search

GyulyVGC / sniffnet

Comfortably monitor your Internet traffic 🕵️‍♂️
https://sniffnet.net
Apache License 2.0
18.65k stars 560 forks source link

Support more upper layer services (many, many, many more) #446

Closed GyulyVGC closed 9 months ago

GyulyVGC commented 10 months ago

[!WARNING] This PR was replaced by #450

As requested in #374 and by multiple other users of the application (e.g., #289, #338), this PR adds support for several new upper layer services in addition to the 24 already supported application protocols.

The full list of the new supported services, taken from Nmap, is basically the IANA assigned ports list plus some trojans and worms. It contains 6438 different services/protocols/trojans/worms.

While I could use a file-lookup approach to resolve the name of a service given a port number and the transport protocol, I decided to create a short bash script that automatically curls the full list of services and generates a Rust file containing a single (very long) match expression wrapped in a new method. This strategy may seem a little unconventional but should guarantee un-matchable performances (pun intended) in the port-to-service mapping procedure.

Since apparently there isn't a way to autofix clippy::match_same_arms, the bash script also takes care of merging duplicate branches of the match.

Fixes #374

yawaramin commented 10 months ago

If you do this, you'll have to cut a new release every time you want to change even a single character of any of the service definitions. It will quickly become unsustainable.

GyulyVGC commented 10 months ago

If you do this, you'll have to cut a new release every time you want to change even a single character of any of the service definitions. It will quickly become unsustainable.

I see your point.

Anyway, I don't judge it a priority to update this service list. The most common services assignments are stable, well-known, and long lasting conventions maintained directly by IANA.

GyulyVGC commented 9 months ago

After having long discussed this PR with the Rust community of Reddit, I came to the conclusion that a better strategy is to generate a compile-time, static, perfect hash map for the network services. The new approach still guarantees high performances and avoids the complexities of this PR.

New PR: #450.