Spotting Aggressive Clandestine BotNets
"Yesterday was making a typical “evening run” in cyberspace and noticed a strange pattern, zoomed in, and found a aggressive clandestine “indexing” botnet operating out of a dedicated hosting provider’s datacenter. The feature image in this post shows a... (0 Replies)
snmpa_network_interface_filter(3erl) Erlang Module Definition snmpa_network_interface_filter(3erl)NAME
snmpa_network_interface_filter - Behaviour module for the SNMP agent network-interface filter.
DESCRIPTION
This module defines the behaviour of the agent network interface filter. A snmpa_network_interface_filter compliant module must export the
following functions:
* accept_recv/2
* accept_send/2
* accept_recv_pdu/3
* accept_send_pdu/2
The semantics of them and their exact signatures are explained below.
The purpose of the network interface filter is to allow for filtering of messages (accept or reject) receive and send. This is done on two
levels:
* The first level is at the UDP entry / exit point, i.e. immediately after the receipt of the message, before any message processing is
done (accept_recv) and immediately before sending the message, after all message processing is done (accept_send).
* The second level is at the MPD entry / exit point, i.e. immediately after the basic message processing (accept_recv_pdu) / immediately
before the basic message processing (accept_send_pdu).
Note that the network interface filter is something which is used by the network interface implementation provided by the application (
snmpa_net_if ). The default filter accepts all messages.
A network interface filter can e.g. be used during testing or for load regulation. If the intended use is load regulation, see also
req_limit and the function register_notification_filter .
DATA TYPES
port() = integer() > 0
pdu_type() = 'get-request' | 'get-next-request' | 'get-response' | 'set-request' | trap | 'get-bulk-request' | 'inform-request' | report
EXPORTS
accept_recv(Ip, Port) -> boolean()
Types Ip = ip_address()
Port = port()
Called at the reception of a message (before any processing has been done).
For the message to be discarded, the function must return false .
accept_send(Ip, Port) -> boolean()
Types Ip = ip_address()
Port = port()
Called before the sending of a message (after all processing has been done).
For the message to be discarded, the function must return false .
accept_recv_pdu(Ip, Port, PduType) -> boolean()
Types Ip = ip_address()
Port = port()
PduType = pdu_type()
Called after the basic message processing (MPD) has been done, but before the pdu is handed over to the master-agent for primary
processing.
For the pdu to be discarded, the function must return false .
accept_send_pdu(Targets, PduType) -> Reply
Types Targets = targets()
targets() = [target()]
target() = {ip_address(), port()}
PduType = pdu_type() > 0
Reply = boolean() | NewTargets
NewTargets = targets()
Called before the basic message processing (MPD) is done, when a pdu has been received from the master-agent.
For the message to be discarded all together, the function must return false .
Note that it is possible for this function to filter out targets (but not add its own) by returning an updated Targets list ( New-
Targets ).
Ericsson AB snmp 4.19 snmpa_network_interface_filter(3erl)
