,28010,1cccc,7a,80,535380,38010,ff44,ffff80,80ffff,10100,60180,7a0502,70000,30400,18011,10194,10380,cccccc,468000,7a0801,20119,10000,180,480,30700,53,80cccc,ff40ff,200180,7a03,108000,193cc,104cc,18010,10195,7a0702,7a0306,cc81cc,11980,180cc,80161,800002,28000,ff5041,7a0203,96cccc,10041,7a0307,40000,10002,454680,40280,10010,7a05,50101,415353,534e00,cccc81,10480,191cc,8000,10a00,20280,801300,4cccc,7a0304,415441,197cc,100cc,200,198000,444154,14142,11bcc,95cccc,1,ffff01,20380,7a0221,120000,801200,10181,40ffff,93cccc,10104,616161,30800,20a00,7a0201,10198"}, + {protocol ="dnp3", + tgm_set = "100,640000,40c01,16400,30164,10003,301,a0001,c40a00,c2040c,c1c204,5b"}, + {protocol ="ethersio", + tgm_set = "101,4f0001,1800,c0000,1,494f00,110000,10000,1100,20000,455349,200,100,c00,180000,10100,53494f"}, + {protocol ="mms", + tgm_set = "18103,c10200,2c202,2f080,600,800101,6,20100,3ffff,130ee0,10181,130e,c102,2c2,c20202,600c1,20002,e00000,810305,13,ee000,300,ffffff,30000,20200"}, + {protocol ="ethernet", + tgm_set = "100,10000"}, + {protocol ="hart", + tgm_set = "d01,2,10000,d0100,2000d,200"}, + {protocol ="ethersbus", + tgm_set = "1d000a,1a0152,152ea,1500,60000,1bbc8b,d01,a1b1b,1bcf87,a60000,a0152,4000a,1c,a87f00,1b000a,a1bca,2fd,3c23c6,a00c4,80b500,9f4f00,760000,be0000,4bec52,b3d,30000b,2e,21000a,4f0000,1900,18000a,ee0000,40ec6,1dda4,1b00,ef0000,ea2e00,b93300,bc0000,eb1c00,18000,ec5200,850d00,a1b85,a1b,a1bf6,170152,a0603,e000a,d00,170000,1e0200,52700,527,c90000,c0000,980000,180152,1800,1101,11000a,3,2014d,1401,545b00,15259,33,2045d9,3000fa,312c00,d0100,1600,60300,5b0000,40ebb,dd0000,1c0152,7a0000,15200,8,101,1e01,1d0152,a0600,a1bb9,152dc,4c3100,44324d,6000a,2e3a00,b80000,1a,1801,1100,f0152,dc2c00,20000,2,a1e09,a94d00,fd5300,a510a,3000a,1b0000,a,a1b05,1301,12,6f6465,8014d,b7e200,b7e2,e01,530000,3a0000,e2b800,c00,52588e,8c0000,3f0000,c60000,180000,a1b6d,1e00,1522d,bca800,bca8,590000,f00000,14000a,b0152,4bec,6c6c20,14432,15274,1f,1b3cf0,5200ec,d000a,6c0000,5,c000,401,5d8600,205318,13,1300,12000a,202000,64656c,1b850d,b50000,7f0000,a1b54,dc0000,17a19,4c31,4c,a20,700,2e3a,fac9,1001,2000,df0000,1521a,52f12f,526fbe,280,324d34,207481,4e2,a00,e60000,bf6c,dda45a,1dd,90000,bb2300,302,c4,1f000a,52ea2e,4ed76,4,8000bf,400,a3d800,2100,10,30000,c,1a01,e0c500,bc8b00,303230,2045,2000a,a07,8f0000,1d01,d459,a0703,1a5d00,1f00,b7,a1b9b,a1bbc,4014d,5d86,1adf00,d4,3cf000,c50000,1201,800,1d,a1bcf,f01,f000a,1beda6,19a604,7,c43c,2101,1a00,a1b3c,11,c000a,b,60152,23c600,a0000,438f00,1c01,160152,1b9eaa,bf6c00,900,7a0a00,52438f,2f0000,270001,310000,748100,50100,501,45d900,5d0000,1b1b69,1901,a02,ed,100152,767a00,1526e,300,a2053,1e,1e0000,f00,eda600,70144,7000a,6,11000,312c,74bf00,a72c00,1701,16,b37e00,120152,e,6c2020,444e75,1c00,ed7600,6e8c00,1c0000,901,a3,1000a,1bd198,e0,4ed,1400,15258,383032,531800,100100,20,6ddd00,1b80b5,19,57600,ede6,5259bc,8b0000,2225c,222,200000,c43c23,9,a1e02,3d0000,343830,230000,100,d,100bc,17,1700,16000a,a1b00,d0152,4d3438,d0000,d80000,a3d8,200100,152a8,190100,a1be8,b01,b000a,330000,1bca3f,860000,e20000,e00,c0,14d6f,100020,757a0a,1b01,5237dc,ce0000,ce00,800000,9000a,30004,15243,1e000a,f12f00,14,1b545b,601,510a00,210100,150152,588e00,1b767a,b00,119a6,152a9,10000,1f0152,1c000a,152b3,180,c444,6c0d00,70300,bf0000,5274bf,1bf601,1ba72c,1601,cf8700,ec0000,ec00,9b1200,52eb1c,2fd53,2001,20000a,19000a,1b0576,1000,52a94d,5d,a1e00,529f4f,15,f0000,f,110152,a2074,600,656c0d,1a5d,1b0152,1529f,17000a,152eb,d90000,470110,4e757a,a1ba7,a0203,152dd,1be81e,9eaa00,5236ee,a000a,90100,10144,4e2b8,690000,1d00,152f1,52dd1e,2e0000,a06,870000,a1bed,ec652,119,1b6900,a1b9e,ede600,c01,28000,4d6f64,a47,2c0000,f60100,52a87f,a1bd1,20300,130100,1200,526e8c,801,8000a,810000,52b37e,a6040e,5aa500,225c00,5000a,1a000a,15236,a1b76,10002,a1e,a45aa5,201,522def,d45900,dd1e00,140100,4b,c65200,3300,323000,701,8e0000,37dc00,1b9b12,520000,5c0001,c00000,500,1526f,a01,4d0000,c4444e,1b6ddd,1501,15000a,6fbe00,59bc00,ca3f00,a50001,656c6c,1e0900,b3d00,140000,fac900,1e0152,d19800,aa0000,10000a,15237,7a1900,200,1b,521adf,e81e00,13000a,36ee00,e0152,1b00ce,120000,1,17a,30200,31,1f01,a1b80,7e0000,1bb933,ebb23,21,2def00,a80000,18,e0c5,c0152,52dc2c,110100,190001,a4701,a51"}, + {protocol ="http", + tgm_set = "696f6e,74696f,616765,485454,2e310d,636365,2f312e,416363,d0a41,70742d,696361,617465,486f73,d0a55,736572,67656e,a4163,65722d,a5573,617469,a436f,743a20,722d41,54202f,545450,6f6469,310d0a,204854,636f64,73743a,557365,d0a43,653a20,656e74,6f7374,416765,2d4167,54502f,636570,6e743a,502f31,a486f,d0a48,312e31,657074"}, + {protocol ="iec", + tgm_set = "b04,10414,1a0004,40002,40b00,1468,200414,4000a,10400,30414,20002,1001a,683a16,240004,64010a,40024,1f0414,68222e,222c00,e2200,d0e00,1f04,681e,683e1a,361400,1a0600,3,311017,c0000,68220e,20001,680e00,68,90414,2c0004,680e20,e0200,6000a,20000,2,1e0004,683614,2204,40022,41400,14681a,14000a,4000b,6822,40064,683e1c,2304,d6836,120004,68220c,170884,70d0c,d6846,680e22,d680e,101708,430000,2404,3e1a00,46,6804,a00,400,4,70414,683612,681a04,30000,6401,88407,44300,10700,230414,40020,b0414,40009,40100,640106,14680e,461e00,68040b,c0004,10600,48300,683e,1a00,d683a,40005,a0000,70d68,4001f,e0004,2a2a00,80004,681e08,300,2e0004,4601,830000,7000a,681a06,1a0400,220e00,680443,a0001,d0d00,68222c,180004,684618,50414,100,504,240414,d0000,40007,140004,220c00,1a2600,d6804,2004,40023,461800,14,84070d,70d0d,2104,460104,70000,b00,4001e,361200,2a0a00,64,10000,3a1600,1e0414,680483,681a26,1a2400,220004,1a0068,220414,680401,280004,681e28,70d0e,d683e,904,682a,40001,e0000,a0004,681a,a000a,d04,4000d,2a1000,20064,222e00,2a0004,304,3110,d0c00,40021,682a10,40000,1e2800,1c0004,60002,a000b,681a24,200004,1e0800,104,680407,260004,10a00,3e1c00,210414,40003,d0414,100004,200,682a2a,b0000,68461e,1e04,160004,6836,20003,680e02,640107,31,682a0a,704,e2000,680e,40700"}, + {protocol ="modbus", + tgm_set = "10000,100"}, + {protocol ="ntp", + tgm_set = "1,102,c50204,204ec,c502,d9000a,900000,204eb,afa,10290,afa00,fa0000,c5,29000"}, + }, + pack_data = false, + split_size = 253, + concatenate = true + } + +stream = {} +stream_icmp = {} +stream_tcp = {} +stream_udp = {} +stream_ip = {} + +binder = { + { use = {type = 'trout_wizard'} } +} diff --git a/plugins/trout_wizard/ai_training/to_tsv.lua b/plugins/trout_wizard/ai_training/to_tsv.lua index 04e1fb1..32e2f3c 100644 --- a/plugins/trout_wizard/ai_training/to_tsv.lua +++ b/plugins/trout_wizard/ai_training/to_tsv.lua @@ -7,6 +7,7 @@ serializer_csv = { item_separator = " ", logger_file = { serializer = 'serializer_csv' } trout_wizard = { tag = 'NA', + inference = false, logger = 'logger_file', pack_data = false, split_size = 253, diff --git a/plugins/trout_wizard/files.list b/plugins/trout_wizard/files.list index 3bbae72..6983dba 100644 --- a/plugins/trout_wizard/files.list +++ b/plugins/trout_wizard/files.list @@ -1,2 +1,4 @@ inspector.cc module.cc +settings.cc +trigram.cc \ No newline at end of file diff --git a/plugins/trout_wizard/inspector.cc b/plugins/trout_wizard/inspector.cc index d620867..60b3151 100644 --- a/plugins/trout_wizard/inspector.cc +++ b/plugins/trout_wizard/inspector.cc @@ -1,4 +1,5 @@ // Snort includes +#include #include #include @@ -6,7 +7,6 @@ #include #include #include -#include // Global includes #include @@ -30,6 +30,9 @@ class WizardFlow { other, } base_protocol = BaseProtocol::other; + // flow map - ,count + std::map, int> flow_map; + private: struct Cache { // Settings @@ -217,7 +220,8 @@ class WizardFlow { if (client_cache.append(data, data_length, offset)) { flush(); } - } else /* Must be from server */ { + } else /* Must be from server */ + { if (server_cache.empty() && p->pkth) { server_cache.time_stamp = p->pkth->ts; } @@ -227,21 +231,96 @@ class WizardFlow { } } } -}; +#ifdef ENABLE_INFERENCE + // WIP - after deriving the accurate protocol, we have to attach the that + // protocol to flow. + std::string get_protocol(const uint8_t *data, size_t data_len, + std::shared_ptr neg_cache, + std::shared_ptr settings) { + get_intresting_tgms(data, data_len, neg_cache, settings); + + std::map protocol_list; + for (auto fd : flow_map) { + for (auto &pd : settings->data_set) { + if (fd.first.first == pd->protocol) { + float v = ((float)fd.second / (float)pd->tgm_set.size()); + if (protocol_list[pd->protocol] < v) { + protocol_list[pd->protocol] = v; + } + } + } + } + std::string f_protocol = ""; + float maxProbability = + -std::numeric_limits::infinity(); // Smallest possible value + + for (const auto &[protocol, prob] : protocol_list) { + if (prob > maxProbability) { + maxProbability = prob; + f_protocol = protocol; + } + } + return f_protocol; + } + + void get_intresting_tgms(const uint8_t *data, size_t len, + std::shared_ptr neg_cache, + std::shared_ptr settings) { + + if (len < 3U) + return; + + for (size_t i = 0; i <= len - 3U; i++) { + uint32_t tgm = (static_cast(data[i]) << 16) | + (static_cast(data[i + 1]) << 8) | + (static_cast(data[i + 2])); + bool found = false; + + if (neg_cache->test(tgm) || tgm == 0U) { + continue; + } else { + for (auto &item : settings->data_set) { + if (item->tgm_set.find(tgm) != item->tgm_set.end()) { + flow_map[{item->protocol, tgm}]++; + found = true; + } + } + if (!found) { + neg_cache->add(tgm); + } + } + } + + return; + } + +#endif + +}; // wizard class using FlowData = Common::FlowData; void dump_pkt(bool from_client, snort::Packet *p, const uint8_t *data, - uint32_t data_length, std::shared_ptr settings) { + uint32_t data_length, std::shared_ptr settings, + std::shared_ptr neg_cache) { assert(p); FlowData *flow_data = (p->flow) ? FlowData::get_from_flow(p->flow) : nullptr; if (flow_data) { - flow_data->set_settings(settings); - - flow_data->process(from_client, p, data, data_length); +#ifdef ENABLE_INFERENCE + if (settings->inference == true) { + std::string f_protocol = + flow_data->get_protocol(data, data_length, neg_cache, settings); + + std::cout << "\n protocol derived: " << f_protocol << "\n"; + } else { +#endif + flow_data->process(from_client, p, data, data_length); +#ifdef ENABLE_INFERENCE + } +#endif } else { snort::WarningMessage("WARNING: trout_wizard unable to parse packet due to " "missing flow, check your configuration"); @@ -252,6 +331,7 @@ void dump_pkt(bool from_client, snort::Packet *p, const uint8_t *data, class Splitter : public snort::StreamSplitter { std::shared_ptr settings; + std::shared_ptr neg_cache; Status scan(snort::Packet *p, const uint8_t *data, // in order segment data as it arrives @@ -260,7 +340,7 @@ class Splitter : public snort::StreamSplitter { uint32_t * /*fp*/ // flush point (offset) relative to data ) override { - dump_pkt(to_server(), p, data, len, settings); + dump_pkt(to_server(), p, data, len, settings, neg_cache); return SEARCH; } @@ -270,19 +350,26 @@ class Splitter : public snort::StreamSplitter { unsigned max(snort::Flow *) override { return 32000; } public: - Splitter(std::shared_ptr settings, bool c2s) - : StreamSplitter(c2s), settings(settings) {} + Splitter(std::shared_ptr settings, bool c2s, + std::shared_ptr neg_cache) + : StreamSplitter(c2s), settings(settings), neg_cache(neg_cache) {} }; void Inspector::eval(snort::Packet *p) { - dump_pkt(p->is_from_client(), p, p->data, p->dsize, module.get_settings()); + dump_pkt(p->is_from_client(), p, p->data, p->dsize, settings, neg_cache); } +Inspector::Inspector(Module &module) + : settings(module.get_settings()), pegs(module.get_peg_counts()), + neg_cache(std::make_shared()) { + + }; + Inspector::~Inspector() {} snort::StreamSplitter *Inspector::get_splitter(bool c2s) { - return new Splitter(module.get_settings(), c2s); + return new Splitter(settings, c2s, neg_cache); } snort::Inspector *Inspector::ctor(snort::Module *module) { diff --git a/plugins/trout_wizard/inspector.h b/plugins/trout_wizard/inspector.h index ddd9500..d888d6a 100644 --- a/plugins/trout_wizard/inspector.h +++ b/plugins/trout_wizard/inspector.h @@ -11,19 +11,23 @@ // Global includes // Local includes +#include "settings.h" +#include "trigram.h" // Debug includes namespace trout_wizard { - class Module; class Inspector : public snort::Inspector { private: - Module &module; + std::shared_ptr settings; + PegCounts &pegs; + + std::shared_ptr neg_cache; public: - Inspector(Module &module) : module(module) { assert(&module); }; + Inspector(Module &module); ~Inspector(); void eval(snort::Packet *) override; diff --git a/plugins/trout_wizard/module.cc b/plugins/trout_wizard/module.cc index 0f5653b..ea46ffa 100644 --- a/plugins/trout_wizard/module.cc +++ b/plugins/trout_wizard/module.cc @@ -14,9 +14,20 @@ namespace { static const char *s_name = "trout_wizard"; static const char *s_help = "detects protocols"; +static const snort::Parameter data_set[] = { + {"protocol", snort::Parameter::PT_STRING, nullptr, nullptr, + "Set the protocol name of the input dataset"}, + {"tgm_set", snort::Parameter::PT_STRING, nullptr, nullptr, + "Set the trigram values of the corresponding protocol"}, + {nullptr, snort::Parameter::PT_MAX, nullptr, nullptr, nullptr}}; + static const snort::Parameter module_params[] = { {"logger", snort::Parameter::PT_STRING, nullptr, nullptr, "Set logger output should be sent to"}, + {"inference", snort::Parameter::PT_BOOL, nullptr, "false", + "Set to true to enable frequency filtering"}, + {"data_set", snort::Parameter::PT_LIST, data_set, nullptr, + "Dataset with protocol and corresponding trigram values"}, {"concatenate", snort::Parameter::PT_BOOL, nullptr, "false", "Set to true if chunks should be concatenated"}, {"split_size", snort::Parameter::PT_INT, "0:max31", "253", @@ -32,14 +43,8 @@ const PegInfo s_pegs[] = { {CountType::SUM, "services detected", "Number of services detected"}, {CountType::END, nullptr, nullptr}}; -// TODO: actually increase these: -// This must match the s_pegs[] array -struct PegCounts { - PegCount pkg_processed = 0; - PegCount srv_detected = 0; -}; - -THREAD_LOCAL struct PegCounts s_peg_counts; +// TODO: Understand the pegs in a threaded context... +/*THREAD_LOCAL*/ struct PegCounts s_peg_counts; // Compile time sanity check of number of entries in s_pegs and s_peg_counts static_assert( @@ -49,37 +54,28 @@ static_assert( } // namespace -LioLi::Logger &Settings::get_logger() { - if (!logger) { - logger = LioLi::LogDB::get(logger_name.c_str()); - } - return *logger; +Module::Module() + : snort::Module(s_name, s_help, module_params), + settings(std::make_shared(s_name, s_peg_counts)) { + std::cout << "Module Constructor"; } -Module::Module() - : snort::Module(s_name, s_help, module_params), settings(new Settings) {} +Module::~Module() { settings.reset(); } -Module::Usage Module::get_usage() const { - return DETECT; /* GLOBAL, CONTEXT, INSPECT, DETECT */ +bool Module::begin(const char *s, int i, snort::SnortConfig *) { + return settings->begin(s, i); +} + +bool Module::end(const char *s, int, snort::SnortConfig *) { + return settings->end(s); } -bool Module::set(const char *, snort::Value &val, snort::SnortConfig *) { - if (val.is("logger") && val.get_as_string().size() > 0) { - settings->logger_name = val.get_string(); - } else if (val.is("concatenate")) { - settings->concatenate = val.get_bool(); - } else if (val.is("pack_data")) { - settings->pack_data = val.get_bool(); - } else if (val.is("split_size")) { - settings->split_size = val.get_uint32(); - } else if (val.is("tag") && val.get_as_string().size() > 0) { - settings->tag = val.get_string(); - } else { - // fail if we didn't get something valid - return false; - } - - return true; +bool Module::set(const char *s, snort::Value &val, snort::SnortConfig *) { + return settings->set(s, val); +} +Module::Usage Module::get_usage() const { + return DETECT; + /* GLOBAL, CONTEXT, INSPECT, DETECT */ // TODO needs to check about DETECT } const PegInfo *Module::get_pegs() const { return s_pegs; } @@ -90,6 +86,8 @@ PegCount *Module::get_counts() const { bool Module::is_bindable() const { return true; } +PegCounts &Module::get_peg_counts() { return s_peg_counts; } + std::shared_ptr Module::get_settings() { return settings; } const snort::InspectApi inspect_api = { diff --git a/plugins/trout_wizard/module.h b/plugins/trout_wizard/module.h index 77e92dc..394155c 100644 --- a/plugins/trout_wizard/module.h +++ b/plugins/trout_wizard/module.h @@ -2,38 +2,40 @@ #define module_1d34881e // Snort includes - +#include +#include // System includes +#include // Global includes #include -// Local includes +#define ENABLE_INFERENCE +// Local includes namespace trout_wizard { -struct Settings { - std::shared_ptr logger; - -public: - std::string logger_name; - bool concatenate = false; - bool pack_data = false; - uint32_t split_size = 253; - std::string tag; +class Settings; - LioLi::Logger &get_logger(); +// This must match the s_pegs[] array +struct PegCounts { + PegCount pkg_processed = 0; + PegCount srv_detected = 0; }; class Module : public snort::Module { std::shared_ptr settings; Module(); + ~Module(); - Usage get_usage() const override; + bool begin(const char *, int, snort::SnortConfig *) override; + bool end(const char *, int, snort::SnortConfig *) override; bool set(const char *, snort::Value &val, snort::SnortConfig *) override; + Usage get_usage() const override; + const PegInfo *get_pegs() const override; PegCount *get_counts() const override; @@ -42,7 +44,7 @@ class Module : public snort::Module { public: std::shared_ptr get_settings(); - + PegCounts &get_peg_counts(); static snort::Module *ctor() { return new Module(); } static void dtor(snort::Module *p) { delete p; } }; diff --git a/plugins/trout_wizard/settings.cc b/plugins/trout_wizard/settings.cc new file mode 100644 index 0000000..c58a2d5 --- /dev/null +++ b/plugins/trout_wizard/settings.cc @@ -0,0 +1,117 @@ +// Snort includes + +// System includes + +// Global includes + +// Local includes +#include "settings.h" + +// Debug includes + +namespace trout_wizard { +Settings::Settings(const char *module_name, PegCounts &pegs) + : pegs(pegs), module_name(module_name) {} + +bool Settings::begin(const char *s, int) { + if (module_name == s) + // Check if this is a fresh load of settings + if (module_name == s) { + reset(); + return true; + } + + // Processing the data_set + if (module_name + ".data_set" == s) { + if (current_item) { + if (zero_item) { + snort::ErrorMessage("ERROR: Internal parsing error on %s", s); + return false; + } + current_item.swap(zero_item); + } + current_item.reset(new Dataset); + return true; + } + + // We got something in that we don't know how to handle + return false; +} + +bool Settings::end(const char *s) { + if (module_name == s) { + // TODO: Validate settings + return true; + } + + if (module_name + ".data_set" == s) { + if (!current_item) { + snort::ErrorMessage( + "ERROR: Internal parsing error on %s, end with no beginning\n", s); + return false; + } + + data_set.emplace_back(current_item.release()); + current_item.swap(zero_item); + return true; + } + + return false; +} + +LioLi::Logger &Settings::get_logger() { + if (!logger) { + logger = LioLi::LogDB::get(logger_name.c_str()); + } + return *logger; +} + +std::unordered_set stringToSet(const std::string &input) { + std::unordered_set result; + std::stringstream ss(input); + std::string token; + + while (std::getline(ss, token, ',')) { + if (!token.empty()) { + result.insert(static_cast(std::stoul(token, nullptr, 16))); + } + } + + return result; +} + +bool Settings::set(const char *, snort::Value &val) { + if (val.is("logger") && val.get_as_string().size() > 0) { + logger_name = val.get_string(); + } else if (val.is("inference")) { + inference = val.get_bool(); + } else if (val.is("protocol")) { + assert(current_item); + current_item->protocol = val.get_string(); + } else if (val.is("tgm_set")) { + assert(current_item); + current_item->tgm_set = stringToSet(val.get_string()); + } else if (val.is("concatenate")) { + concatenate = val.get_bool(); + } else if (val.is("pack_data")) { + pack_data = val.get_bool(); + } else if (val.is("split_size")) { + split_size = val.get_uint32(); + } else if (val.is("tag") && val.get_as_string().size() > 0) { + tag = val.get_string(); + } else { + // fail if we didn't get something valid + return false; + } + + return true; +} + +void Settings::reset() { + // NOTE: Some values have their defaults from the module_params in module.cc + data_set.clear(); + zero_item.reset(); + current_item.reset(); +} + +} // namespace trout_wizard diff --git a/plugins/trout_wizard/settings.h b/plugins/trout_wizard/settings.h new file mode 100644 index 0000000..81bec5d --- /dev/null +++ b/plugins/trout_wizard/settings.h @@ -0,0 +1,66 @@ +#ifndef settings_d22993cc +#define settings_d22993cc + +// Snort includes + +// System includes +#include +#include +#include +#include +#include +#include +#include + +// Global includes + +// Local includes +#include "module.h" +// Debug includes + +namespace trout_wizard { + +class Module; + +struct Settings : std::enable_shared_from_this { + PegCounts &pegs; + Settings(const char *module_name, PegCounts &pegs); + + // Settings for all map entries + std::shared_ptr logger; + +public: + std::string logger_name; + bool inference = false; + bool concatenate = false; + bool pack_data = false; + uint32_t split_size = 253; + std::string tag; + + LioLi::Logger &get_logger(); + + struct Dataset { + std::string protocol; + std::unordered_set tgm_set; + }; + + std::list> + data_set; // This might be made more inteligent at a later time + +private: + friend Module; + + std::string module_name; + + bool begin(const char *, int); + bool end(const char *); + bool set(const char *, snort::Value &val); + + std::unique_ptr zero_item; + std::unique_ptr current_item; + + void reset(); // Clears all settings to default values +}; +} // namespace trout_wizard + +#endif // #ifndef settings_d22993cc diff --git a/plugins/trout_wizard/tests/wizard_test.script b/plugins/trout_wizard/tests/wizard_test.script index 3042cd2..bbe70ad 100755 --- a/plugins/trout_wizard/tests/wizard_test.script +++ b/plugins/trout_wizard/tests/wizard_test.script @@ -18,6 +18,7 @@ stream_udp = {} stream_ip = {} trout_wizard = { tag = 'NA', + inference = false, logger = 'logger_file', pack_data = false, split_size = 253, diff --git a/plugins/trout_wizard/trigram.cc b/plugins/trout_wizard/trigram.cc new file mode 100644 index 0000000..6affa6b --- /dev/null +++ b/plugins/trout_wizard/trigram.cc @@ -0,0 +1,36 @@ +// Snort includes + +// System includes + +// Global includes + +// Local includes +#include "trigram.h" + +// Debug includes + +namespace trout_wizard { +#ifdef ENABLE_INFERENCE + +Negative_cache::Negative_cache() { + ntgs_index.fill(0); + ntgs.assign(SIZE, 0); +} + +void Negative_cache::add(uint32_t tgm) { + ntgs.push_back(tgm); + ntgs_index[tgm] = ntgs.size() - 1; +} + +bool Negative_cache::test(uint32_t tgm) { + uint32_t i = ntgs_index[tgm]; + + if (i < ntgs.size()) { + return ntgs[i] == tgm; + } + return false; +} +// Need to decide when we have reset the negative cache. +void Negative_cache::reset() { return ntgs.clear(); } +#endif +} // namespace trout_wizard \ No newline at end of file diff --git a/plugins/trout_wizard/trigram.h b/plugins/trout_wizard/trigram.h new file mode 100644 index 0000000..56ecbc6 --- /dev/null +++ b/plugins/trout_wizard/trigram.h @@ -0,0 +1,28 @@ +#ifndef trigram_d22993dd +#define trigram_d22993dd + +// Snort includes +#include + +// System includes + +// Global includes + +// Local includes +#include "module.h" +// Debug includes + +namespace trout_wizard { +constexpr int SIZE = 1 << 24; +class Negative_cache { + std::array ntgs_index; + std::vector ntgs; + +public: + Negative_cache(); + void add(uint32_t); + bool test(uint32_t); + void reset(); +}; +} // namespace trout_wizard +#endif // trigram_d22993dd \ No newline at end of file diff --git a/plugins/trout_wizard/trigram_dataset/candidates.csv b/plugins/trout_wizard/trigram_dataset/candidates.csv new file mode 100644 index 0000000..37c8704 --- /dev/null +++ b/plugins/trout_wizard/trigram_dataset/candidates.csv @@ -0,0 +1,1232 @@ +"protocol" "tgs" "np" "nc" "tf" +"cip" "000100" 104 134 0.776119402985075 +"cip" "000001" 99 134 0.738805970149254 +"dnp3" "000100" 206 235 0.876595744680851 +"dnp3" "640000" 201 235 0.85531914893617 +"dnp3" "040c01" 201 235 0.85531914893617 +"dnp3" "016400" 201 235 0.85531914893617 +"dnp3" "030164" 201 235 0.85531914893617 +"dnp3" "010003" 201 235 0.85531914893617 +"dnp3" "000301" 199 235 0.846808510638298 +"dnp3" "0a0001" 198 235 0.842553191489362 +"dnp3" "c40a00" 198 235 0.842553191489362 +"dnp3" "c2040c" 198 235 0.842553191489362 +"dnp3" "c1c204" 198 235 0.842553191489362 +"dnp3" "00005b" 165 235 0.702127659574468 +"eip" "000100" 45 57 0.789473684210526 +"eip" "010000" 43 57 0.754385964912281 +"ethernet" "000100" 149 193 0.772020725388601 +"ethernet" "010000" 141 193 0.730569948186529 +"ethersbus" "1d000a" 1 1 1 +"ethersbus" "1a0152" 1 1 1 +"ethersbus" "0152ea" 1 1 1 +"ethersbus" "001500" 1 1 1 +"ethersbus" "060000" 1 1 1 +"ethersbus" "1bbc8b" 1 1 1 +"ethersbus" "000d01" 1 1 1 +"ethersbus" "0a1b1b" 1 1 1 +"ethersbus" "1bcf87" 1 1 1 +"ethersbus" "a60000" 1 1 1 +"ethersbus" "0a0152" 1 1 1 +"ethersbus" "04000a" 1 1 1 +"ethersbus" "00001c" 1 1 1 +"ethersbus" "a87f00" 1 1 1 +"ethersbus" "1b000a" 1 1 1 +"ethersbus" "0a1bca" 1 1 1 +"ethersbus" "0002fd" 1 1 1 +"ethersbus" "3c23c6" 1 1 1 +"ethersbus" "0a00c4" 1 1 1 +"ethersbus" "80b500" 1 1 1 +"ethersbus" "9f4f00" 1 1 1 +"ethersbus" "760000" 1 1 1 +"ethersbus" "be0000" 1 1 1 +"ethersbus" "4bec52" 1 1 1 +"ethersbus" "000b3d" 1 1 1 +"ethersbus" "30000b" 1 1 1 +"ethersbus" "00002e" 1 1 1 +"ethersbus" "21000a" 1 1 1 +"ethersbus" "4f0000" 1 1 1 +"ethersbus" "001900" 1 1 1 +"ethersbus" "18000a" 1 1 1 +"ethersbus" "ee0000" 1 1 1 +"ethersbus" "040ec6" 1 1 1 +"ethersbus" "01dda4" 1 1 1 +"ethersbus" "001b00" 1 1 1 +"ethersbus" "ef0000" 1 1 1 +"ethersbus" "ea2e00" 1 1 1 +"ethersbus" "b93300" 1 1 1 +"ethersbus" "bc0000" 1 1 1 +"ethersbus" "eb1c00" 1 1 1 +"ethersbus" "018000" 1 1 1 +"ethersbus" "ec5200" 1 1 1 +"ethersbus" "850d00" 1 1 1 +"ethersbus" "0a1b85" 1 1 1 +"ethersbus" "000a1b" 1 1 1 +"ethersbus" "0a1bf6" 1 1 1 +"ethersbus" "170152" 1 1 1 +"ethersbus" "0a0603" 1 1 1 +"ethersbus" "0e000a" 1 1 1 +"ethersbus" "000d00" 1 1 1 +"ethersbus" "170000" 1 1 1 +"ethersbus" "1e0200" 1 1 1 +"ethersbus" "052700" 1 1 1 +"ethersbus" "000527" 1 1 1 +"ethersbus" "c90000" 1 1 1 +"ethersbus" "0c0000" 1 1 1 +"ethersbus" "980000" 1 1 1 +"ethersbus" "180152" 1 1 1 +"ethersbus" "001800" 1 1 1 +"ethersbus" "001101" 1 1 1 +"ethersbus" "11000a" 1 1 1 +"ethersbus" "000003" 1 1 1 +"ethersbus" "02014d" 1 1 1 +"ethersbus" "001401" 1 1 1 +"ethersbus" "545b00" 1 1 1 +"ethersbus" "015259" 1 1 1 +"ethersbus" "000033" 1 1 1 +"ethersbus" "2045d9" 1 1 1 +"ethersbus" "3000fa" 1 1 1 +"ethersbus" "312c00" 1 1 1 +"ethersbus" "0d0100" 1 1 1 +"ethersbus" "001600" 1 1 1 +"ethersbus" "060300" 1 1 1 +"ethersbus" "5b0000" 1 1 1 +"ethersbus" "040ebb" 1 1 1 +"ethersbus" "dd0000" 1 1 1 +"ethersbus" "1c0152" 1 1 1 +"ethersbus" "7a0000" 1 1 1 +"ethersbus" "015200" 1 1 1 +"ethersbus" "000008" 1 1 1 +"ethersbus" "000101" 1 1 1 +"ethersbus" "001e01" 1 1 1 +"ethersbus" "1d0152" 1 1 1 +"ethersbus" "0a0600" 1 1 1 +"ethersbus" "0a1bb9" 1 1 1 +"ethersbus" "0152dc" 1 1 1 +"ethersbus" "4c3100" 1 1 1 +"ethersbus" "44324d" 1 1 1 +"ethersbus" "06000a" 1 1 1 +"ethersbus" "2e3a00" 1 1 1 +"ethersbus" "b80000" 1 1 1 +"ethersbus" "00001a" 1 1 1 +"ethersbus" "001801" 1 1 1 +"ethersbus" "001100" 1 1 1 +"ethersbus" "0f0152" 1 1 1 +"ethersbus" "dc2c00" 1 1 1 +"ethersbus" "020000" 1 1 1 +"ethersbus" "000002" 1 1 1 +"ethersbus" "0a1e09" 1 1 1 +"ethersbus" "a94d00" 1 1 1 +"ethersbus" "fd5300" 1 1 1 +"ethersbus" "0a510a" 1 1 1 +"ethersbus" "03000a" 1 1 1 +"ethersbus" "1b0000" 1 1 1 +"ethersbus" "00000a" 1 1 1 +"ethersbus" "0a1b05" 1 1 1 +"ethersbus" "001301" 1 1 1 +"ethersbus" "000012" 1 1 1 +"ethersbus" "6f6465" 1 1 1 +"ethersbus" "08014d" 1 1 1 +"ethersbus" "b7e200" 1 1 1 +"ethersbus" "00b7e2" 1 1 1 +"ethersbus" "000e01" 1 1 1 +"ethersbus" "530000" 1 1 1 +"ethersbus" "3a0000" 1 1 1 +"ethersbus" "e2b800" 1 1 1 +"ethersbus" "000c00" 1 1 1 +"ethersbus" "52588e" 1 1 1 +"ethersbus" "8c0000" 1 1 1 +"ethersbus" "3f0000" 1 1 1 +"ethersbus" "c60000" 1 1 1 +"ethersbus" "180000" 1 1 1 +"ethersbus" "0a1b6d" 1 1 1 +"ethersbus" "001e00" 1 1 1 +"ethersbus" "01522d" 1 1 1 +"ethersbus" "bca800" 1 1 1 +"ethersbus" "00bca8" 1 1 1 +"ethersbus" "590000" 1 1 1 +"ethersbus" "f00000" 1 1 1 +"ethersbus" "14000a" 1 1 1 +"ethersbus" "0b0152" 1 1 1 +"ethersbus" "004bec" 1 1 1 +"ethersbus" "6c6c20" 1 1 1 +"ethersbus" "014432" 1 1 1 +"ethersbus" "015274" 1 1 1 +"ethersbus" "00001f" 1 1 1 +"ethersbus" "1b3cf0" 1 1 1 +"ethersbus" "5200ec" 1 1 1 +"ethersbus" "0d000a" 1 1 1 +"ethersbus" "6c0000" 1 1 1 +"ethersbus" "000005" 1 1 1 +"ethersbus" "00c000" 1 1 1 +"ethersbus" "000401" 1 1 1 +"ethersbus" "5d8600" 1 1 1 +"ethersbus" "205318" 1 1 1 +"ethersbus" "000013" 1 1 1 +"ethersbus" "001300" 1 1 1 +"ethersbus" "12000a" 1 1 1 +"ethersbus" "202000" 1 1 1 +"ethersbus" "64656c" 1 1 1 +"ethersbus" "1b850d" 1 1 1 +"ethersbus" "b50000" 1 1 1 +"ethersbus" "7f0000" 1 1 1 +"ethersbus" "0a1b54" 1 1 1 +"ethersbus" "dc0000" 1 1 1 +"ethersbus" "017a19" 1 1 1 +"ethersbus" "004c31" 1 1 1 +"ethersbus" "00004c" 1 1 1 +"ethersbus" "000a20" 1 1 1 +"ethersbus" "000700" 1 1 1 +"ethersbus" "002e3a" 1 1 1 +"ethersbus" "00fac9" 1 1 1 +"ethersbus" "001001" 1 1 1 +"ethersbus" "002000" 1 1 1 +"ethersbus" "df0000" 1 1 1 +"ethersbus" "01521a" 1 1 1 +"ethersbus" "52f12f" 1 1 1 +"ethersbus" "526fbe" 1 1 1 +"ethersbus" "000280" 1 1 1 +"ethersbus" "324d34" 1 1 1 +"ethersbus" "207481" 1 1 1 +"ethersbus" "0004e2" 1 1 1 +"ethersbus" "000a00" 1 1 1 +"ethersbus" "e60000" 1 1 1 +"ethersbus" "00bf6c" 1 1 1 +"ethersbus" "dda45a" 1 1 1 +"ethersbus" "0001dd" 1 1 1 +"ethersbus" "090000" 1 1 1 +"ethersbus" "bb2300" 1 1 1 +"ethersbus" "000302" 1 1 1 +"ethersbus" "0000c4" 1 1 1 +"ethersbus" "1f000a" 1 1 1 +"ethersbus" "52ea2e" 1 1 1 +"ethersbus" "04ed76" 1 1 1 +"ethersbus" "000004" 1 1 1 +"ethersbus" "8000bf" 1 1 1 +"ethersbus" "000400" 1 1 1 +"ethersbus" "a3d800" 1 1 1 +"ethersbus" "002100" 1 1 1 +"ethersbus" "000010" 1 1 1 +"ethersbus" "030000" 1 1 1 +"ethersbus" "00000c" 1 1 1 +"ethersbus" "001a01" 1 1 1 +"ethersbus" "e0c500" 1 1 1 +"ethersbus" "bc8b00" 1 1 1 +"ethersbus" "303230" 1 1 1 +"ethersbus" "002045" 1 1 1 +"ethersbus" "02000a" 1 1 1 +"ethersbus" "000a07" 1 1 1 +"ethersbus" "8f0000" 1 1 1 +"ethersbus" "001d01" 1 1 1 +"ethersbus" "00d459" 1 1 1 +"ethersbus" "0a0703" 1 1 1 +"ethersbus" "1a5d00" 1 1 1 +"ethersbus" "001f00" 1 1 1 +"ethersbus" "0000b7" 1 1 1 +"ethersbus" "0a1b9b" 1 1 1 +"ethersbus" "0a1bbc" 1 1 1 +"ethersbus" "04014d" 1 1 1 +"ethersbus" "005d86" 1 1 1 +"ethersbus" "1adf00" 1 1 1 +"ethersbus" "0000d4" 1 1 1 +"ethersbus" "3cf000" 1 1 1 +"ethersbus" "c50000" 1 1 1 +"ethersbus" "001201" 1 1 1 +"ethersbus" "000800" 1 1 1 +"ethersbus" "00001d" 1 1 1 +"ethersbus" "0a1bcf" 1 1 1 +"ethersbus" "000f01" 1 1 1 +"ethersbus" "0f000a" 1 1 1 +"ethersbus" "1beda6" 1 1 1 +"ethersbus" "19a604" 1 1 1 +"ethersbus" "000007" 1 1 1 +"ethersbus" "00c43c" 1 1 1 +"ethersbus" "002101" 1 1 1 +"ethersbus" "001a00" 1 1 1 +"ethersbus" "0a1b3c" 1 1 1 +"ethersbus" "000011" 1 1 1 +"ethersbus" "0c000a" 1 1 1 +"ethersbus" "00000b" 1 1 1 +"ethersbus" "060152" 1 1 1 +"ethersbus" "23c600" 1 1 1 +"ethersbus" "0a0000" 1 1 1 +"ethersbus" "438f00" 1 1 1 +"ethersbus" "001c01" 1 1 1 +"ethersbus" "160152" 1 1 1 +"ethersbus" "1b9eaa" 1 1 1 +"ethersbus" "bf6c00" 1 1 1 +"ethersbus" "000900" 1 1 1 +"ethersbus" "7a0a00" 1 1 1 +"ethersbus" "52438f" 1 1 1 +"ethersbus" "2f0000" 1 1 1 +"ethersbus" "270001" 1 1 1 +"ethersbus" "310000" 1 1 1 +"ethersbus" "748100" 1 1 1 +"ethersbus" "050100" 1 1 1 +"ethersbus" "000501" 1 1 1 +"ethersbus" "45d900" 1 1 1 +"ethersbus" "5d0000" 1 1 1 +"ethersbus" "1b1b69" 1 1 1 +"ethersbus" "001901" 1 1 1 +"ethersbus" "000a02" 1 1 1 +"ethersbus" "0000ed" 1 1 1 +"ethersbus" "100152" 1 1 1 +"ethersbus" "767a00" 1 1 1 +"ethersbus" "01526e" 1 1 1 +"ethersbus" "000300" 1 1 1 +"ethersbus" "0a2053" 1 1 1 +"ethersbus" "00001e" 1 1 1 +"ethersbus" "1e0000" 1 1 1 +"ethersbus" "000f00" 1 1 1 +"ethersbus" "eda600" 1 1 1 +"ethersbus" "070144" 1 1 1 +"ethersbus" "07000a" 1 1 1 +"ethersbus" "000006" 1 1 1 +"ethersbus" "011000" 1 1 1 +"ethersbus" "00312c" 1 1 1 +"ethersbus" "74bf00" 1 1 1 +"ethersbus" "a72c00" 1 1 1 +"ethersbus" "001701" 1 1 1 +"ethersbus" "000016" 1 1 1 +"ethersbus" "b37e00" 1 1 1 +"ethersbus" "120152" 1 1 1 +"ethersbus" "00000e" 1 1 1 +"ethersbus" "6c2020" 1 1 1 +"ethersbus" "444e75" 1 1 1 +"ethersbus" "001c00" 1 1 1 +"ethersbus" "ed7600" 1 1 1 +"ethersbus" "6e8c00" 1 1 1 +"ethersbus" "1c0000" 1 1 1 +"ethersbus" "000901" 1 1 1 +"ethersbus" "0000a3" 1 1 1 +"ethersbus" "01000a" 1 1 1 +"ethersbus" "1bd198" 1 1 1 +"ethersbus" "0000e0" 1 1 1 +"ethersbus" "0004ed" 1 1 1 +"ethersbus" "001400" 1 1 1 +"ethersbus" "015258" 1 1 1 +"ethersbus" "383032" 1 1 1 +"ethersbus" "531800" 1 1 1 +"ethersbus" "100100" 1 1 1 +"ethersbus" "000020" 1 1 1 +"ethersbus" "6ddd00" 1 1 1 +"ethersbus" "1b80b5" 1 1 1 +"ethersbus" "000019" 1 1 1 +"ethersbus" "057600" 1 1 1 +"ethersbus" "00ede6" 1 1 1 +"ethersbus" "5259bc" 1 1 1 +"ethersbus" "8b0000" 1 1 1 +"ethersbus" "02225c" 1 1 1 +"ethersbus" "000222" 1 1 1 +"ethersbus" "200000" 1 1 1 +"ethersbus" "c43c23" 1 1 1 +"ethersbus" "000009" 1 1 1 +"ethersbus" "0a1e02" 1 1 1 +"ethersbus" "3d0000" 1 1 1 +"ethersbus" "343830" 1 1 1 +"ethersbus" "230000" 1 1 1 +"ethersbus" "000100" 1 1 1 +"ethersbus" "00000d" 1 1 1 +"ethersbus" "0100bc" 1 1 1 +"ethersbus" "000017" 1 1 1 +"ethersbus" "001700" 1 1 1 +"ethersbus" "16000a" 1 1 1 +"ethersbus" "0a1b00" 1 1 1 +"ethersbus" "0d0152" 1 1 1 +"ethersbus" "4d3438" 1 1 1 +"ethersbus" "0d0000" 1 1 1 +"ethersbus" "d80000" 1 1 1 +"ethersbus" "00a3d8" 1 1 1 +"ethersbus" "200100" 1 1 1 +"ethersbus" "0152a8" 1 1 1 +"ethersbus" "190100" 1 1 1 +"ethersbus" "0a1be8" 1 1 1 +"ethersbus" "000b01" 1 1 1 +"ethersbus" "0b000a" 1 1 1 +"ethersbus" "330000" 1 1 1 +"ethersbus" "1bca3f" 1 1 1 +"ethersbus" "860000" 1 1 1 +"ethersbus" "e20000" 1 1 1 +"ethersbus" "000e00" 1 1 1 +"ethersbus" "0000c0" 1 1 1 +"ethersbus" "014d6f" 1 1 1 +"ethersbus" "100020" 1 1 1 +"ethersbus" "757a0a" 1 1 1 +"ethersbus" "001b01" 1 1 1 +"ethersbus" "5237dc" 1 1 1 +"ethersbus" "ce0000" 1 1 1 +"ethersbus" "00ce00" 1 1 1 +"ethersbus" "800000" 1 1 1 +"ethersbus" "09000a" 1 1 1 +"ethersbus" "030004" 1 1 1 +"ethersbus" "015243" 1 1 1 +"ethersbus" "1e000a" 1 1 1 +"ethersbus" "f12f00" 1 1 1 +"ethersbus" "000014" 1 1 1 +"ethersbus" "1b545b" 1 1 1 +"ethersbus" "000601" 1 1 1 +"ethersbus" "510a00" 1 1 1 +"ethersbus" "210100" 1 1 1 +"ethersbus" "150152" 1 1 1 +"ethersbus" "588e00" 1 1 1 +"ethersbus" "1b767a" 1 1 1 +"ethersbus" "000b00" 1 1 1 +"ethersbus" "0119a6" 1 1 1 +"ethersbus" "0152a9" 1 1 1 +"ethersbus" "010000" 1 1 1 +"ethersbus" "1f0152" 1 1 1 +"ethersbus" "1c000a" 1 1 1 +"ethersbus" "0152b3" 1 1 1 +"ethersbus" "000180" 1 1 1 +"ethersbus" "00c444" 1 1 1 +"ethersbus" "6c0d00" 1 1 1 +"ethersbus" "070300" 1 1 1 +"ethersbus" "bf0000" 1 1 1 +"ethersbus" "5274bf" 1 1 1 +"ethersbus" "1bf601" 1 1 1 +"ethersbus" "1ba72c" 1 1 1 +"ethersbus" "001601" 1 1 1 +"ethersbus" "cf8700" 1 1 1 +"ethersbus" "ec0000" 1 1 1 +"ethersbus" "00ec00" 1 1 1 +"ethersbus" "9b1200" 1 1 1 +"ethersbus" "52eb1c" 1 1 1 +"ethersbus" "02fd53" 1 1 1 +"ethersbus" "002001" 1 1 1 +"ethersbus" "20000a" 1 1 1 +"ethersbus" "19000a" 1 1 1 +"ethersbus" "1b0576" 1 1 1 +"ethersbus" "001000" 1 1 1 +"ethersbus" "52a94d" 1 1 1 +"ethersbus" "00005d" 1 1 1 +"ethersbus" "0a1e00" 1 1 1 +"ethersbus" "529f4f" 1 1 1 +"ethersbus" "000015" 1 1 1 +"ethersbus" "0f0000" 1 1 1 +"ethersbus" "00000f" 1 1 1 +"ethersbus" "110152" 1 1 1 +"ethersbus" "0a2074" 1 1 1 +"ethersbus" "000600" 1 1 1 +"ethersbus" "656c0d" 1 1 1 +"ethersbus" "001a5d" 1 1 1 +"ethersbus" "1b0152" 1 1 1 +"ethersbus" "01529f" 1 1 1 +"ethersbus" "17000a" 1 1 1 +"ethersbus" "0152eb" 1 1 1 +"ethersbus" "d90000" 1 1 1 +"ethersbus" "470110" 1 1 1 +"ethersbus" "4e757a" 1 1 1 +"ethersbus" "0a1ba7" 1 1 1 +"ethersbus" "0a0203" 1 1 1 +"ethersbus" "0152dd" 1 1 1 +"ethersbus" "1be81e" 1 1 1 +"ethersbus" "9eaa00" 1 1 1 +"ethersbus" "5236ee" 1 1 1 +"ethersbus" "0a000a" 1 1 1 +"ethersbus" "090100" 1 1 1 +"ethersbus" "010144" 1 1 1 +"ethersbus" "04e2b8" 1 1 1 +"ethersbus" "690000" 1 1 1 +"ethersbus" "001d00" 1 1 1 +"ethersbus" "0152f1" 1 1 1 +"ethersbus" "52dd1e" 1 1 1 +"ethersbus" "2e0000" 1 1 1 +"ethersbus" "000a06" 1 1 1 +"ethersbus" "870000" 1 1 1 +"ethersbus" "0a1bed" 1 1 1 +"ethersbus" "0ec652" 1 1 1 +"ethersbus" "000119" 1 1 1 +"ethersbus" "1b6900" 1 1 1 +"ethersbus" "0a1b9e" 1 1 1 +"ethersbus" "ede600" 1 1 1 +"ethersbus" "000c01" 1 1 1 +"ethersbus" "028000" 1 1 1 +"ethersbus" "4d6f64" 1 1 1 +"ethersbus" "000a47" 1 1 1 +"ethersbus" "2c0000" 1 1 1 +"ethersbus" "f60100" 1 1 1 +"ethersbus" "52a87f" 1 1 1 +"ethersbus" "0a1bd1" 1 1 1 +"ethersbus" "020300" 1 1 1 +"ethersbus" "130100" 1 1 1 +"ethersbus" "001200" 1 1 1 +"ethersbus" "526e8c" 1 1 1 +"ethersbus" "000801" 1 1 1 +"ethersbus" "08000a" 1 1 1 +"ethersbus" "810000" 1 1 1 +"ethersbus" "52b37e" 1 1 1 +"ethersbus" "a6040e" 1 1 1 +"ethersbus" "5aa500" 1 1 1 +"ethersbus" "225c00" 1 1 1 +"ethersbus" "05000a" 1 1 1 +"ethersbus" "1a000a" 1 1 1 +"ethersbus" "015236" 1 1 1 +"ethersbus" "0a1b76" 1 1 1 +"ethersbus" "010002" 1 1 1 +"ethersbus" "000a1e" 1 1 1 +"ethersbus" "a45aa5" 1 1 1 +"ethersbus" "000201" 1 1 1 +"ethersbus" "522def" 1 1 1 +"ethersbus" "d45900" 1 1 1 +"ethersbus" "dd1e00" 1 1 1 +"ethersbus" "140100" 1 1 1 +"ethersbus" "00004b" 1 1 1 +"ethersbus" "c65200" 1 1 1 +"ethersbus" "003300" 1 1 1 +"ethersbus" "323000" 1 1 1 +"ethersbus" "000701" 1 1 1 +"ethersbus" "8e0000" 1 1 1 +"ethersbus" "37dc00" 1 1 1 +"ethersbus" "1b9b12" 1 1 1 +"ethersbus" "520000" 1 1 1 +"ethersbus" "5c0001" 1 1 1 +"ethersbus" "c00000" 1 1 1 +"ethersbus" "000500" 1 1 1 +"ethersbus" "01526f" 1 1 1 +"ethersbus" "000a01" 1 1 1 +"ethersbus" "4d0000" 1 1 1 +"ethersbus" "c4444e" 1 1 1 +"ethersbus" "1b6ddd" 1 1 1 +"ethersbus" "001501" 1 1 1 +"ethersbus" "15000a" 1 1 1 +"ethersbus" "6fbe00" 1 1 1 +"ethersbus" "59bc00" 1 1 1 +"ethersbus" "ca3f00" 1 1 1 +"ethersbus" "a50001" 1 1 1 +"ethersbus" "656c6c" 1 1 1 +"ethersbus" "1e0900" 1 1 1 +"ethersbus" "0b3d00" 1 1 1 +"ethersbus" "140000" 1 1 1 +"ethersbus" "fac900" 1 1 1 +"ethersbus" "1e0152" 1 1 1 +"ethersbus" "d19800" 1 1 1 +"ethersbus" "aa0000" 1 1 1 +"ethersbus" "10000a" 1 1 1 +"ethersbus" "015237" 1 1 1 +"ethersbus" "7a1900" 1 1 1 +"ethersbus" "000200" 1 1 1 +"ethersbus" "00001b" 1 1 1 +"ethersbus" "521adf" 1 1 1 +"ethersbus" "e81e00" 1 1 1 +"ethersbus" "13000a" 1 1 1 +"ethersbus" "36ee00" 1 1 1 +"ethersbus" "0e0152" 1 1 1 +"ethersbus" "1b00ce" 1 1 1 +"ethersbus" "120000" 1 1 1 +"ethersbus" "000001" 1 1 1 +"ethersbus" "00017a" 1 1 1 +"ethersbus" "030200" 1 1 1 +"ethersbus" "000031" 1 1 1 +"ethersbus" "001f01" 1 1 1 +"ethersbus" "0a1b80" 1 1 1 +"ethersbus" "7e0000" 1 1 1 +"ethersbus" "1bb933" 1 1 1 +"ethersbus" "0ebb23" 1 1 1 +"ethersbus" "000021" 1 1 1 +"ethersbus" "2def00" 1 1 1 +"ethersbus" "a80000" 1 1 1 +"ethersbus" "000018" 1 1 1 +"ethersbus" "00e0c5" 1 1 1 +"ethersbus" "0c0152" 1 1 1 +"ethersbus" "52dc2c" 1 1 1 +"ethersbus" "110100" 1 1 1 +"ethersbus" "190001" 1 1 1 +"ethersbus" "0a4701" 1 1 1 +"ethersbus" "000a51" 1 1 1 +"ethersio" "000101" 26 27 0.962962962962963 +"ethersio" "4f0001" 26 27 0.962962962962963 +"ethersio" "001800" 26 27 0.962962962962963 +"ethersio" "0c0000" 26 27 0.962962962962963 +"ethersio" "000001" 26 27 0.962962962962963 +"ethersio" "494f00" 26 27 0.962962962962963 +"ethersio" "110000" 26 27 0.962962962962963 +"ethersio" "010000" 26 27 0.962962962962963 +"ethersio" "001100" 26 27 0.962962962962963 +"ethersio" "020000" 26 27 0.962962962962963 +"ethersio" "455349" 26 27 0.962962962962963 +"ethersio" "000200" 26 27 0.962962962962963 +"ethersio" "000100" 26 27 0.962962962962963 +"ethersio" "000c00" 26 27 0.962962962962963 +"ethersio" "180000" 26 27 0.962962962962963 +"ethersio" "010100" 26 27 0.962962962962963 +"ethersio" "53494f" 26 27 0.962962962962963 +"fins" "012001" 1 1 1 +"fins" "070180" 1 1 1 +"fins" "7a0701" 1 1 1 +"fins" "060000" 1 1 1 +"fins" "7a0305" 1 1 1 +"fins" "050000" 1 1 1 +"fins" "007a08" 1 1 1 +"fins" "010180" 1 1 1 +"fins" "00ffff" 1 1 1 +"fins" "7a0220" 1 1 1 +"fins" "007a07" 1 1 1 +"fins" "434480" 1 1 1 +"fins" "cc0001" 1 1 1 +"fins" "98cccc" 1 1 1 +"fins" "800200" 1 1 1 +"fins" "010300" 1 1 1 +"fins" "018000" 1 1 1 +"fins" "424344" 1 1 1 +"fins" "ff0100" 1 1 1 +"fins" "4e0000" 1 1 1 +"fins" "cdce00" 1 1 1 +"fins" "01011b" 1 1 1 +"fins" "0195cc" 1 1 1 +"fins" "010101" 1 1 1 +"fins" "050180" 1 1 1 +"fins" "010580" 1 1 1 +"fins" "cccc00" 1 1 1 +"fins" "00cccc" 1 1 1 +"fins" "0190cc" 1 1 1 +"fins" "004142" 1 1 1 +"fins" "0580cc" 1 1 1 +"fins" "010200" 1 1 1 +"fins" "7a0402" 1 1 1 +"fins" "434445" 1 1 1 +"fins" "7a0603" 1 1 1 +"fins" "1bcccc" 1 1 1 +"fins" "020103" 1 1 1 +"fins" "080000" 1 1 1 +"fins" "000101" 1 1 1 +"fins" "00ff80" 1 1 1 +"fins" "cccdce" 1 1 1 +"fins" "90cccc" 1 1 1 +"fins" "020000" 1 1 1 +"fins" "020901" 1 1 1 +"fins" "010201" 1 1 1 +"fins" "200080" 1 1 1 +"fins" "000002" 1 1 1 +"fins" "81cccd" 1 1 1 +"fins" "010182" 1 1 1 +"fins" "010192" 1 1 1 +"fins" "062000" 1 1 1 +"fins" "0480ff" 1 1 1 +"fins" "000141" 1 1 1 +"fins" "0198cc" 1 1 1 +"fins" "010280" 1 1 1 +"fins" "7a0308" 1 1 1 +"fins" "210000" 1 1 1 +"fins" "018002" 1 1 1 +"fins" "444546" 1 1 1 +"fins" "010103" 1 1 1 +"fins" "0196cc" 1 1 1 +"fins" "0101cc" 1 1 1 +"fins" "016161" 1 1 1 +"fins" "060380" 1 1 1 +"fins" "030600" 1 1 1 +"fins" "00534e" 1 1 1 +"fins" "418000" 1 1 1 +"fins" "010185" 1 1 1 +"fins" "81cccc" 1 1 1 +"fins" "448000" 1 1 1 +"fins" "130000" 1 1 1 +"fins" "7a0101" 1 1 1 +"fins" "97cccc" 1 1 1 +"fins" "0194cc" 1 1 1 +"fins" "010193" 1 1 1 +"fins" "0103cc" 1 1 1 +"fins" "7a0601" 1 1 1 +"fins" "ffff50" 1 1 1 +"fins" "03cccc" 1 1 1 +"fins" "090120" 1 1 1 +"fins" "000280" 1 1 1 +"fins" "007a02" 1 1 1 +"fins" "801100" 1 1 1 +"fins" "01010a" 1 1 1 +"fins" "0300cc" 1 1 1 +"fins" "7a0620" 1 1 1 +"fins" "000004" 1 1 1 +"fins" "414243" 1 1 1 +"fins" "801000" 1 1 1 +"fins" "7a0102" 1 1 1 +"fins" "010190" 1 1 1 +"fins" "82cccc" 1 1 1 +"fins" "040100" 1 1 1 +"fins" "7a0401" 1 1 1 +"fins" "010105" 1 1 1 +"fins" "022000" 1 1 1 +"fins" "7a0202" 1 1 1 +"fins" "ff8000" 1 1 1 +"fins" "0200cc" 1 1 1 +"fins" "110000" 1 1 1 +"fins" "7a0103" 1 1 1 +"fins" "010191" 1 1 1 +"fins" "0185cc" 1 1 1 +"fins" "200102" 1 1 1 +"fins" "022100" 1 1 1 +"fins" "05cccc" 1 1 1 +"fins" "0182cc" 1 1 1 +"fins" "070209" 1 1 1 +"fins" "050100" 1 1 1 +"fins" "007a04" 1 1 1 +"fins" "048000" 1 1 1 +"fins" "ffff40" 1 1 1 +"fins" "cc0002" 1 1 1 +"fins" "038000" 1 1 1 +"fins" "ce0010" 1 1 1 +"fins" "94cccc" 1 1 1 +"fins" "050201" 1 1 1 +"fins" "544180" 1 1 1 +"fins" "ff4441" 1 1 1 +"fins" "018013" 1 1 1 +"fins" "7a0104" 1 1 1 +"fins" "010196" 1 1 1 +"fins" "92cccc" 1 1 1 +"fins" "ffffff" 1 1 1 +"fins" "0000ff" 1 1 1 +"fins" "ff0000" 1 1 1 +"fins" "00ff00" 1 1 1 +"fins" "0a0001" 1 1 1 +"fins" "504153" 1 1 1 +"fins" "200000" 1 1 1 +"fins" "0192cc" 1 1 1 +"fins" "0105cc" 1 1 1 +"fins" "010080" 1 1 1 +"fins" "000100" 1 1 1 +"fins" "007a01" 1 1 1 +"fins" "85cccc" 1 1 1 +"fins" "7a0501" 1 1 1 +"fins" "538000" 1 1 1 +"fins" "018012" 1 1 1 +"fins" "7a0105" 1 1 1 +"fins" "010197" 1 1 1 +"fins" "020180" 1 1 1 +"fins" "100000" 1 1 1 +"fins" "00020a" 1 1 1 +"fins" "001080" 1 1 1 +"fins" "007a06" 1 1 1 +"fins" "030500" 1 1 1 +"fins" "91cccc" 1 1 1 +"fins" "0181cc" 1 1 1 +"fins" "062001" 1 1 1 +"fins" "028010" 1 1 1 +"fins" "01cccc" 1 1 1 +"fins" "00007a" 1 1 1 +"fins" "000080" 1 1 1 +"fins" "535380" 1 1 1 +"fins" "038010" 1 1 1 +"fins" "00ff44" 1 1 1 +"fins" "ffff80" 1 1 1 +"fins" "80ffff" 1 1 1 +"fins" "010100" 1 1 1 +"fins" "060180" 1 1 1 +"fins" "7a0502" 1 1 1 +"fins" "070000" 1 1 1 +"fins" "030400" 1 1 1 +"fins" "018011" 1 1 1 +"fins" "010194" 1 1 1 +"fins" "010380" 1 1 1 +"fins" "cccccc" 1 1 1 +"fins" "468000" 1 1 1 +"fins" "7a0801" 1 1 1 +"fins" "020119" 1 1 1 +"fins" "010000" 1 1 1 +"fins" "000180" 1 1 1 +"fins" "000480" 1 1 1 +"fins" "030700" 1 1 1 +"fins" "000053" 1 1 1 +"fins" "80cccc" 1 1 1 +"fins" "ff40ff" 1 1 1 +"fins" "200180" 1 1 1 +"fins" "007a03" 1 1 1 +"fins" "108000" 1 1 1 +"fins" "0193cc" 1 1 1 +"fins" "0104cc" 1 1 1 +"fins" "018010" 1 1 1 +"fins" "010195" 1 1 1 +"fins" "7a0702" 1 1 1 +"fins" "7a0306" 1 1 1 +"fins" "cc81cc" 1 1 1 +"fins" "011980" 1 1 1 +"fins" "0180cc" 1 1 1 +"fins" "080161" 1 1 1 +"fins" "800002" 1 1 1 +"fins" "028000" 1 1 1 +"fins" "ff5041" 1 1 1 +"fins" "7a0203" 1 1 1 +"fins" "96cccc" 1 1 1 +"fins" "010041" 1 1 1 +"fins" "7a0307" 1 1 1 +"fins" "040000" 1 1 1 +"fins" "010002" 1 1 1 +"fins" "454680" 1 1 1 +"fins" "040280" 1 1 1 +"fins" "010010" 1 1 1 +"fins" "007a05" 1 1 1 +"fins" "050101" 1 1 1 +"fins" "415353" 1 1 1 +"fins" "534e00" 1 1 1 +"fins" "cccc81" 1 1 1 +"fins" "010480" 1 1 1 +"fins" "0191cc" 1 1 1 +"fins" "008000" 1 1 1 +"fins" "010a00" 1 1 1 +"fins" "020280" 1 1 1 +"fins" "801300" 1 1 1 +"fins" "04cccc" 1 1 1 +"fins" "7a0304" 1 1 1 +"fins" "415441" 1 1 1 +"fins" "0197cc" 1 1 1 +"fins" "0100cc" 1 1 1 +"fins" "000200" 1 1 1 +"fins" "198000" 1 1 1 +"fins" "444154" 1 1 1 +"fins" "014142" 1 1 1 +"fins" "011bcc" 1 1 1 +"fins" "95cccc" 1 1 1 +"fins" "000001" 1 1 1 +"fins" "ffff01" 1 1 1 +"fins" "020380" 1 1 1 +"fins" "7a0221" 1 1 1 +"fins" "120000" 1 1 1 +"fins" "801200" 1 1 1 +"fins" "010181" 1 1 1 +"fins" "40ffff" 1 1 1 +"fins" "93cccc" 1 1 1 +"fins" "010104" 1 1 1 +"fins" "616161" 1 1 1 +"fins" "030800" 1 1 1 +"fins" "020a00" 1 1 1 +"fins" "7a0201" 1 1 1 +"fins" "010198" 1 1 1 +"hart" "000d01" 3 3 1 +"hart" "000002" 3 3 1 +"hart" "010000" 3 3 1 +"hart" "0d0100" 3 3 1 +"hart" "02000d" 3 3 1 +"hart" "000200" 3 3 1 +"http" "696f6e" 74 74 1 +"http" "74696f" 74 74 1 +"http" "616765" 74 74 1 +"http" "485454" 73 74 0.986486486486487 +"http" "2e310d" 73 74 0.986486486486487 +"http" "636365" 73 74 0.986486486486487 +"http" "2f312e" 73 74 0.986486486486487 +"http" "416363" 73 74 0.986486486486487 +"http" "0d0a41" 73 74 0.986486486486487 +"http" "70742d" 73 74 0.986486486486487 +"http" "696361" 73 74 0.986486486486487 +"http" "617465" 73 74 0.986486486486487 +"http" "486f73" 73 74 0.986486486486487 +"http" "0d0a55" 73 74 0.986486486486487 +"http" "736572" 73 74 0.986486486486487 +"http" "67656e" 73 74 0.986486486486487 +"http" "0a4163" 73 74 0.986486486486487 +"http" "65722d" 73 74 0.986486486486487 +"http" "0a5573" 73 74 0.986486486486487 +"http" "617469" 73 74 0.986486486486487 +"http" "0a436f" 73 74 0.986486486486487 +"http" "743a20" 73 74 0.986486486486487 +"http" "722d41" 73 74 0.986486486486487 +"http" "54202f" 73 74 0.986486486486487 +"http" "545450" 73 74 0.986486486486487 +"http" "6f6469" 73 74 0.986486486486487 +"http" "310d0a" 73 74 0.986486486486487 +"http" "204854" 73 74 0.986486486486487 +"http" "636f64" 73 74 0.986486486486487 +"http" "73743a" 73 74 0.986486486486487 +"http" "557365" 73 74 0.986486486486487 +"http" "0d0a43" 73 74 0.986486486486487 +"http" "653a20" 73 74 0.986486486486487 +"http" "656e74" 73 74 0.986486486486487 +"http" "6f7374" 73 74 0.986486486486487 +"http" "416765" 73 74 0.986486486486487 +"http" "2d4167" 73 74 0.986486486486487 +"http" "54502f" 73 74 0.986486486486487 +"http" "636570" 73 74 0.986486486486487 +"http" "6e743a" 73 74 0.986486486486487 +"http" "502f31" 73 74 0.986486486486487 +"http" "0a486f" 73 74 0.986486486486487 +"http" "0d0a48" 73 74 0.986486486486487 +"http" "312e31" 73 74 0.986486486486487 +"http" "657074" 73 74 0.986486486486487 +"iec" "000b04" 1 1 1 +"iec" "010414" 1 1 1 +"iec" "1a0004" 1 1 1 +"iec" "040002" 1 1 1 +"iec" "040b00" 1 1 1 +"iec" "001468" 1 1 1 +"iec" "200414" 1 1 1 +"iec" "04000a" 1 1 1 +"iec" "010400" 1 1 1 +"iec" "030414" 1 1 1 +"iec" "020002" 1 1 1 +"iec" "01001a" 1 1 1 +"iec" "683a16" 1 1 1 +"iec" "240004" 1 1 1 +"iec" "64010a" 1 1 1 +"iec" "040024" 1 1 1 +"iec" "1f0414" 1 1 1 +"iec" "68222e" 1 1 1 +"iec" "222c00" 1 1 1 +"iec" "0e2200" 1 1 1 +"iec" "0d0e00" 1 1 1 +"iec" "001f04" 1 1 1 +"iec" "00681e" 1 1 1 +"iec" "683e1a" 1 1 1 +"iec" "361400" 1 1 1 +"iec" "1a0600" 1 1 1 +"iec" "000003" 1 1 1 +"iec" "311017" 1 1 1 +"iec" "0c0000" 1 1 1 +"iec" "68220e" 1 1 1 +"iec" "020001" 1 1 1 +"iec" "680e00" 1 1 1 +"iec" "000068" 1 1 1 +"iec" "090414" 1 1 1 +"iec" "2c0004" 1 1 1 +"iec" "680e20" 1 1 1 +"iec" "0e0200" 1 1 1 +"iec" "06000a" 1 1 1 +"iec" "020000" 1 1 1 +"iec" "000002" 1 1 1 +"iec" "1e0004" 1 1 1 +"iec" "683614" 1 1 1 +"iec" "002204" 1 1 1 +"iec" "040022" 1 1 1 +"iec" "041400" 1 1 1 +"iec" "14681a" 1 1 1 +"iec" "14000a" 1 1 1 +"iec" "04000b" 1 1 1 +"iec" "006822" 1 1 1 +"iec" "040064" 1 1 1 +"iec" "683e1c" 1 1 1 +"iec" "002304" 1 1 1 +"iec" "0d6836" 1 1 1 +"iec" "120004" 1 1 1 +"iec" "68220c" 1 1 1 +"iec" "170884" 1 1 1 +"iec" "070d0c" 1 1 1 +"iec" "0d6846" 1 1 1 +"iec" "680e22" 1 1 1 +"iec" "0d680e" 1 1 1 +"iec" "101708" 1 1 1 +"iec" "430000" 1 1 1 +"iec" "002404" 1 1 1 +"iec" "3e1a00" 1 1 1 +"iec" "000046" 1 1 1 +"iec" "006804" 1 1 1 +"iec" "000a00" 1 1 1 +"iec" "000400" 1 1 1 +"iec" "000004" 1 1 1 +"iec" "070414" 1 1 1 +"iec" "683612" 1 1 1 +"iec" "681a04" 1 1 1 +"iec" "030000" 1 1 1 +"iec" "006401" 1 1 1 +"iec" "088407" 1 1 1 +"iec" "044300" 1 1 1 +"iec" "010700" 1 1 1 +"iec" "230414" 1 1 1 +"iec" "040020" 1 1 1 +"iec" "0b0414" 1 1 1 +"iec" "040009" 1 1 1 +"iec" "040100" 1 1 1 +"iec" "640106" 1 1 1 +"iec" "14680e" 1 1 1 +"iec" "461e00" 1 1 1 +"iec" "68040b" 1 1 1 +"iec" "0c0004" 1 1 1 +"iec" "010600" 1 1 1 +"iec" "048300" 1 1 1 +"iec" "00683e" 1 1 1 +"iec" "001a00" 1 1 1 +"iec" "0d683a" 1 1 1 +"iec" "040005" 1 1 1 +"iec" "0a0000" 1 1 1 +"iec" "070d68" 1 1 1 +"iec" "04001f" 1 1 1 +"iec" "0e0004" 1 1 1 +"iec" "2a2a00" 1 1 1 +"iec" "080004" 1 1 1 +"iec" "681e08" 1 1 1 +"iec" "000300" 1 1 1 +"iec" "2e0004" 1 1 1 +"iec" "004601" 1 1 1 +"iec" "830000" 1 1 1 +"iec" "07000a" 1 1 1 +"iec" "681a06" 1 1 1 +"iec" "1a0400" 1 1 1 +"iec" "220e00" 1 1 1 +"iec" "680443" 1 1 1 +"iec" "0a0001" 1 1 1 +"iec" "0d0d00" 1 1 1 +"iec" "68222c" 1 1 1 +"iec" "180004" 1 1 1 +"iec" "684618" 1 1 1 +"iec" "050414" 1 1 1 +"iec" "000100" 1 1 1 +"iec" "000504" 1 1 1 +"iec" "240414" 1 1 1 +"iec" "0d0000" 1 1 1 +"iec" "040007" 1 1 1 +"iec" "140004" 1 1 1 +"iec" "220c00" 1 1 1 +"iec" "1a2600" 1 1 1 +"iec" "0d6804" 1 1 1 +"iec" "002004" 1 1 1 +"iec" "040023" 1 1 1 +"iec" "461800" 1 1 1 +"iec" "000014" 1 1 1 +"iec" "84070d" 1 1 1 +"iec" "070d0d" 1 1 1 +"iec" "002104" 1 1 1 +"iec" "460104" 1 1 1 +"iec" "070000" 1 1 1 +"iec" "000b00" 1 1 1 +"iec" "04001e" 1 1 1 +"iec" "361200" 1 1 1 +"iec" "2a0a00" 1 1 1 +"iec" "000064" 1 1 1 +"iec" "010000" 1 1 1 +"iec" "3a1600" 1 1 1 +"iec" "1e0414" 1 1 1 +"iec" "680483" 1 1 1 +"iec" "681a26" 1 1 1 +"iec" "1a2400" 1 1 1 +"iec" "220004" 1 1 1 +"iec" "1a0068" 1 1 1 +"iec" "220414" 1 1 1 +"iec" "680401" 1 1 1 +"iec" "280004" 1 1 1 +"iec" "681e28" 1 1 1 +"iec" "070d0e" 1 1 1 +"iec" "0d683e" 1 1 1 +"iec" "000904" 1 1 1 +"iec" "00682a" 1 1 1 +"iec" "040001" 1 1 1 +"iec" "0e0000" 1 1 1 +"iec" "0a0004" 1 1 1 +"iec" "00681a" 1 1 1 +"iec" "0a000a" 1 1 1 +"iec" "000d04" 1 1 1 +"iec" "04000d" 1 1 1 +"iec" "2a1000" 1 1 1 +"iec" "020064" 1 1 1 +"iec" "222e00" 1 1 1 +"iec" "2a0004" 1 1 1 +"iec" "000304" 1 1 1 +"iec" "003110" 1 1 1 +"iec" "0d0c00" 1 1 1 +"iec" "040021" 1 1 1 +"iec" "682a10" 1 1 1 +"iec" "040000" 1 1 1 +"iec" "1e2800" 1 1 1 +"iec" "1c0004" 1 1 1 +"iec" "060002" 1 1 1 +"iec" "0a000b" 1 1 1 +"iec" "681a24" 1 1 1 +"iec" "200004" 1 1 1 +"iec" "1e0800" 1 1 1 +"iec" "000104" 1 1 1 +"iec" "680407" 1 1 1 +"iec" "260004" 1 1 1 +"iec" "010a00" 1 1 1 +"iec" "3e1c00" 1 1 1 +"iec" "210414" 1 1 1 +"iec" "040003" 1 1 1 +"iec" "0d0414" 1 1 1 +"iec" "100004" 1 1 1 +"iec" "000200" 1 1 1 +"iec" "682a2a" 1 1 1 +"iec" "0b0000" 1 1 1 +"iec" "68461e" 1 1 1 +"iec" "001e04" 1 1 1 +"iec" "160004" 1 1 1 +"iec" "006836" 1 1 1 +"iec" "020003" 1 1 1 +"iec" "680e02" 1 1 1 +"iec" "640107" 1 1 1 +"iec" "000031" 1 1 1 +"iec" "682a0a" 1 1 1 +"iec" "000704" 1 1 1 +"iec" "0e2000" 1 1 1 +"iec" "00680e" 1 1 1 +"iec" "040700" 1 1 1 +"mms" "018103" 21 21 1 +"mms" "c10200" 21 21 1 +"mms" "02c202" 21 21 1 +"mms" "02f080" 21 21 1 +"mms" "000600" 21 21 1 +"mms" "800101" 21 21 1 +"mms" "000006" 21 21 1 +"mms" "020100" 21 21 1 +"mms" "03ffff" 21 21 1 +"mms" "130ee0" 21 21 1 +"mms" "010181" 21 21 1 +"mms" "00130e" 21 21 1 +"mms" "00c102" 21 21 1 +"mms" "0002c2" 21 21 1 +"mms" "c20202" 21 21 1 +"mms" "0600c1" 21 21 1 +"mms" "020002" 21 21 1 +"mms" "e00000" 21 21 1 +"mms" "810305" 21 21 1 +"mms" "000013" 21 21 1 +"mms" "0ee000" 21 21 1 +"mms" "000300" 21 21 1 +"mms" "ffffff" 21 21 1 +"mms" "030000" 21 21 1 +"mms" "020200" 21 21 1 +"modbus" "010000" 13 17 0.764705882352941 +"modbus" "000100" 13 17 0.764705882352941 +"ntp" "000001" 16 16 1 +"ntp" "000102" 15 16 0.9375 +"ntp" "c50204" 15 16 0.9375 +"ntp" "0204ec" 15 16 0.9375 +"ntp" "00c502" 15 16 0.9375 +"ntp" "d9000a" 15 16 0.9375 +"ntp" "900000" 15 16 0.9375 +"ntp" "0204eb" 15 16 0.9375 +"ntp" "000afa" 15 16 0.9375 +"ntp" "010290" 15 16 0.9375 +"ntp" "0afa00" 15 16 0.9375 +"ntp" "fa0000" 15 16 0.9375 +"ntp" "0000c5" 15 16 0.9375 +"ntp" "029000" 15 16 0.9375 +"omron" "2d4400" 2 2 1 +"omron" "0000c8" 2 2 1 +"omron" "172a10" 2 2 1 +"omron" "00ef05" 2 2 1 +"omron" "000043" 2 2 1 +"omron" "c00002" 2 2 1 +"omron" "000001" 2 2 1 +"omron" "03000a" 2 2 1 +"omron" "020000" 2 2 1 +"omron" "003031" 2 2 1 +"omron" "4c3230" 2 2 1 +"omron" "435031" 2 2 1 +"omron" "50314c" 2 2 1 +"omron" "300000" 2 2 1 +"omron" "454c32" 2 2 1 +"omron" "080000" 2 2 1 +"omron" "303000" 2 2 1 +"omron" "440000" 2 2 1 +"omron" "050100" 2 2 1 +"omron" "2e3036" 2 2 1 +"omron" "314c2d" 2 2 1 +"omron" "44522d" 2 2 1 +"omron" "4c2d45" 2 2 1 +"omron" "100800" 2 2 1 +"omron" "00c000" 2 2 1 +"omron" "312e30" 2 2 1 +"omron" "004350" 2 2 1 +"omron" "000030" 2 2 1 +"omron" "00c800" 2 2 1 +"omron" "000020" 2 2 1 +"omron" "000a17" 2 2 1 +"omron" "002020" 2 2 1 +"omron" "2d454c" 2 2 1 +"omron" "000300" 2 2 1 +"omron" "360000" 2 2 1 +"omron" "304452" 2 2 1 +"omron" "522d44" 2 2 1 +"omron" "30312e" 2 2 1 +"omron" "000100" 2 2 1 +"omron" "2a1008" 2 2 1 +"omron" "203031" 2 2 1 +"omron" "323044" 2 2 1 +"omron" "202030" 2 2 1 +"omron" "2e3030" 2 2 1 +"omron" "202020" 2 2 1 +"omron" "800002" 2 2 1 +"omron" "010000" 2 2 1 +"omron" "0a172a" 2 2 1 +"omron" "303600" 2 2 1 +"omron" "010003" 2 2 1 +"omron" "000200" 2 2 1 +"s7" "02f080" 36 36 1 +"s7" "000001" 36 36 1 +"s7" "010000" 36 36 1 +"s7" "000300" 36 36 1 +"s7" "000003" 36 36 1 +"s7" "000002" 36 36 1 +"s7" "030000" 36 36 1 +"s7" "020000" 35 36 0.972222222222222 +"s7" "000004" 34 36 0.944444444444444 +"s7" "00c001" 34 36 0.944444444444444 +"s7" "000200" 32 36 0.888888888888889 +"s7" "000100" 32 36 0.888888888888889 +"s7" "c0010a" 30 36 0.833333333333333 +"s7" "000400" 30 36 0.833333333333333 +"s7" "010ac1" 29 36 0.805555555555556 +"s7" "320300" 29 36 0.805555555555556 +"s7" "000800" 29 36 0.805555555555556 +"s7" "f08032" 28 36 0.777777777777778 +"s7" "11d000" 28 36 0.777777777777778 +"s7" "010002" 28 36 0.777777777777778 +"s7" "f00000" 28 36 0.777777777777778 +"s7" "0000ff" 28 36 0.777777777777778 +"s7" "000005" 28 36 0.777777777777778 +"s7" "00001b" 28 36 0.777777777777778 +"s7" "00f000" 28 36 0.777777777777778 +"s7" "080000" 28 36 0.777777777777778 +"s7" "000016" 28 36 0.777777777777778 +"s7" "803203" 28 36 0.777777777777778 +"s7" "0000f0" 28 36 0.777777777777778 +"s7" "1611d0" 28 36 0.777777777777778 +"s7" "001b02" 28 36 0.777777777777778 +"s7" "020300" 28 36 0.777777777777778 +"s7" "001611" 28 36 0.777777777777778 +"s7" "1b02f0" 28 36 0.777777777777778 +"s7" "00c202" 28 36 0.777777777777778 +"s7comm" "00f000" 12 12 1 +"s7comm" "010203" 12 12 1 +"s7comm" "c10201" 12 12 1 +"s7comm" "000016" 12 12 1 +"s7comm" "000400" 12 12 1 +"s7comm" "02f080" 12 12 1 +"s7comm" "000001" 12 12 1 +"s7comm" "010002" 12 12 1 +"s7comm" "000002" 12 12 1 +"s7comm" "020100" 12 12 1 +"s7comm" "001611" 12 12 1 +"s7comm" "010000" 12 12 1 +"s7comm" "c20201" 12 12 1 +"s7comm" "f00000" 12 12 1 +"s7comm" "0100c2" 12 12 1 +"s7comm" "02c001" 12 12 1 +"s7comm" "f00300" 12 12 1 +"s7comm" "00001b" 12 12 1 +"s7comm" "00f003" 12 12 1 +"s7comm" "0300c0" 12 12 1 +"s7comm" "11d000" 12 12 1 +"s7comm" "080000" 12 12 1 +"s7comm" "000800" 12 12 1 +"s7comm" "010001" 12 12 1 +"s7comm" "320100" 12 12 1 +"s7comm" "0000ff" 12 12 1 +"s7comm" "001b02" 12 12 1 +"s7comm" "f08032" 12 12 1 +"s7comm" "e00000" 12 12 1 +"s7comm" "000401" 12 12 1 +"s7comm" "803203" 12 12 1 +"s7comm" "000003" 12 12 1 +"s7comm" "320300" 12 12 1 +"s7comm" "0000f0" 12 12 1 +"s7comm" "000019" 12 12 1 +"s7comm" "00c102" 12 12 1 +"s7comm" "020300" 12 12 1 +"s7comm" "11e000" 12 12 1 +"s7comm" "000300" 12 12 1 +"s7comm" "00c202" 12 12 1 +"s7comm" "000200" 12 12 1 +"s7comm" "803201" 12 12 1 +"s7comm" "1611e0" 12 12 1 +"s7comm" "000100" 12 12 1 +"s7comm" "1611d0" 12 12 1 +"s7comm" "001902" 12 12 1 +"s7comm" "0100f0" 12 12 1 +"s7comm" "030000" 12 12 1 +"s7comm" "1b02f0" 12 12 1 +"s7comm" "00c001" 12 12 1 +"s7comm" "0102c0" 12 12 1 +"s7comm" "020102" 12 12 1 +"s7comm" "020000" 12 12 1 +"s7comm" "1902f0" 12 12 1 +"smb" "000100" 429 436 0.98394495412844 +"smb" "000001" 416 436 0.954128440366973 +"smb" "010000" 413 436 0.947247706422018 +"tftp" "313335" 4 4 1 +"tftp" "333530" 4 4 1 diff --git a/plugins/trout_wizard/trigram_dataset/dataset.cc b/plugins/trout_wizard/trigram_dataset/dataset.cc new file mode 100755 index 0000000..3452877 --- /dev/null +++ b/plugins/trout_wizard/trigram_dataset/dataset.cc @@ -0,0 +1,417 @@ +#include "trigram_dataset.h" +#include +#include + +std::vector trigram = { + {"cip", 0x000100}, {"cip", 0x000001}, {"dnp3", 0x000100}, + {"dnp3", 0x640000}, {"dnp3", 0x040c01}, {"dnp3", 0x016400}, + {"dnp3", 0x030164}, {"dnp3", 0x010003}, {"dnp3", 0x000301}, + {"dnp3", 0x0a0001}, {"dnp3", 0xc40a00}, {"dnp3", 0xc2040c}, + {"dnp3", 0xc1c204}, {"dnp3", 0x00005b}, {"eip", 0x000100}, + {"eip", 0x010000}, {"ethernet", 0x000100}, {"ethernet", 0x010000}, + {"ethersbus", 0x1d000a}, {"ethersbus", 0x1a0152}, {"ethersbus", 0x0152ea}, + {"ethersbus", 0x001500}, {"ethersbus", 0x060000}, {"ethersbus", 0x1bbc8b}, + {"ethersbus", 0x000d01}, {"ethersbus", 0x0a1b1b}, {"ethersbus", 0x1bcf87}, + {"ethersbus", 0xa60000}, {"ethersbus", 0x0a0152}, {"ethersbus", 0x04000a}, + {"ethersbus", 0x00001c}, {"ethersbus", 0xa87f00}, {"ethersbus", 0x1b000a}, + {"ethersbus", 0x0a1bca}, {"ethersbus", 0x0002fd}, {"ethersbus", 0x3c23c6}, + {"ethersbus", 0x0a00c4}, {"ethersbus", 0x80b500}, {"ethersbus", 0x9f4f00}, + {"ethersbus", 0x760000}, {"ethersbus", 0xbe0000}, {"ethersbus", 0x4bec52}, + {"ethersbus", 0x000b3d}, {"ethersbus", 0x30000b}, {"ethersbus", 0x00002e}, + {"ethersbus", 0x21000a}, {"ethersbus", 0x4f0000}, {"ethersbus", 0x001900}, + {"ethersbus", 0x18000a}, {"ethersbus", 0xee0000}, {"ethersbus", 0x040ec6}, + {"ethersbus", 0x01dda4}, {"ethersbus", 0x001b00}, {"ethersbus", 0xef0000}, + {"ethersbus", 0xea2e00}, {"ethersbus", 0xb93300}, {"ethersbus", 0xbc0000}, + {"ethersbus", 0xeb1c00}, {"ethersbus", 0x018000}, {"ethersbus", 0xec5200}, + {"ethersbus", 0x850d00}, {"ethersbus", 0x0a1b85}, {"ethersbus", 0x000a1b}, + {"ethersbus", 0x0a1bf6}, {"ethersbus", 0x170152}, {"ethersbus", 0x0a0603}, + {"ethersbus", 0x0e000a}, {"ethersbus", 0x000d00}, {"ethersbus", 0x170000}, + {"ethersbus", 0x1e0200}, {"ethersbus", 0x052700}, {"ethersbus", 0x000527}, + {"ethersbus", 0xc90000}, {"ethersbus", 0x0c0000}, {"ethersbus", 0x980000}, + {"ethersbus", 0x180152}, {"ethersbus", 0x001800}, {"ethersbus", 0x001101}, + {"ethersbus", 0x11000a}, {"ethersbus", 0x000003}, {"ethersbus", 0x02014d}, + {"ethersbus", 0x001401}, {"ethersbus", 0x545b00}, {"ethersbus", 0x015259}, + {"ethersbus", 0x000033}, {"ethersbus", 0x2045d9}, {"ethersbus", 0x3000fa}, + {"ethersbus", 0x312c00}, {"ethersbus", 0x0d0100}, {"ethersbus", 0x001600}, + {"ethersbus", 0x060300}, {"ethersbus", 0x5b0000}, {"ethersbus", 0x040ebb}, + {"ethersbus", 0xdd0000}, {"ethersbus", 0x1c0152}, {"ethersbus", 0x7a0000}, + {"ethersbus", 0x015200}, {"ethersbus", 0x000008}, {"ethersbus", 0x000101}, + {"ethersbus", 0x001e01}, {"ethersbus", 0x1d0152}, {"ethersbus", 0x0a0600}, + {"ethersbus", 0x0a1bb9}, {"ethersbus", 0x0152dc}, {"ethersbus", 0x4c3100}, + {"ethersbus", 0x44324d}, {"ethersbus", 0x06000a}, {"ethersbus", 0x2e3a00}, + {"ethersbus", 0xb80000}, {"ethersbus", 0x00001a}, {"ethersbus", 0x001801}, + {"ethersbus", 0x001100}, {"ethersbus", 0x0f0152}, {"ethersbus", 0xdc2c00}, + {"ethersbus", 0x020000}, {"ethersbus", 0x000002}, {"ethersbus", 0x0a1e09}, + {"ethersbus", 0xa94d00}, {"ethersbus", 0xfd5300}, {"ethersbus", 0x0a510a}, + {"ethersbus", 0x03000a}, {"ethersbus", 0x1b0000}, {"ethersbus", 0x00000a}, + {"ethersbus", 0x0a1b05}, {"ethersbus", 0x001301}, {"ethersbus", 0x000012}, + {"ethersbus", 0x6f6465}, {"ethersbus", 0x08014d}, {"ethersbus", 0xb7e200}, + {"ethersbus", 0x00b7e2}, {"ethersbus", 0x000e01}, {"ethersbus", 0x530000}, + {"ethersbus", 0x3a0000}, {"ethersbus", 0xe2b800}, {"ethersbus", 0x000c00}, + {"ethersbus", 0x52588e}, {"ethersbus", 0x8c0000}, {"ethersbus", 0x3f0000}, + {"ethersbus", 0xc60000}, {"ethersbus", 0x180000}, {"ethersbus", 0x0a1b6d}, + {"ethersbus", 0x001e00}, {"ethersbus", 0x01522d}, {"ethersbus", 0xbca800}, + {"ethersbus", 0x00bca8}, {"ethersbus", 0x590000}, {"ethersbus", 0xf00000}, + {"ethersbus", 0x14000a}, {"ethersbus", 0x0b0152}, {"ethersbus", 0x004bec}, + {"ethersbus", 0x6c6c20}, {"ethersbus", 0x014432}, {"ethersbus", 0x015274}, + {"ethersbus", 0x00001f}, {"ethersbus", 0x1b3cf0}, {"ethersbus", 0x5200ec}, + {"ethersbus", 0x0d000a}, {"ethersbus", 0x6c0000}, {"ethersbus", 0x000005}, + {"ethersbus", 0x00c000}, {"ethersbus", 0x000401}, {"ethersbus", 0x5d8600}, + {"ethersbus", 0x205318}, {"ethersbus", 0x000013}, {"ethersbus", 0x001300}, + {"ethersbus", 0x12000a}, {"ethersbus", 0x202000}, {"ethersbus", 0x64656c}, + {"ethersbus", 0x1b850d}, {"ethersbus", 0xb50000}, {"ethersbus", 0x7f0000}, + {"ethersbus", 0x0a1b54}, {"ethersbus", 0xdc0000}, {"ethersbus", 0x017a19}, + {"ethersbus", 0x004c31}, {"ethersbus", 0x00004c}, {"ethersbus", 0x000a20}, + {"ethersbus", 0x000700}, {"ethersbus", 0x002e3a}, {"ethersbus", 0x00fac9}, + {"ethersbus", 0x001001}, {"ethersbus", 0x002000}, {"ethersbus", 0xdf0000}, + {"ethersbus", 0x01521a}, {"ethersbus", 0x52f12f}, {"ethersbus", 0x526fbe}, + {"ethersbus", 0x000280}, {"ethersbus", 0x324d34}, {"ethersbus", 0x207481}, + {"ethersbus", 0x0004e2}, {"ethersbus", 0x000a00}, {"ethersbus", 0xe60000}, + {"ethersbus", 0x00bf6c}, {"ethersbus", 0xdda45a}, {"ethersbus", 0x0001dd}, + {"ethersbus", 0x090000}, {"ethersbus", 0xbb2300}, {"ethersbus", 0x000302}, + {"ethersbus", 0x0000c4}, {"ethersbus", 0x1f000a}, {"ethersbus", 0x52ea2e}, + {"ethersbus", 0x04ed76}, {"ethersbus", 0x000004}, {"ethersbus", 0x8000bf}, + {"ethersbus", 0x000400}, {"ethersbus", 0xa3d800}, {"ethersbus", 0x002100}, + {"ethersbus", 0x000010}, {"ethersbus", 0x030000}, {"ethersbus", 0x00000c}, + {"ethersbus", 0x001a01}, {"ethersbus", 0xe0c500}, {"ethersbus", 0xbc8b00}, + {"ethersbus", 0x303230}, {"ethersbus", 0x002045}, {"ethersbus", 0x02000a}, + {"ethersbus", 0x000a07}, {"ethersbus", 0x8f0000}, {"ethersbus", 0x001d01}, + {"ethersbus", 0x00d459}, {"ethersbus", 0x0a0703}, {"ethersbus", 0x1a5d00}, + {"ethersbus", 0x001f00}, {"ethersbus", 0x0000b7}, {"ethersbus", 0x0a1b9b}, + {"ethersbus", 0x0a1bbc}, {"ethersbus", 0x04014d}, {"ethersbus", 0x005d86}, + {"ethersbus", 0x1adf00}, {"ethersbus", 0x0000d4}, {"ethersbus", 0x3cf000}, + {"ethersbus", 0xc50000}, {"ethersbus", 0x001201}, {"ethersbus", 0x000800}, + {"ethersbus", 0x00001d}, {"ethersbus", 0x0a1bcf}, {"ethersbus", 0x000f01}, + {"ethersbus", 0x0f000a}, {"ethersbus", 0x1beda6}, {"ethersbus", 0x19a604}, + {"ethersbus", 0x000007}, {"ethersbus", 0x00c43c}, {"ethersbus", 0x002101}, + {"ethersbus", 0x001a00}, {"ethersbus", 0x0a1b3c}, {"ethersbus", 0x000011}, + {"ethersbus", 0x0c000a}, {"ethersbus", 0x00000b}, {"ethersbus", 0x060152}, + {"ethersbus", 0x23c600}, {"ethersbus", 0x0a0000}, {"ethersbus", 0x438f00}, + {"ethersbus", 0x001c01}, {"ethersbus", 0x160152}, {"ethersbus", 0x1b9eaa}, + {"ethersbus", 0xbf6c00}, {"ethersbus", 0x000900}, {"ethersbus", 0x7a0a00}, + {"ethersbus", 0x52438f}, {"ethersbus", 0x2f0000}, {"ethersbus", 0x270001}, + {"ethersbus", 0x310000}, {"ethersbus", 0x748100}, {"ethersbus", 0x050100}, + {"ethersbus", 0x000501}, {"ethersbus", 0x45d900}, {"ethersbus", 0x5d0000}, + {"ethersbus", 0x1b1b69}, {"ethersbus", 0x001901}, {"ethersbus", 0x000a02}, + {"ethersbus", 0x0000ed}, {"ethersbus", 0x100152}, {"ethersbus", 0x767a00}, + {"ethersbus", 0x01526e}, {"ethersbus", 0x000300}, {"ethersbus", 0x0a2053}, + {"ethersbus", 0x00001e}, {"ethersbus", 0x1e0000}, {"ethersbus", 0x000f00}, + {"ethersbus", 0xeda600}, {"ethersbus", 0x070144}, {"ethersbus", 0x07000a}, + {"ethersbus", 0x000006}, {"ethersbus", 0x011000}, {"ethersbus", 0x00312c}, + {"ethersbus", 0x74bf00}, {"ethersbus", 0xa72c00}, {"ethersbus", 0x001701}, + {"ethersbus", 0x000016}, {"ethersbus", 0xb37e00}, {"ethersbus", 0x120152}, + {"ethersbus", 0x00000e}, {"ethersbus", 0x6c2020}, {"ethersbus", 0x444e75}, + {"ethersbus", 0x001c00}, {"ethersbus", 0xed7600}, {"ethersbus", 0x6e8c00}, + {"ethersbus", 0x1c0000}, {"ethersbus", 0x000901}, {"ethersbus", 0x0000a3}, + {"ethersbus", 0x01000a}, {"ethersbus", 0x1bd198}, {"ethersbus", 0x0000e0}, + {"ethersbus", 0x0004ed}, {"ethersbus", 0x001400}, {"ethersbus", 0x015258}, + {"ethersbus", 0x383032}, {"ethersbus", 0x531800}, {"ethersbus", 0x100100}, + {"ethersbus", 0x000020}, {"ethersbus", 0x6ddd00}, {"ethersbus", 0x1b80b5}, + {"ethersbus", 0x000019}, {"ethersbus", 0x057600}, {"ethersbus", 0x00ede6}, + {"ethersbus", 0x5259bc}, {"ethersbus", 0x8b0000}, {"ethersbus", 0x02225c}, + {"ethersbus", 0x000222}, {"ethersbus", 0x200000}, {"ethersbus", 0xc43c23}, + {"ethersbus", 0x000009}, {"ethersbus", 0x0a1e02}, {"ethersbus", 0x3d0000}, + {"ethersbus", 0x343830}, {"ethersbus", 0x230000}, {"ethersbus", 0x000100}, + {"ethersbus", 0x00000d}, {"ethersbus", 0x0100bc}, {"ethersbus", 0x000017}, + {"ethersbus", 0x001700}, {"ethersbus", 0x16000a}, {"ethersbus", 0x0a1b00}, + {"ethersbus", 0x0d0152}, {"ethersbus", 0x4d3438}, {"ethersbus", 0x0d0000}, + {"ethersbus", 0xd80000}, {"ethersbus", 0x00a3d8}, {"ethersbus", 0x200100}, + {"ethersbus", 0x0152a8}, {"ethersbus", 0x190100}, {"ethersbus", 0x0a1be8}, + {"ethersbus", 0x000b01}, {"ethersbus", 0x0b000a}, {"ethersbus", 0x330000}, + {"ethersbus", 0x1bca3f}, {"ethersbus", 0x860000}, {"ethersbus", 0xe20000}, + {"ethersbus", 0x000e00}, {"ethersbus", 0x0000c0}, {"ethersbus", 0x014d6f}, + {"ethersbus", 0x100020}, {"ethersbus", 0x757a0a}, {"ethersbus", 0x001b01}, + {"ethersbus", 0x5237dc}, {"ethersbus", 0xce0000}, {"ethersbus", 0x00ce00}, + {"ethersbus", 0x800000}, {"ethersbus", 0x09000a}, {"ethersbus", 0x030004}, + {"ethersbus", 0x015243}, {"ethersbus", 0x1e000a}, {"ethersbus", 0xf12f00}, + {"ethersbus", 0x000014}, {"ethersbus", 0x1b545b}, {"ethersbus", 0x000601}, + {"ethersbus", 0x510a00}, {"ethersbus", 0x210100}, {"ethersbus", 0x150152}, + {"ethersbus", 0x588e00}, {"ethersbus", 0x1b767a}, {"ethersbus", 0x000b00}, + {"ethersbus", 0x0119a6}, {"ethersbus", 0x0152a9}, {"ethersbus", 0x010000}, + {"ethersbus", 0x1f0152}, {"ethersbus", 0x1c000a}, {"ethersbus", 0x0152b3}, + {"ethersbus", 0x000180}, {"ethersbus", 0x00c444}, {"ethersbus", 0x6c0d00}, + {"ethersbus", 0x070300}, {"ethersbus", 0xbf0000}, {"ethersbus", 0x5274bf}, + {"ethersbus", 0x1bf601}, {"ethersbus", 0x1ba72c}, {"ethersbus", 0x001601}, + {"ethersbus", 0xcf8700}, {"ethersbus", 0xec0000}, {"ethersbus", 0x00ec00}, + {"ethersbus", 0x9b1200}, {"ethersbus", 0x52eb1c}, {"ethersbus", 0x02fd53}, + {"ethersbus", 0x002001}, {"ethersbus", 0x20000a}, {"ethersbus", 0x19000a}, + {"ethersbus", 0x1b0576}, {"ethersbus", 0x001000}, {"ethersbus", 0x52a94d}, + {"ethersbus", 0x00005d}, {"ethersbus", 0x0a1e00}, {"ethersbus", 0x529f4f}, + {"ethersbus", 0x000015}, {"ethersbus", 0x0f0000}, {"ethersbus", 0x00000f}, + {"ethersbus", 0x110152}, {"ethersbus", 0x0a2074}, {"ethersbus", 0x000600}, + {"ethersbus", 0x656c0d}, {"ethersbus", 0x001a5d}, {"ethersbus", 0x1b0152}, + {"ethersbus", 0x01529f}, {"ethersbus", 0x17000a}, {"ethersbus", 0x0152eb}, + {"ethersbus", 0xd90000}, {"ethersbus", 0x470110}, {"ethersbus", 0x4e757a}, + {"ethersbus", 0x0a1ba7}, {"ethersbus", 0x0a0203}, {"ethersbus", 0x0152dd}, + {"ethersbus", 0x1be81e}, {"ethersbus", 0x9eaa00}, {"ethersbus", 0x5236ee}, + {"ethersbus", 0x0a000a}, {"ethersbus", 0x090100}, {"ethersbus", 0x010144}, + {"ethersbus", 0x04e2b8}, {"ethersbus", 0x690000}, {"ethersbus", 0x001d00}, + {"ethersbus", 0x0152f1}, {"ethersbus", 0x52dd1e}, {"ethersbus", 0x2e0000}, + {"ethersbus", 0x000a06}, {"ethersbus", 0x870000}, {"ethersbus", 0x0a1bed}, + {"ethersbus", 0x0ec652}, {"ethersbus", 0x000119}, {"ethersbus", 0x1b6900}, + {"ethersbus", 0x0a1b9e}, {"ethersbus", 0xede600}, {"ethersbus", 0x000c01}, + {"ethersbus", 0x028000}, {"ethersbus", 0x4d6f64}, {"ethersbus", 0x000a47}, + {"ethersbus", 0x2c0000}, {"ethersbus", 0xf60100}, {"ethersbus", 0x52a87f}, + {"ethersbus", 0x0a1bd1}, {"ethersbus", 0x020300}, {"ethersbus", 0x130100}, + {"ethersbus", 0x001200}, {"ethersbus", 0x526e8c}, {"ethersbus", 0x000801}, + {"ethersbus", 0x08000a}, {"ethersbus", 0x810000}, {"ethersbus", 0x52b37e}, + {"ethersbus", 0xa6040e}, {"ethersbus", 0x5aa500}, {"ethersbus", 0x225c00}, + {"ethersbus", 0x05000a}, {"ethersbus", 0x1a000a}, {"ethersbus", 0x015236}, + {"ethersbus", 0x0a1b76}, {"ethersbus", 0x010002}, {"ethersbus", 0x000a1e}, + {"ethersbus", 0xa45aa5}, {"ethersbus", 0x000201}, {"ethersbus", 0x522def}, + {"ethersbus", 0xd45900}, {"ethersbus", 0xdd1e00}, {"ethersbus", 0x140100}, + {"ethersbus", 0x00004b}, {"ethersbus", 0xc65200}, {"ethersbus", 0x003300}, + {"ethersbus", 0x323000}, {"ethersbus", 0x000701}, {"ethersbus", 0x8e0000}, + {"ethersbus", 0x37dc00}, {"ethersbus", 0x1b9b12}, {"ethersbus", 0x520000}, + {"ethersbus", 0x5c0001}, {"ethersbus", 0xc00000}, {"ethersbus", 0x000500}, + {"ethersbus", 0x01526f}, {"ethersbus", 0x000a01}, {"ethersbus", 0x4d0000}, + {"ethersbus", 0xc4444e}, {"ethersbus", 0x1b6ddd}, {"ethersbus", 0x001501}, + {"ethersbus", 0x15000a}, {"ethersbus", 0x6fbe00}, {"ethersbus", 0x59bc00}, + {"ethersbus", 0xca3f00}, {"ethersbus", 0xa50001}, {"ethersbus", 0x656c6c}, + {"ethersbus", 0x1e0900}, {"ethersbus", 0x0b3d00}, {"ethersbus", 0x140000}, + {"ethersbus", 0xfac900}, {"ethersbus", 0x1e0152}, {"ethersbus", 0xd19800}, + {"ethersbus", 0xaa0000}, {"ethersbus", 0x10000a}, {"ethersbus", 0x015237}, + {"ethersbus", 0x7a1900}, {"ethersbus", 0x000200}, {"ethersbus", 0x00001b}, + {"ethersbus", 0x521adf}, {"ethersbus", 0xe81e00}, {"ethersbus", 0x13000a}, + {"ethersbus", 0x36ee00}, {"ethersbus", 0x0e0152}, {"ethersbus", 0x1b00ce}, + {"ethersbus", 0x120000}, {"ethersbus", 0x000001}, {"ethersbus", 0x00017a}, + {"ethersbus", 0x030200}, {"ethersbus", 0x000031}, {"ethersbus", 0x001f01}, + {"ethersbus", 0x0a1b80}, {"ethersbus", 0x7e0000}, {"ethersbus", 0x1bb933}, + {"ethersbus", 0x0ebb23}, {"ethersbus", 0x000021}, {"ethersbus", 0x2def00}, + {"ethersbus", 0xa80000}, {"ethersbus", 0x000018}, {"ethersbus", 0x00e0c5}, + {"ethersbus", 0x0c0152}, {"ethersbus", 0x52dc2c}, {"ethersbus", 0x110100}, + {"ethersbus", 0x190001}, {"ethersbus", 0x0a4701}, {"ethersbus", 0x000a51}, + {"ethersio", 0x000101}, {"ethersio", 0x4f0001}, {"ethersio", 0x001800}, + {"ethersio", 0x0c0000}, {"ethersio", 0x000001}, {"ethersio", 0x494f00}, + {"ethersio", 0x110000}, {"ethersio", 0x010000}, {"ethersio", 0x001100}, + {"ethersio", 0x020000}, {"ethersio", 0x455349}, {"ethersio", 0x000200}, + {"ethersio", 0x000100}, {"ethersio", 0x000c00}, {"ethersio", 0x180000}, + {"ethersio", 0x010100}, {"ethersio", 0x53494f}, {"fins", 0x012001}, + {"fins", 0x070180}, {"fins", 0x7a0701}, {"fins", 0x060000}, + {"fins", 0x7a0305}, {"fins", 0x050000}, {"fins", 0x007a08}, + {"fins", 0x010180}, {"fins", 0x00ffff}, {"fins", 0x7a0220}, + {"fins", 0x007a07}, {"fins", 0x434480}, {"fins", 0xcc0001}, + {"fins", 0x98cccc}, {"fins", 0x800200}, {"fins", 0x010300}, + {"fins", 0x018000}, {"fins", 0x424344}, {"fins", 0xff0100}, + {"fins", 0x4e0000}, {"fins", 0xcdce00}, {"fins", 0x01011b}, + {"fins", 0x0195cc}, {"fins", 0x010101}, {"fins", 0x050180}, + {"fins", 0x010580}, {"fins", 0xcccc00}, {"fins", 0x00cccc}, + {"fins", 0x0190cc}, {"fins", 0x004142}, {"fins", 0x0580cc}, + {"fins", 0x010200}, {"fins", 0x7a0402}, {"fins", 0x434445}, + {"fins", 0x7a0603}, {"fins", 0x1bcccc}, {"fins", 0x020103}, + {"fins", 0x080000}, {"fins", 0x000101}, {"fins", 0x00ff80}, + {"fins", 0xcccdce}, {"fins", 0x90cccc}, {"fins", 0x020000}, + {"fins", 0x020901}, {"fins", 0x010201}, {"fins", 0x200080}, + {"fins", 0x000002}, {"fins", 0x81cccd}, {"fins", 0x010182}, + {"fins", 0x010192}, {"fins", 0x062000}, {"fins", 0x0480ff}, + {"fins", 0x000141}, {"fins", 0x0198cc}, {"fins", 0x010280}, + {"fins", 0x7a0308}, {"fins", 0x210000}, {"fins", 0x018002}, + {"fins", 0x444546}, {"fins", 0x010103}, {"fins", 0x0196cc}, + {"fins", 0x0101cc}, {"fins", 0x016161}, {"fins", 0x060380}, + {"fins", 0x030600}, {"fins", 0x00534e}, {"fins", 0x418000}, + {"fins", 0x010185}, {"fins", 0x81cccc}, {"fins", 0x448000}, + {"fins", 0x130000}, {"fins", 0x7a0101}, {"fins", 0x97cccc}, + {"fins", 0x0194cc}, {"fins", 0x010193}, {"fins", 0x0103cc}, + {"fins", 0x7a0601}, {"fins", 0xffff50}, {"fins", 0x03cccc}, + {"fins", 0x090120}, {"fins", 0x000280}, {"fins", 0x007a02}, + {"fins", 0x801100}, {"fins", 0x01010a}, {"fins", 0x0300cc}, + {"fins", 0x7a0620}, {"fins", 0x000004}, {"fins", 0x414243}, + {"fins", 0x801000}, {"fins", 0x7a0102}, {"fins", 0x010190}, + {"fins", 0x82cccc}, {"fins", 0x040100}, {"fins", 0x7a0401}, + {"fins", 0x010105}, {"fins", 0x022000}, {"fins", 0x7a0202}, + {"fins", 0xff8000}, {"fins", 0x0200cc}, {"fins", 0x110000}, + {"fins", 0x7a0103}, {"fins", 0x010191}, {"fins", 0x0185cc}, + {"fins", 0x200102}, {"fins", 0x022100}, {"fins", 0x05cccc}, + {"fins", 0x0182cc}, {"fins", 0x070209}, {"fins", 0x050100}, + {"fins", 0x007a04}, {"fins", 0x048000}, {"fins", 0xffff40}, + {"fins", 0xcc0002}, {"fins", 0x038000}, {"fins", 0xce0010}, + {"fins", 0x94cccc}, {"fins", 0x050201}, {"fins", 0x544180}, + {"fins", 0xff4441}, {"fins", 0x018013}, {"fins", 0x7a0104}, + {"fins", 0x010196}, {"fins", 0x92cccc}, {"fins", 0xffffff}, + {"fins", 0x0000ff}, {"fins", 0xff0000}, {"fins", 0x00ff00}, + {"fins", 0x0a0001}, {"fins", 0x504153}, {"fins", 0x200000}, + {"fins", 0x0192cc}, {"fins", 0x0105cc}, {"fins", 0x010080}, + {"fins", 0x000100}, {"fins", 0x007a01}, {"fins", 0x85cccc}, + {"fins", 0x7a0501}, {"fins", 0x538000}, {"fins", 0x018012}, + {"fins", 0x7a0105}, {"fins", 0x010197}, {"fins", 0x020180}, + {"fins", 0x100000}, {"fins", 0x00020a}, {"fins", 0x001080}, + {"fins", 0x007a06}, {"fins", 0x030500}, {"fins", 0x91cccc}, + {"fins", 0x0181cc}, {"fins", 0x062001}, {"fins", 0x028010}, + {"fins", 0x01cccc}, {"fins", 0x00007a}, {"fins", 0x000080}, + {"fins", 0x535380}, {"fins", 0x038010}, {"fins", 0x00ff44}, + {"fins", 0xffff80}, {"fins", 0x80ffff}, {"fins", 0x010100}, + {"fins", 0x060180}, {"fins", 0x7a0502}, {"fins", 0x070000}, + {"fins", 0x030400}, {"fins", 0x018011}, {"fins", 0x010194}, + {"fins", 0x010380}, {"fins", 0xcccccc}, {"fins", 0x468000}, + {"fins", 0x7a0801}, {"fins", 0x020119}, {"fins", 0x010000}, + {"fins", 0x000180}, {"fins", 0x000480}, {"fins", 0x030700}, + {"fins", 0x000053}, {"fins", 0x80cccc}, {"fins", 0xff40ff}, + {"fins", 0x200180}, {"fins", 0x007a03}, {"fins", 0x108000}, + {"fins", 0x0193cc}, {"fins", 0x0104cc}, {"fins", 0x018010}, + {"fins", 0x010195}, {"fins", 0x7a0702}, {"fins", 0x7a0306}, + {"fins", 0xcc81cc}, {"fins", 0x011980}, {"fins", 0x0180cc}, + {"fins", 0x080161}, {"fins", 0x800002}, {"fins", 0x028000}, + {"fins", 0xff5041}, {"fins", 0x7a0203}, {"fins", 0x96cccc}, + {"fins", 0x010041}, {"fins", 0x7a0307}, {"fins", 0x040000}, + {"fins", 0x010002}, {"fins", 0x454680}, {"fins", 0x040280}, + {"fins", 0x010010}, {"fins", 0x007a05}, {"fins", 0x050101}, + {"fins", 0x415353}, {"fins", 0x534e00}, {"fins", 0xcccc81}, + {"fins", 0x010480}, {"fins", 0x0191cc}, {"fins", 0x008000}, + {"fins", 0x010a00}, {"fins", 0x020280}, {"fins", 0x801300}, + {"fins", 0x04cccc}, {"fins", 0x7a0304}, {"fins", 0x415441}, + {"fins", 0x0197cc}, {"fins", 0x0100cc}, {"fins", 0x000200}, + {"fins", 0x198000}, {"fins", 0x444154}, {"fins", 0x014142}, + {"fins", 0x011bcc}, {"fins", 0x95cccc}, {"fins", 0x000001}, + {"fins", 0xffff01}, {"fins", 0x020380}, {"fins", 0x7a0221}, + {"fins", 0x120000}, {"fins", 0x801200}, {"fins", 0x010181}, + {"fins", 0x40ffff}, {"fins", 0x93cccc}, {"fins", 0x010104}, + {"fins", 0x616161}, {"fins", 0x030800}, {"fins", 0x020a00}, + {"fins", 0x7a0201}, {"fins", 0x010198}, {"hart", 0x000d01}, + {"hart", 0x000002}, {"hart", 0x010000}, {"hart", 0x0d0100}, + {"hart", 0x02000d}, {"hart", 0x000200}, {"http", 0x696f6e}, + {"http", 0x74696f}, {"http", 0x616765}, {"http", 0x485454}, + {"http", 0x2e310d}, {"http", 0x636365}, {"http", 0x2f312e}, + {"http", 0x416363}, {"http", 0x0d0a41}, {"http", 0x70742d}, + {"http", 0x696361}, {"http", 0x617465}, {"http", 0x486f73}, + {"http", 0x0d0a55}, {"http", 0x736572}, {"http", 0x67656e}, + {"http", 0x0a4163}, {"http", 0x65722d}, {"http", 0x0a5573}, + {"http", 0x617469}, {"http", 0x0a436f}, {"http", 0x743a20}, + {"http", 0x722d41}, {"http", 0x54202f}, {"http", 0x545450}, + {"http", 0x6f6469}, {"http", 0x310d0a}, {"http", 0x204854}, + {"http", 0x636f64}, {"http", 0x73743a}, {"http", 0x557365}, + {"http", 0x0d0a43}, {"http", 0x653a20}, {"http", 0x656e74}, + {"http", 0x6f7374}, {"http", 0x416765}, {"http", 0x2d4167}, + {"http", 0x54502f}, {"http", 0x636570}, {"http", 0x6e743a}, + {"http", 0x502f31}, {"http", 0x0a486f}, {"http", 0x0d0a48}, + {"http", 0x312e31}, {"http", 0x657074}, {"iec", 0x000b04}, + {"iec", 0x010414}, {"iec", 0x1a0004}, {"iec", 0x040002}, + {"iec", 0x040b00}, {"iec", 0x001468}, {"iec", 0x200414}, + {"iec", 0x04000a}, {"iec", 0x010400}, {"iec", 0x030414}, + {"iec", 0x020002}, {"iec", 0x01001a}, {"iec", 0x683a16}, + {"iec", 0x240004}, {"iec", 0x64010a}, {"iec", 0x040024}, + {"iec", 0x1f0414}, {"iec", 0x68222e}, {"iec", 0x222c00}, + {"iec", 0x0e2200}, {"iec", 0x0d0e00}, {"iec", 0x001f04}, + {"iec", 0x00681e}, {"iec", 0x683e1a}, {"iec", 0x361400}, + {"iec", 0x1a0600}, {"iec", 0x000003}, {"iec", 0x311017}, + {"iec", 0x0c0000}, {"iec", 0x68220e}, {"iec", 0x020001}, + {"iec", 0x680e00}, {"iec", 0x000068}, {"iec", 0x090414}, + {"iec", 0x2c0004}, {"iec", 0x680e20}, {"iec", 0x0e0200}, + {"iec", 0x06000a}, {"iec", 0x020000}, {"iec", 0x000002}, + {"iec", 0x1e0004}, {"iec", 0x683614}, {"iec", 0x002204}, + {"iec", 0x040022}, {"iec", 0x041400}, {"iec", 0x14681a}, + {"iec", 0x14000a}, {"iec", 0x04000b}, {"iec", 0x006822}, + {"iec", 0x040064}, {"iec", 0x683e1c}, {"iec", 0x002304}, + {"iec", 0x0d6836}, {"iec", 0x120004}, {"iec", 0x68220c}, + {"iec", 0x170884}, {"iec", 0x070d0c}, {"iec", 0x0d6846}, + {"iec", 0x680e22}, {"iec", 0x0d680e}, {"iec", 0x101708}, + {"iec", 0x430000}, {"iec", 0x002404}, {"iec", 0x3e1a00}, + {"iec", 0x000046}, {"iec", 0x006804}, {"iec", 0x000a00}, + {"iec", 0x000400}, {"iec", 0x000004}, {"iec", 0x070414}, + {"iec", 0x683612}, {"iec", 0x681a04}, {"iec", 0x030000}, + {"iec", 0x006401}, {"iec", 0x088407}, {"iec", 0x044300}, + {"iec", 0x010700}, {"iec", 0x230414}, {"iec", 0x040020}, + {"iec", 0x0b0414}, {"iec", 0x040009}, {"iec", 0x040100}, + {"iec", 0x640106}, {"iec", 0x14680e}, {"iec", 0x461e00}, + {"iec", 0x68040b}, {"iec", 0x0c0004}, {"iec", 0x010600}, + {"iec", 0x048300}, {"iec", 0x00683e}, {"iec", 0x001a00}, + {"iec", 0x0d683a}, {"iec", 0x040005}, {"iec", 0x0a0000}, + {"iec", 0x070d68}, {"iec", 0x04001f}, {"iec", 0x0e0004}, + {"iec", 0x2a2a00}, {"iec", 0x080004}, {"iec", 0x681e08}, + {"iec", 0x000300}, {"iec", 0x2e0004}, {"iec", 0x004601}, + {"iec", 0x830000}, {"iec", 0x07000a}, {"iec", 0x681a06}, + {"iec", 0x1a0400}, {"iec", 0x220e00}, {"iec", 0x680443}, + {"iec", 0x0a0001}, {"iec", 0x0d0d00}, {"iec", 0x68222c}, + {"iec", 0x180004}, {"iec", 0x684618}, {"iec", 0x050414}, + {"iec", 0x000100}, {"iec", 0x000504}, {"iec", 0x240414}, + {"iec", 0x0d0000}, {"iec", 0x040007}, {"iec", 0x140004}, + {"iec", 0x220c00}, {"iec", 0x1a2600}, {"iec", 0x0d6804}, + {"iec", 0x002004}, {"iec", 0x040023}, {"iec", 0x461800}, + {"iec", 0x000014}, {"iec", 0x84070d}, {"iec", 0x070d0d}, + {"iec", 0x002104}, {"iec", 0x460104}, {"iec", 0x070000}, + {"iec", 0x000b00}, {"iec", 0x04001e}, {"iec", 0x361200}, + {"iec", 0x2a0a00}, {"iec", 0x000064}, {"iec", 0x010000}, + {"iec", 0x3a1600}, {"iec", 0x1e0414}, {"iec", 0x680483}, + {"iec", 0x681a26}, {"iec", 0x1a2400}, {"iec", 0x220004}, + {"iec", 0x1a0068}, {"iec", 0x220414}, {"iec", 0x680401}, + {"iec", 0x280004}, {"iec", 0x681e28}, {"iec", 0x070d0e}, + {"iec", 0x0d683e}, {"iec", 0x000904}, {"iec", 0x00682a}, + {"iec", 0x040001}, {"iec", 0x0e0000}, {"iec", 0x0a0004}, + {"iec", 0x00681a}, {"iec", 0x0a000a}, {"iec", 0x000d04}, + {"iec", 0x04000d}, {"iec", 0x2a1000}, {"iec", 0x020064}, + {"iec", 0x222e00}, {"iec", 0x2a0004}, {"iec", 0x000304}, + {"iec", 0x003110}, {"iec", 0x0d0c00}, {"iec", 0x040021}, + {"iec", 0x682a10}, {"iec", 0x040000}, {"iec", 0x1e2800}, + {"iec", 0x1c0004}, {"iec", 0x060002}, {"iec", 0x0a000b}, + {"iec", 0x681a24}, {"iec", 0x200004}, {"iec", 0x1e0800}, + {"iec", 0x000104}, {"iec", 0x680407}, {"iec", 0x260004}, + {"iec", 0x010a00}, {"iec", 0x3e1c00}, {"iec", 0x210414}, + {"iec", 0x040003}, {"iec", 0x0d0414}, {"iec", 0x100004}, + {"iec", 0x000200}, {"iec", 0x682a2a}, {"iec", 0x0b0000}, + {"iec", 0x68461e}, {"iec", 0x001e04}, {"iec", 0x160004}, + {"iec", 0x006836}, {"iec", 0x020003}, {"iec", 0x680e02}, + {"iec", 0x640107}, {"iec", 0x000031}, {"iec", 0x682a0a}, + {"iec", 0x000704}, {"iec", 0x0e2000}, {"iec", 0x00680e}, + {"iec", 0x040700}, {"mms", 0x018103}, {"mms", 0xc10200}, + {"mms", 0x02c202}, {"mms", 0x02f080}, {"mms", 0x000600}, + {"mms", 0x800101}, {"mms", 0x000006}, {"mms", 0x020100}, + {"mms", 0x03ffff}, {"mms", 0x130ee0}, {"mms", 0x010181}, + {"mms", 0x00130e}, {"mms", 0x00c102}, {"mms", 0x0002c2}, + {"mms", 0xc20202}, {"mms", 0x0600c1}, {"mms", 0x020002}, + {"mms", 0xe00000}, {"mms", 0x810305}, {"mms", 0x000013}, + {"mms", 0x0ee000}, {"mms", 0x000300}, {"mms", 0xffffff}, + {"mms", 0x030000}, {"mms", 0x020200}, {"modbus", 0x010000}, + {"modbus", 0x000100}, {"ntp", 0x000001}, {"ntp", 0x000102}, + {"ntp", 0xc50204}, {"ntp", 0x0204ec}, {"ntp", 0x00c502}, + {"ntp", 0xd9000a}, {"ntp", 0x900000}, {"ntp", 0x0204eb}, + {"ntp", 0x000afa}, {"ntp", 0x010290}, {"ntp", 0x0afa00}, + {"ntp", 0xfa0000}, {"ntp", 0x0000c5}, {"ntp", 0x029000}, + {"omron", 0x2d4400}, {"omron", 0x0000c8}, {"omron", 0x172a10}, + {"omron", 0x00ef05}, {"omron", 0x000043}, {"omron", 0xc00002}, + {"omron", 0x000001}, {"omron", 0x03000a}, {"omron", 0x020000}, + {"omron", 0x003031}, {"omron", 0x4c3230}, {"omron", 0x435031}, + {"omron", 0x50314c}, {"omron", 0x300000}, {"omron", 0x454c32}, + {"omron", 0x080000}, {"omron", 0x303000}, {"omron", 0x440000}, + {"omron", 0x050100}, {"omron", 0x2e3036}, {"omron", 0x314c2d}, + {"omron", 0x44522d}, {"omron", 0x4c2d45}, {"omron", 0x100800}, + {"omron", 0x00c000}, {"omron", 0x312e30}, {"omron", 0x004350}, + {"omron", 0x000030}, {"omron", 0x00c800}, {"omron", 0x000020}, + {"omron", 0x000a17}, {"omron", 0x002020}, {"omron", 0x2d454c}, + {"omron", 0x000300}, {"omron", 0x360000}, {"omron", 0x304452}, + {"omron", 0x522d44}, {"omron", 0x30312e}, {"omron", 0x000100}, + {"omron", 0x2a1008}, {"omron", 0x203031}, {"omron", 0x323044}, + {"omron", 0x202030}, {"omron", 0x2e3030}, {"omron", 0x202020}, + {"omron", 0x800002}, {"omron", 0x010000}, {"omron", 0x0a172a}, + {"omron", 0x303600}, {"omron", 0x010003}, {"omron", 0x000200}, + {"s7", 0x02f080}, {"s7", 0x000001}, {"s7", 0x010000}, + {"s7", 0x000300}, {"s7", 0x000003}, {"s7", 0x000002}, + {"s7", 0x030000}, {"s7", 0x020000}, {"s7", 0x000004}, + {"s7", 0x00c001}, {"s7", 0x000200}, {"s7", 0x000100}, + {"s7", 0xc0010a}, {"s7", 0x000400}, {"s7", 0x010ac1}, + {"s7", 0x320300}, {"s7", 0x000800}, {"s7", 0xf08032}, + {"s7", 0x11d000}, {"s7", 0x010002}, {"s7", 0xf00000}, + {"s7", 0x0000ff}, {"s7", 0x000005}, {"s7", 0x00001b}, + {"s7", 0x00f000}, {"s7", 0x080000}, {"s7", 0x000016}, + {"s7", 0x803203}, {"s7", 0x0000f0}, {"s7", 0x1611d0}, + {"s7", 0x001b02}, {"s7", 0x020300}, {"s7", 0x001611}, + {"s7", 0x1b02f0}, {"s7", 0x00c202}, {"s7comm", 0x00f000}, + {"s7comm", 0x010203}, {"s7comm", 0xc10201}, {"s7comm", 0x000016}, + {"s7comm", 0x000400}, {"s7comm", 0x02f080}, {"s7comm", 0x000001}, + {"s7comm", 0x010002}, {"s7comm", 0x000002}, {"s7comm", 0x020100}, + {"s7comm", 0x001611}, {"s7comm", 0x010000}, {"s7comm", 0xc20201}, + {"s7comm", 0xf00000}, {"s7comm", 0x0100c2}, {"s7comm", 0x02c001}, + {"s7comm", 0xf00300}, {"s7comm", 0x00001b}, {"s7comm", 0x00f003}, + {"s7comm", 0x0300c0}, {"s7comm", 0x11d000}, {"s7comm", 0x080000}, + {"s7comm", 0x000800}, {"s7comm", 0x010001}, {"s7comm", 0x320100}, + {"s7comm", 0x0000ff}, {"s7comm", 0x001b02}, {"s7comm", 0xf08032}, + {"s7comm", 0xe00000}, {"s7comm", 0x000401}, {"s7comm", 0x803203}, + {"s7comm", 0x000003}, {"s7comm", 0x320300}, {"s7comm", 0x0000f0}, + {"s7comm", 0x000019}, {"s7comm", 0x00c102}, {"s7comm", 0x020300}, + {"s7comm", 0x11e000}, {"s7comm", 0x000300}, {"s7comm", 0x00c202}, + {"s7comm", 0x000200}, {"s7comm", 0x803201}, {"s7comm", 0x1611e0}, + {"s7comm", 0x000100}, {"s7comm", 0x1611d0}, {"s7comm", 0x001902}, + {"s7comm", 0x0100f0}, {"s7comm", 0x030000}, {"s7comm", 0x1b02f0}, + {"s7comm", 0x00c001}, {"s7comm", 0x0102c0}, {"s7comm", 0x020102}, + {"s7comm", 0x020000}, {"s7comm", 0x1902f0}, {"smb", 0x000100}, + {"smb", 0x000001}, {"smb", 0x010000}, {"tftp", 0x313335}, + {"tftp", 0x333530}, +}; diff --git a/plugins/trout_wizard/trigram_dataset/dataset_csv.do b/plugins/trout_wizard/trigram_dataset/dataset_csv.do new file mode 100755 index 0000000..fa089fe --- /dev/null +++ b/plugins/trout_wizard/trigram_dataset/dataset_csv.do @@ -0,0 +1,17 @@ +OUTPUT="dataset.cc" +INPUT="candidates.csv" +#redo-ifchange "$INPUT" + +cat < "$OUTPUT" +#include +#include +#include "trigram_minsketch.h" + +std::vector trigram = { +eof + +tail -n +2 "$INPUT" | while read -r protocol tgs np nc tf; do + echo " {${protocol},"0x$(echo "$tgs" | sed "s/^['\"]//;s/['\"]$//")" }," >> "$OUTPUT" +done + +echo "};" >> "$OUTPUT" \ No newline at end of file diff --git a/plugins/trout_wizard/trigram_dataset/trigram_dataset.cc b/plugins/trout_wizard/trigram_dataset/trigram_dataset.cc new file mode 100644 index 0000000..7f4c392 --- /dev/null +++ b/plugins/trout_wizard/trigram_dataset/trigram_dataset.cc @@ -0,0 +1,37 @@ + +// System includes +#include +#include +#include + +// Local includes +#include "trigram_dataset.h" + +// fetching the (protocol and tgm list) string from the dataset +int main() { + std::unordered_map> dataset; + + // Group tgms under each protocol + for (const auto &[proto, tgm] : trigram) { + dataset[proto].push_back(tgm); + } + + std::ostringstream ops; + + ops << "{\n"; + for (auto &[proto, vec] : dataset) { + ops << "{" << "protocol =" << "\"" << proto << "\"" << ",\n" + << "tgm_set = " << "\""; + for (size_t i = 0; i < vec.size(); ++i) { + ops << std::hex << vec[i]; + if (i != vec.size() - 1) + ops << ","; + } + ops << "\"" << "},\n"; + } + ops << "}"; + + std::cout << ops.str(); + + return 0; +} diff --git a/plugins/trout_wizard/trigram_dataset/trigram_dataset.h b/plugins/trout_wizard/trigram_dataset/trigram_dataset.h new file mode 100644 index 0000000..f638842 --- /dev/null +++ b/plugins/trout_wizard/trigram_dataset/trigram_dataset.h @@ -0,0 +1,16 @@ + +#ifndef TRIGRAM_DATASET_H +#define TRIGRAM_DATASET_H + +// System includes +#include +#include + +struct TrigramSet { + std::string protocol; + std::uint32_t tgs; +}; + +extern std::vector trigram; + +#endif // TRIGRAM_DATASET_H \ No newline at end of file