NAME

yafdpi - yaf deep packet inspection

SYNOPSIS

yaf --plugin-name=dpacketplugin [--plugin-conf=FILE]
    [--plugin-opts=APPLABELS] --applabel --max-payload=MAX_PAYLOAD ...

DESCRIPTION

yaf(1) can optionally examine packet payloads, capture useful information for specific protocols, and export that information in a protocol-specific template in IPFIX records. This process is called deep packet inspection (DPI).

DPI in yaf is directly related to determining a flow record's application label (often called appLabel, see applabel(1)) as yaf only performs DPI if an appLabel was set during the application labeling phase, and the deep packet inspection performed is specific to the chosen application label. (Some appLabels that yaf identifies do not support DPI.)

The DPI data is exported as sub-records of the main record and are stored in a subTemplateMultiList.

The DPI is executed by a plug-in that yaf loads at run time, and yaf must be built with plug-in support for DPI to be available. To see if that support is available, check the "Plugin support" setting in the output of yaf --version. (To enable this feature when building yaf, specify the --enable-applabel and --enable-plugins options to the configure script.)

To use the DPI plugin with yaf, specify --plugin-name with an argument of dpacketplugin. If yaf is unable to find the plug-in, you may either set the LTDL_LIBRARY_PATH environment variable to the path containing the file (LTDL_LIBRARY_PATH=/usr/local/lib/yaf), or specify the complete path to the plugin file, for example --plugin-name=/usr/local/lib/yaf/dpacketplugin.la.

Using the DPI plugin requires payload capture to be enabled with the --max-payload option. A minimum payload capture length of 384 octets is recommended for best results. The --applabel option is also required, as the application label determines how the inspection will execute.

When loading the dpacketplugin plug-in, yaf loads the plug-in's configuration from the file at /usr/local/etc/yafDPIRules.conf. To tell yaf to load a different file instead, provide the --plugin-conf option and the path to the file.

You may also add the --plugin-opts switch to specify the appLabels on which to perform DPI:

--plugin-opts="53 80 21"

The above performs DPI for DNS, HTTP, and FTP. Note the values must be separated by spaces, not commas.

In order to perform DPI on DNSSEC resource records, add "DNSSEC" to the --plugin-opts option:

--plugin-opts=DNSSEC

Enables DPI over all protocols and includes DNSSEC resource records.

--plugin-opts="DNSSEC 53"

Enables DPI over only DNS and DNSSEC resource records.

--plugin-opts="DNSSEC 53 80"

Enables DPI over HTTP and DNS only and includes DNSSEC resource records.

--plugin-opts="DNSSEC 80"

Enables DPI over HTTP only and does not enable DNSSEC resource records. When any appLabel is present, you must also include 53 to enable DNSSEC.

DPI operates differently depending on whether the protocol is plugin-based or regex-based in the yafApplabelRules.conf file (see applabel(1) for a description of this file).

If the protocol uses a regex rule for application labeling, the yafDPIRules.conf file (described below has a list of regular expressions that are compared against the captured payload. Any matches are stored and later exported in a series of IPFIX basicLists, where each basicList contains one IPFIX information element corresponding to one regular expression.

If the protocol is based on a plugin rule, the dynamically loaded plugin listed in the yafApplabelRules.conf file stores important information while it is decoding the payload, and later exports that information in customized templates. See the source code to the plugins included with yaf for details on the specific protocol implementations.

Some plugins allow configurable deep packet inspection from the yafDPIRules.conf file, such as DNP 3.0, Ethernet/IP, and SCADA. See below for specific information on these particular protocols.

DPI CONFIG FILE FORMAT

The contents of the yafDPIRules.conf file includes

The yafDPIRules.conf file should be in the same directory as the yafApplabelRules.conf file (see applabel(1)), and it follows a format similar to that file.

If a statement is not properly formatted, yaf may continue to run and entirely ignore the contents of the file.

Comments and Blank Lines

A '#' symbol starts a comment in the file, and the rest of the line is a comment. The comment and any whitespace that precedes it is ignored.

Comments must appear on their own line; they are not recognized if they appear after another keyword. Example:

# this is a comment

A completely empty line or a line containing only whitespace is considered a blank line and is ignored.

Regex Rules

The regex rules in the file begin with the keyword label and contain three parts: an appLabel, an IPFIX element ID, and a regex (regular expression) pattern. Elements may either be defined by yaf or by the user.

The regexes for an appLabel are only executed when the application labeling engine assigns that appLabel to the flow record.

The order in which appLabels appear does not matter.

A single appLabel supports multiple label statements, however each statement must use a unique element ID.

The order of the regex rules for a single appLabel matters. There are limits to the number and lengths of the fields that yaf exports, and yaf processes the rules in the order they appear in this file. It is best to put the most important regexes before others.

The regexes are PCRE2 Perl Compatible Regular Expressions. For details on the syntax, see the pcre2pattern(1) manual page or web page.

In the regex pattern, there should be parentheses around the substring you want to capture and store. If there are no (capturing) parentheses, the entire matched expression is captured. If there are more than 1 set of parentheses in the regular expression, the outermost set is the substring captured. To avoid capturing a substring and for efficiency, use non-capturing parentheses for grouping (for example, use '(?:foo|bar)' to match 'foo' or 'bar' without capturing the text). See the PCRE2 documentation for details on regular expressions and substring matching.

YAF DPI Rule

A YAF DPI Rule is a rule that uses an element defined in yaf, or more specifically, an element defined in CERT IPFIX Private Enterprise (PEN 6871) and listed in the CERT IPFIX Registry.

A YAF DPI Rule has this format:

label APP yaf ELEMENT_IE EXPRESSION

where:

It is acceptable to comment out any YAF DPI rule. Doing so prevents yaf from executing the rule against the payload, though the element may still appear in the template and be exported in the record as an empty list.

User DPI Rule and Element Definition

To define a regular expression that is stored in a user-defined information element, use the following form, which is similar to that above:

label APP user ELEMENT_ID name ELEMENT_NAME EXPRESSION

where:

There is a limit of 30 additional fields per protocol that yaf stores and executes. To find out if yaf accepted your elements, run yaf with --verbose. All user elements are exported using the CERT Private Enterprise Number (PEN) 6871. ONLY user labels for protocols FTP, HTTP, RTSP, and SIP are allowed. Elements are added to the template in the order they are listed in the yafDPIRules.conf file in the form of an basicList.

Export Limits

The yafDPIRules.conf file may contain statements to control the amount of DPI data exported by yaf.

limit field [length] MAX_LENGTH

This statement specifies the maximum length, in octets, of any single field that yaf will export (for most protocols). If a regex captures a longer field, the field is truncated to this length. If this statement is not present, the default maximum is 256 octets. The maximum allowed value for MAX_LENGTH is 16383. If a larger value is specified, the default value is used.

This statement was changed in yaf-2.20 to include the keyword length. For compatibility with older versions of yaf, its use is optional.

This statement does not affect the DNS Deep Packet Inspection or SSL Certificate Capture. For DNS, a domain name can have a maximum of 255 characters and the limit is not configurable.

limit total [length] MAX_SUM

This statement specifies the maximum value for the sum of the lengths of all fields, in octets, that yaf will export. Fields that cause MAX_SUM to be exceeded are ignored. If this statement is not present, the default value of the maximum sum is 2048 octets. The maximum allowed value for MAX_SUM is 32767. If a larger value is specified, the default value is used instead.

This statement was changed in yaf-2.20 to include the keyword length. For compatibility with older versions of yaf, its use is optional.

limit direction count MAX_COUNT

This statement specifies the maximum number of fields yaf will capture per direction. The maximum number of fields yaf will capture is twice MAX_COUNT. If this statement is not present, the default maximum is 128 fields per direction. The maximum allowed value for MAX_COUNT is 8192. If a larger value is specified, the default value is used. This setting was added in yaf-2.20.

Optional Features

There are two statements that enable features related to TLS/SSL export.

By default, yaf parses the X.509 certificates and exports the information described below under "TLS/SSL (443) - yaf_ssl". The following settings affect that behavior:

cert_export_enabled = NUMBER

This setting, when NUMBER is non-zero, causes yaf export the complete X.509 certificate(s), as an octetArray, in the format described below under "TLS/SSL Full Certificate Template - yaf_ssl_cert_full".

This setting also causes yaf to disable its traditional TLS certificate decode and export. You can re-enable the traditional TLS elements by enabling the cert_hash_enabled feature.

cert_hash_enabled = NUMBER

This setting, when NUMBER is non-zero, tells yaf to export the hash of the X.509 certificate as found in the certificate. This is typically the SHA-256 hash of the binary certificate but it can vary by the hashing algorithm used. The hashing algorithm can be identified by the sslCertSignature field.

If both cert_export_enabled and cert_hash_enabled are non-zero, yaf exports the full binary X.509 certificate and performs and exports the traditional decode of the X.509 certificate. Enabling both significantly increases the size of the exported DPI. When cert_export_enabled is enabled, super_mediator(1) can perform the extraction of relevant fields as is done by yaf, plus it provides the option to perform SHA-1 or MD5 hashes of the certificate.

DPI IN ACTION

Upon yaf startup and capture, you are able to see if the rule files and their regular expressions were accepted using the --verbose flag.

[2026-06-26 19:39:25] DPI Running for ALL Protocols
[2026-06-26 19:39:25] Initializing DPI Rules from File "/usr/local/etc/yafDPIRules.conf"
[2026-06-26 19:39:25] DPI rule scanner accepted 44 rules from the DPI Rule File
[2026-06-26 19:39:25] DPI regular expressions cover 4 protocols

An unacceptable regular expression will be brought to your attention with the above statements. If you choose certain protocols for inspection using the --plugin-opts flag, only the appropriate rule statements are loaded into the DPI Rule Scanner.

BUILD-TIME CONFIGURE OPTIONS

The following options can be given to ./configure when yaf is built to export DNS authoritative and NXDomain Responses only.

--enable-exportDNSAuth

Enable export of DNS Authoritative Responses only. The default is to capture and export all DNS Responses. This flag can be used in conjunction with --enable-exportDNSNXDomain. It is only recognized if --plugin-name is set to the DPI plugin, application labeling is enabled, and --max-payload is set.

--enable-exportDNSNXDomain

Enable export of DNS NXDomain Responses only. The default is to capture and export all DNS Responses. This flag can be used in conjunction with --enable-exportDNSAuth. It is only recognized if --plugin-name is set to the DPI plugin, application labeling is enabled, and --max-payload is set.

DPI DATA EXPORT

DPI Templates & Information Elements by Protocol

yaf's output consists of an IPFIX message stream. yaf uses a variety of templates for IPFIX data records. As of yaf 2.0, yaf uses a subTemplateMultiList to export optional information elements, such as Deep Packet Inspection fields, relating to the flow.

This section describes the templates that may appear in the subTemplateMultiList depending on the application label of the flow. The heading for a section includes the application label and the name of the template if yaf is invoked with the --metadata-export option.

For more information on yaf information elements see yaf(1) and the CERT IPFIX Registry. For more information on IPFIX Structured lists, see the Internet Draft, Export of Structured Data in IPFIX, <RFC 6313>.

Many of the elements are exported as a basicList, and the elements are marked with a "✳". An IPFIX basicList (IE 291) represents a list of zero or more instances of any Information Element.

FTP (21) - yaf_ftp

File Transfer Protocol (FTP) Deep Packet Inspection is based on RFC 959. The following information elements are exported as a template in the subTemplateMultiList as basicLists (indicated by ✳) of variable length string elements in the order they are listed in the yafDPIRules.conf file. By default, they will be in the following order:

ftpReturn ✳ CERT (PEN 6871) IE 131, string, varies

FTP Commands or Replies.

ftpUser ✳ CERT (PEN 6871) IE 132, string, varies

FTP User Command Argument. This command is normally the first command transmitted by the user.

ftpPass ✳ CERT (PEN 6871) IE 133, string, varies

FTP Password Command Argument. This command must be preceded by the user name command, and is usually required to complete authentication.

ftpType ✳ CERT (PEN 6871) IE 134, string, varies

FTP Data Representation Type.

ftpRespCode ✳ CERT (PEN 6871) IE 135, string, varies

FTP Reply. This consists of a three digit number followed by some text.

HTTP (80) - yaf_http

HTTP Deep Packet Inspection is based on RFC 2616. The following information elements are exported as a template in the subTemplateMultiList as basicLists (indicated by ✳) of variable length string elements in the order they are listed in the yafDPIRules.conf file. Some elements are not enabled by default. The template will always contain at least 20 information elements even if less elements are enabled in the configuration file. By default, the following 20 information elements are exported in the following order:

httpServerString ✳ CERT (PEN 6871) IE 110, string, varies

HTTP Server Response-header field. Contains information about the software used to handle the HTTP Request.

httpUserAgent ✳ CERT (PEN 6871) IE 111, string, varies

HTTP User-Agent Request-header field. Contains information about the user agent originating the request.

httpGet ✳ CERT (PEN 6871) IE 112, string, varies

HTTP Method Command. Retrieves information identified by the following Request-URI.

httpConnection ✳ CERT (PEN 6871) IE 113, string, varies

HTTP Connection header fields. Contains options that are desired for a particular connection.

httpReferer ✳ CERT (PEN 6871) IE 115, string, varies

HTTP Referer request-header field. Address (URI) of the resource which the Request-URI was obtained.

httpLocation ✳ CERT (PEN 6871) IE 116, string, varies

HTTP Location response-header field. Used to redirect the recipient to a location to complete a request or identify a new resource.

httpHost ✳ CERT (PEN 6871) IE 117, string, varies

HTTP Host Request-header. The Internet host and port number of the resource being requested.

httpContentLength ✳ CERT (PEN 6871) IE 118, string, varies

HTTP Content-Length header. Indicates the size of the entity-body.

httpAge ✳ CERT (PEN 6871) IE 119, string, varies

HTTP Age response-header. Argument is the sender's estimate of the time elapsed since the response.

httpResponse ✳ CERT (PEN 6871) IE 123, string, varies

HTTP Response Status Code. Usually a three-digit number followed by text.

httpAcceptLanguage ✳ CERT (PEN 6871) IE 121, string, varies

HTTP Accept-Language Request-Header field. Restricts the set of natural languages that preferred.

httpAccept ✳ CERT (PEN 6871) IE 120, string, varies

HTTP Accept request-header field. Used to specify certain media types that are acceptable for the response.

httpContentType ✳ CERT (PEN 6871) IE 122, string, varies

HTTP Content Type entity-header field. Indicates the media type of the entity-body.

httpVersion ✳ CERT (PEN 6871) IE 114, string, varies

HTTP Version Number.

httpCookie ✳ CERT (PEN 6871) IE 220, string, varies

HTTP Cookie Header Field.

httpSetCookie ✳ CERT (PEN 6871) IE 221, string, varies

HTTP Set Cookie Header Field.

httpAuthorization ✳ CERT (PEN 6871) IE 252, string, varies

HTTP Authorization Header Field.

httpVia ✳ CERT (PEN 6871) IE 253, string, varies

HTTP Via Header Field.

httpX-Forwarded-For ✳ CERT (PEN 6871) IE 254, string, varies

HTTP X-Forwarded-For Header Field.

httpRefresh ✳ CERT (PEN 6871) IE 256, string, varies

HTTP Refresh Header Field.

Optional HTTP Elements

The following information elements are defined but not enabled by default. To enable any of the following fields, uncomment the line in the yafDPIRules.conf file.

httpExpires ✳ CERT (PEN 6871) IE 255, string, varies

HTTP Expires Header Field.

httpIMEI ✳ CERT (PEN 6871) IE 257, string, varies

HTTP International Mobile Station Equipment Identity ID.

httpIMSI ✳ CERT (PEN 6871) IE 258, string, varies

HTTP International Mobile Subscriber Identity

httpMSISDN ✳ CERT (PEN 6871) IE 259, string, varies

HTTP MSISDN number, a telephone number for the SIM card in a mobile/cellular phone.

httpSubscriber ✳ CERT (PEN 6871) IE 260, string, varies

HTTP Mobile Subscriber Information

httpAcceptCharset ✳ CERT (PEN 6871) IE 261, string, varies

HTTP Accept Charset Header Field.

httpAcceptEncoding ✳ CERT (PEN 6871) IE 262, string, varies

HTTP Accept Encoding Header Field.

httpAllow ✳ CERT (PEN 6871) IE 263, string, varies

HTTP Allow Header Field.

httpDate ✳ CERT (PEN 6871) IE 264, string, varies

HTTP Date Header Field.

httpExpect ✳ CERT (PEN 6871) IE 265, string, varies

HTTP Expect Header Field.

httpFrom ✳ CERT (PEN 6871) IE 266, string, varies

HTTP From Header Field.

httpProxyAuthentication ✳ CERT (PEN 6871) IE 267, string, varies

HTTP Proxy Authentication Field.

httpUpgrade ✳ CERT (PEN 6871) IE 268, string, varies

HTTP Upgrade Header Field.

httpWarning ✳ CERT (PEN 6871) IE 269, string, varies

HTTP Warning Header Field.

httpDNT ✳ CERT (PEN 6871) IE 270, string, varies

HTTP DNT Header Field.

httpX-Forwarded-Proto ✳ CERT (PEN 6871) IE 271, string, varies

HTTP X-Forwarded-Proto Header Field.

httpX-Forwarded-Host ✳ CERT (PEN 6871) IE 272, string, varies

HTTP X-Forwarded-Host Header Field.

httpX-Forwarded-Server ✳ CERT (PEN 6871) IE 273, string, varies

HTTP X-Forwarded-Server Header Field.

httpX-DeviceID ✳ CERT (PEN 6871) IE 274, string, varies

HTTP X-Device ID Header Field.

httpX-Profile ✳ CERT (PEN 6871) IE 275, string, varies

HTTP X-Profile Header Field.

httpLastModified ✳ CERT (PEN 6871) IE 276, string, varies

HTTP Last Modified Header Field.

httpContentEncoding ✳ CERT (PEN 6871) IE 277, string, varies

HTTP Content Encoding Header Field.

httpContentLanguage ✳ CERT (PEN 6871) IE 278, string, varies

HTTP Content Language Header Field.

httpContentLocation ✳ CERT (PEN 6871) IE 279, string, varies

HTTP Content Location Header Field.

httpX-UA-Compatible ✳ CERT (PEN 6871) IE 280, string, varies

HTTP X-UA-Compatible Header Field.

IMAP (143) - yaf_imap

IMAP Deep Packet Inspection is based on RFC 3501. The following information elements are exported as a template in the subTemplateMultiList as basicLists (indicated by ✳) of variable length string elements.

imapCapability ✳ CERT (PEN 6871) IE 136, string, varies

IMAP Capability Command and Response. Captures the listing of capabilities that the server supports.

imapLogin ✳ CERT (PEN 6871) IE 137, string, varies

IMAP Login Command. Arguments are user name and password.

imapStartTLS ✳ CERT (PEN 6871) IE 138, string, varies

IMAP STARTTLS Command. Captures this command only as no arguments or responses are related.

imapAuthenticate ✳ CERT (PEN 6871) IE 139, string, varies

IMAP Authenticate Command. Captures the authentication mechanism name of the server following this command.

imapCommand ✳ CERT (PEN 6871) IE 140, string, varies

Captures a variety of IMAP Commands and their arguments.

imapExists ✳ CERT (PEN 6871) IE 141, string, varies

IMAP Exists Response. Reports the number of messages in the mailbox.

imapRecent ✳ CERT (PEN 6871) IE 142, string, varies

IMAP Recent Response. Reports the number of message with the Recent flag set.

subTemplateList IE 292, subTemplateList, varies

The TLS/SSL connection parameters and certificates if the client and server negotiated a TLS session after an initial clear-text connection. The contents of this subTemplateList is described in "TLS/SSL (443) - yaf_ssl". This support was added in YAF-2.17.0.

RTSP (554) - yaf_rtsp

Real Time Streaming Protocol (RTSP) Deep Packet Inspection is based on RFC 2326. The following information elements are exported as a template in the subTemplateMultiList as basicLists (indicated by ✳) of variable length string elements in the order they are listed in the yafDPIRules.conf file. By default, the following information elements are exported in order:

rtspURL ✳ CERT (PEN 6871) IE 143, string, varies

RTSP URL. Captures the address of the network resources requested.

rtspVersion ✳ CERT (PEN 6871) IE 144, string, varies

RTSP Version Number.

rtspReturnCode ✳ CERT (PEN 6871) IE 145, string, varies

RTSP Status-Line. Captures the RTSP Protocol version, numeric status code, and the textual phrase associated with the numeric code.

rtspContentLength ✳ CERT (PEN 6871) IE 146, string, varies

RTSP Content-Length Header Field. Contains the length of the content of the method.

rtspCommand ✳ CERT (PEN 6871) IE 147, string, varies

RTSP Command. Captures the method to be performed and the Request-URI associated with the method.

rtspContentType ✳ CERT (PEN 6871) IE 148, string, varies

RTSP Content Type.

rtspTransport ✳ CERT (PEN 6871) IE 149, string, varies

RTSP Transport request header field. Captures the transport protocol used and the parameters that follow.

rtspCSeq ✳ CERT (PEN 6871) IE 150, string, varies

RTSP CSeq field. Contains the sequence number for an RTSP request-response pair.

rtspLocation ✳ CERT (PEN 6871) IE 151, string, varies

RTSP Location header field.

rtspPacketsReceived ✳ CERT (PEN 6871) IE 152, string, varies

RTSP Packets Received header field.

rtspUserAgent ✳ CERT (PEN 6871) IE 153, string, varies

RTSP User Agent field. Contains information about the user agent originating the request.

rtspJitter ✳ CERT (PEN 6871) IE 154, string, varies

RTSP Jitter Value.

SIP (5060) - yaf_sip

Session Initiation Protocol (SIP) Deep Packet Inspection is based on RFC 3261. The following information elements are exported as a template in the subTemplateMultiList as basicLists (indicated by ✳) of variable length string elements in the order listed in yafDPIRules.conf. By default, the following information elements are exported in order:

sipInvite ✳ CERT (PEN 6871) IE 155, string, varies

SIP Invite Method. Contains the SIP address and SIP Version Number.

sipCommand ✳ CERT (PEN 6871) IE 156, string, varies

SIP Command. Contains a SIP Method, SIP address, and SIP Version Number.

sipVia ✳ CERT (PEN 6871) IE 157, string, varies

SIP Via contains the SIP Version Number and the address the sender is expecting to receive responses.

sipMaxForwards ✳ CERT (PEN 6871) IE 158, string, varies

SIP Max Forwards contains the limit of number of hops a request can make on the way to its destination.

sipAddress ✳ CERT (PEN 6871) IE 159, string, varies

SIP Address contains the argument of the To, From, or Contact Header Fields.

sipContentLength ✳ CERT (PEN 6871) IE 160, string, varies

SIP Content Length header field. Contains the byte count of the message byte.

sipUserAgent ✳ CERT (PEN 6871) IE 161, string, varies

SIP User Agent Header Field. Contains information about the User Agent Client originating the request.

SMTP (25) - yaf_smtp

Simple Mail Transfer Protocol (SMTP) Deep Packet Inspection is based on RFC 2821. The templates used for SMTP DPI changed in YAF 2.12.0.

An SMTP conversation is exported as a nested set of templates in the subTemplateMultiList. The outer template (yaf_smtp) includes the following elements.

smtpHello CERT (PEN 6871) IE 162, string, varies

SMTP Hello or Extend Hello command. Captures the command and the domain name of the SMTP client.

smtpEnhanced CERT (PEN 6871) IE 170, string, varies

Enhanced SMTP. Contains the ESMTP command with the following argument.

smtpMessageSize, CERT (PEN 6871) IE 330, unsigned32, 4 octets

SMTP Message Size

smtpStartTLS, CERT (PEN 6871) IE 326, unsigned8, 1 octet

START TLS. Element indicating whether or not the SMTP session sent the START TLS command.

smtpResponseList, CERT (PEN 6871) IE 331, basicList, varies

A basicList of SMTP Replies, represented by smtpResponse (IE CERT/169, variable length, string) elements. Each smtpResponse contains of a three digit number followed by text.

smtpMessageList CERT (PEN 6871) IE 336, subTemplateList, varies

A subTemplateList containing zero (but usually at least one) or more records described by the yaf_smtp_message template described below. Each record represents a single email message sent during the SMTP conversation.

subTemplateList IE 292, subTemplateList, varies

The TLS/SSL connection parameters and certificates if the client and server negotiated a TLS session after an initial clear-text connection. The contents of this subTemplateList are described in "TLS/SSL (443) - yaf_ssl". This support was added in YAF-2.17.0.

STMP Message - yaf_smtp_message

This template is used by the smtpMessageList element, and each record describes a single email message sent during an SMTP session. It contains the following elements.

smtpSubject CERT (PEN 6871) IE 166, string, varies

The subject of the message.

smtpToList CERT (PEN 6871) IE 332, basicList, varies

The SMTP Recipient (RCPT) Command. A basicList containing smtpTo (IE CERT/164, variable length, string) elements. Each smtpTo captures the command and the forward-path of the recipient of the mail data.

smtpFromList CERT (PEN 6871) IE 333, basicList, varies

SMTP Mail Command. A basicList containing smtpFrom (IE CERT/163, variable length, string) elements. Each smtpFrom contains the reverse-path of the sender mailbox.

smtpFilenameList CERT (PEN 6871) IE 334, basicList, varies

SMTP Filename. A basicList containing smtpFilename (IE CERT/167, variable length, string) elements. Each smtpFilename contains the name of a file attached to the mail message, if any.

smtpURLList CERT (PEN 6871) IE 335, basicList, varies

SMTP URL. A basicList containing smtpURL (IE CERT/329, variable length, string) elements. Each smtpURL contains a URL captured in the SMTP message body, if any.

smtpHeaderList CERT (PEN 6871) IE 337, subTemplateList, varies

A subTemplateList containing zero or more records described by the yaf_smtp_header template described below. Each record represents a single header (SMTP field name and body) in the email DATA.

STMP Headers - yaf_smtp_header

This template is used by the smtpHeaderList element, and each record describes a single email header as a key-value pair.

smtpKey CERT (PEN 6871) IE 327, string, varies

SMTP Header key string. The name of the header (for example, "To", "From").

smtpValue CERT (PEN 6871) IE 328, string, varies

SMTP Header value string. The value of that header.

SSH (22) - yaf_ssh

Secure Shell Transport Layer Protocol (SSH) DPI is based on RFC 4253. The format of this record changed in YAF-2.15. Previous releases of YAF contained a basicList of sshVersion elements, holding any captured version strings.

sshVersion CERT (PEN 6871) IE 171, string, varies

The version string given by the client.

sshServerVersion CERT (PEN 6871) IE 472, string, varies

The version string from an SSH server.

sshKeyExchangeAlgorithm CERT (PEN 6871) IE 476, string, varies

The negotiated key exchange algorithm used for an SSH session.

sshHostKeyAlgorithm CERT (PEN 6871) IE 477, string, varies

The negotiated host key algorithm used for an SSH session.

sshServerHostKey CERT (PEN 6871) IE 478, octetArray, 16 octets

The MD5 hash of the public key of the SSH server.

sshCipher CERT (PEN 6871) IE 473, string, varies

The negotiated symmetric encryption algorithm used for an SSH session.

sshMacAlgorithm CERT (PEN 6871) IE 474, string, varies

The negotiated MAC algorithm used for an SSH session.

sshCompressionMethod CERT (PEN 6871) IE 475, string, varies

The negotiated compression algorithm used for an SSH session.

sshHassh CERT (PEN 6871) IE 468, octetArray, 16 octets

The client HASSH MD5 hash of the sshHasshAlgorithms (CERT/469) fingerprint for an SSH client.

sshServerHassh CERT (PEN 6871) IE 470, octetArray, 16 octets

The server HASSH MD5 hash (hasshServer) of the sshServerHasshAlgorithms (CERT/471) fingerprint for an SSH server.

sshHasshAlgorithms CERT (PEN 6871) IE 469, string, varies

The SSH client hasshAlgorithms: the concatenated name-lists of the client-to-server algorithms delimited by a semicolon. Element sshHassh (CERT/468) holds the MD5 of this.

sshServerHasshAlgorithms CERT (PEN 6871) IE 471, string, varies

The SSH server hasshServerAlgorithms: the concatenated name-lists of the server-to-client algorithms delimited by a semicolon. Element sshServerHassh (CERT/470) holds the MD5 of this.

DNS (53), MDNS (5353), LLMNR (5355) - yaf_dns

Domain Name System (DNS) Deep Packet Inspection is based on RFC 1035. DNS Information is exported in the yaf subTemplateMultiList as a subTemplateList of yaf_dns_qr records, one for each resource record in the payload.

This template is also used by the MDNS and LLMNR protocols due to their similarity to DNS.

Each yaf_dns_qr record contains a type, TTL, name, and a sub-record that is specific to the type of resource record (A Record vs NS Record, for example).

DNSSEC information is not exported by default. To export DNSSEC information, run yaf with --plugin-opts=DNSSEC.

subTemplateList IE 292, subTemplateList, varies

A list of resource records, yaf_dns_qr, one for each record captured in the payload.

DNS Resource Record - yaf_dns_qr

Each resource record entry contains generic resource record information such as type, TTL, and name. There is also one element (a subTemplateList) that contains resource record specific information based on the type of resource record (A Record vs NS Record, for example). Due to alignment issues, the resource record specific element is the first element in the template and is therefore the first item listed below. The following information elements exist in the resource record template:

subTemplateList IE 292, subTemplateList, varies

An IPFIX subTemplateList. This list contains a "DNS Resource Record Type" Template. The type of this template depends on the type (dnsQRType) of the resource record. For example, if dnsQRType is 1, the yaf_dns_a template is used. The DNS Resource Record Templates are described in the following sections.

dnsQName CERT (PEN 6871) IE 179, string, varies

A DNS Query or Response Name. This field corresponds with the QNAME field in the DNS Question Section or the NAME field in the DNS Resource Record Section.

dnsTTL CERT (PEN 6871) IE 199, unsigned32, 4 octets

DNS Time To Live. This is an unsigned integer that specifies the time interval, in seconds, that the resource record may be cached for. This contains a value of zero for DNS Queries.

dnsQRType CERT (PEN 6871) IE 175, unsigned16, 2 octets

DNS Query/Response Type. This corresponds with the QTYPE field in the DNS Question Section or the TYPE field in the DNS Resource Record Section. This field determines the type of subTemplateList found in this record.

dnsQueryResponse CERT (PEN 6871) IE 174, unsigned8, 1 octet

DNS Query/Response header field. This corresponds with the DNS header one bit field, QR. If the message is a query (0), or a response (1).

dnsAuthoritative CERT (PEN 6871) IE 176, unsigned8, 1 octet

DNS Authoritative header field. This corresponds with the DNS header one bit field, AA. This bit is only valid in responses (when dnsQueryResponse is 1), and specifies that the responding name server is an authority for the domain name in the question section.

dnsNXDomain CERT (PEN 6871) IE 177, unsigned8, 1 octet

DNS NXDomain or Response Code (RCODE). This corresponds with the DNS RCODE header field. This field is set to 3 for a Name Error, 2 for a Server Failure, 1 for a Format Error, and 0 for No Error. See http://www.iana.org/assignments/dns-parameters for other valid values.

dnsRRSection CERT (PEN 6871) IE 178, unsigned8, 1 octet

DNS Resource Record Section Field. This field is set to 0 if the information is from the Question Section, 1 for the Answer Section, 2 for the Name Server Section, and 3 for the Additional Section.

dnsID CERT (PEN 6871) IE 226, unsigned16, 2 octets

DNS Transaction ID. This identifier is used by the requester to match up replies to outstanding queries.

The following sections describe the templates used by the subTemplateList element above to represent the DNS Resource Record Types.

DNS A Resource Record - yaf_dns_a

This entry exists if dnsQRType is 1 and the A Record contains an IP address.

sourceIPv4Address IE 8, ipv4Address, 4 octets

IPv4 address of the host.

DNS NS Resource Record - yaf_dns_ns

This entry exists if dnsQRType is 2 and the NS Record contains an NSDNAME.

dnsNSDName CERT (PEN 6871) IE 183, string, varies

An authoritative name server domain-name.

DNS CNAME Resource Record - yaf_dns_cname

This entry exists if dnsQRType is 5 and the CNAME Record contains an CNAME.

dnsCName CERT (PEN 6871) IE 180, string, varies

A domain-name which specifies the canonical or primary name for the owner.

DNS SOA Resource Record - yaf_dns_soa

This entry exists if dnsQRType is 6 and the SOA Record contains at least 1 of the following elements:

dnsSOAMName CERT (PEN 6871) IE 214, string, varies

Corresponds to DNS SOA MNAME Field.

dnsSOARName CERT (PEN 6871) IE 215, string, varies

Corresponds to DNS SOA RNAME Field.

dnsSOASerial CERT (PEN 6871) IE 209, unsigned32, 4 octets

Corresponds to DNS SOA SERIAL Field.

dnsSOARefresh CERT (PEN 6871) IE 210, unsigned32, 4 octets

Corresponds to DNS SOA REFRESH Field.

dnsSOARetry CERT (PEN 6871) IE 211, unsigned32, 4 octets

Corresponds to DNS SOA RETRY Field.

dnsSOAExpire CERT (PEN 6871) IE 212, unsigned32, 4 octets

Corresponds to DNS SOA EXPIRE Field.

dnsSOAMinimum CERT (PEN 6871) IE 213, unsigned32, 4 octets

Corresponds to DNS SOA MINIMUM Field.

DNS PTR Resource Record - yaf_dns_ptr

This entry exists if dnsQRType is set to 12 and PTRDNAME exists.

dnsPTRDName CERT (PEN 6871) IE 184, string, varies

Corresponds to DNS PTR PTRDNAME Field.

DNS MX Resource Record - yaf_dns_mx

This entry exists if dnsQRType is set to 15 and MXExchange exists.

dnsMXExchange CERT (PEN 6871) IE 182, string, varies

Corresponds to the DNS MX Exchange field.

dnsMXPreference CERT (PEN 6871) IE 181, unsigned16, 2 octets

Corresponds to the DNS MX Preference field.

DNS TXT Resource Record - yaf_dns_txt

This entry exists if dnsQRType is set to 16 and TXT-DATA exists.

dnsTXTData CERT (PEN 6871) IE 208, string, varies

Corresponds to DNS TXT TXT-DATA field.

DNS AAAA Record - yaf_dns_aaaa

This entry exists if dnsQRType is set to 28 and the IPv6 Address exists. See RFC 3596.

sourceIPv6Address IE 27, ipv6Address, 16 octets

An IPv6 Address found in the data portion of an AAAA Resource Record.

DNS SRV Record - yaf_dns_srv

This entry exists if dnsQRType is set to 33 and at least 1 of the following elements exist. See RFC 2782.

dnsSRVTarget CERT (PEN 6871) IE 219, string, varies

Corresponds to the Target Field in the DNS SRV Resource Record.

dnsSRVPriority CERT (PEN 6871) IE 216, unsigned16, 2 octets

Corresponds to the Priority Field in the DNS SRV Resource Record.

dnsSRVWeight CERT (PEN 6871) IE 217, unsigned16, 2 octets

Corresponds to the Weight Field in the DNS SRV Resource Record.

dnsSRVPort CERT (PEN 6871) IE 218, unsigned16, 2 octets

Corresponds to the Port Field in the DNS SRV Resource Record.

DNSSEC DNSKEY Record - yaf_dns_key

This entry exists if dnsQRType is set to 48, yaf was enabled to export DNSSEC information, and at least 1 of the following elements exist. See RFC 4034.

dnsPublicKey CERT (PEN 6871) IE 232, octeArray, varies

DNSSEC uses public key cryptography to sign and authenticate DNS resource record sets. This field holds the public key. The format depends on the algorithm of the key.

dnsFlags CERT (PEN 6871) IE 241, unsigned16, 2 octets

The flags field in the DNSKey Resource Record. Certain bits determine if the key is a zone key or should be used for a secure entry point.

protocolIdentifier IE 4, unsigned8, 1 octet

The protocol field in the DNSKEY RR. This should be 3 or treated as invalid.

dnsAlgorithm CERT (PEN 6871) IE 227, unsigned8, 1 octet

Identifies the public key's cryptographic algorithm, which determines it's format.

DNSSEC DS Record - yaf_dns_ds

This entry exists if dnsQRType is set to 43, yaf was enabled to export DNSSEC information, and at least 1 of the following elements exist. See RFC 4034.

dnsDigest CERT (PEN 6871) IE 231, octetArray, varies

The digest of the DNSKEY RR.

dnsKeyTag CERT (PEN 6871) IE 228, unsigned16, 2 octets

The Key Tag field in the DS RR.

dnsAlgorithm CERT (PEN 6871) IE 227, unsigned8, 1 octet

The Algorithm number of the DNSKEY RR referred to by the DS Record.

dnsDigestType CERT (PEN 6871) IE 238, unsigned8, 1 octet

The Digest Type field which identifies the algorithm used to construct the digest.

DNSSEC NSEC Record - yaf_dns_nsec

This entry exists if dnsQRType is set to 47, yaf was enabled to export DNSSEC information, and the following field exists. See RFC 4034.

dnsHashData CERT (PEN 6871) IE 234, octetArray, varies

This item contains the Next Domain Name in the NSEC RR.

DNSSEC NSEC3 or NSEC3PARAM Record - yaf_dns_nsec3

This entry exists if dnsQRType is set to 50 or 51, yaf was enabled to export DNSSEC information, and at least one of the following fields exists. See RFC 5155.

dnsSalt CERT (PEN 6871) IE 233, octetArray, varies

The Salt Field in the DNSSEC NSEC3 or NSEC3PARAM RR.

dnsHashData CERT (PEN 6871) IE 234, octetArray, varies

The Next Hashed Owner Name in the DNSSEC NSEC3 RR. This is empty for NSEC3PARAM records.

dnsIterations CERT (PEN 6871) IE 235, unsigned16, 2 octets

The Iterations field in the DNSSEC NSEC3 or NSEC3PARAM RR.

dnsAlgorithm CERT (PEN 6871) IE 227, unsigned8, 1 octet

The Hash Algorithm field in the DNSSEC NSEC3 or NSEC3PARAM RR. Values are described in RFC 5155.

DNSSEC RRSIG Record - yaf_dns_sig

This entry exists if dnsQRType is set to 46, yaf was enabled to export DNSSEC information, and at least one of the following fields exists. See RFC 4034.

dnsSigner CERT (PEN 6871) IE 229, string, varies

The Signer's Name field in the RRSIG RR.

dnsSignature CERT (PEN 6871) IE 230, octetArray, varies

The Signature field in the RRSIG RR. Contains the cryptographic signature that covers the dnsQName field.

dnsSignatureInception CERT (PEN 6871) IE 237, unsigned32, 4 octets

The Signature Inception field in a RRSIG RR. The Expiration and Inception fields specify a validity period for the signature.

dnsSignatureExpiration CERT (PEN 6871) IE 236, unsigned32, 4 octets

The Signature Expiration field in a RRSIG RR. The Expiration and Inception fields specify a validity period for the signature.

dnsTTL CERT (PEN 6871) IE 199, unsigned32, 4 octets

The Original TTL Field in the RRSIG RR.

dnsKeyTag CERT (PEN 6871) IE 228, unsigned16, 2 octets

The Key Tag field in a RRSIG RR.

dnsTypeCovered CERT (PEN 6871) IE 240, unsigned16, 2 octets

The Type Covered field in a RRSIG RR.

dnsAlgorithm CERT (PEN 6871) IE 227, unsigned8, 1 octet

The Algorithm Number field in a RRSIG RR. Identifies the algorithm used to create the signature.

dnsLabels CERT (PEN 6871) IE 239, unsigned8, 1 octet

The Labels field in a RRSIG RR. Specifies the number of labels in the original RRSIG resource record owner name.

TLS/SSL (443) - yaf_ssl

Transport Layer Security (TLS)/Secure Socket Layer (SSL) Deep Packet Inspection can identify and export handshake and certificate information if it is contained in the payload of the flow. The elements in the top-level record describe the handshake, such as ciper lists, client version, server name, and JA3 and JA4 hashes. The subTemplateList element contains a record for each certificate identified by yaf. That template is yaf_ssl_cert described below.

sslCipher ✳ CERT (PEN 6871) IE 185, unsigned32, 4 octets

sslCipher is exported by yaf as a basicList that contains the list of CipherSuites suggested by the client in the ClientHello Message.

sslServerCipher CERT (PEN 6871) IE 187, unsigned32, 4 octets

sslServerCipher is the CipherSuite chosen by the server in the ServerHello message.

sslClientVersion CERT (PEN 6871) IE 186, unsigned8, 1 octet

sslClientVersion reflects the major version of the SSL protocol the client used in its initial message: 2 if the client used an SSLv2-style Client Hello or 3 if it used a TLS/SSLv3-style Client Hello.

sslCompressionMethod CERT (PEN 6871) IE 188, unsigned8, 1 octet

sslCompressionMethod is the compression method chosen by the server in the ServerHello message.

sslRecordVersion CERT (PEN 6871) IE 288, unsigned16, 2 octets

sslRecordVersion is the version of TLS or SSL advertised in the ClientHello or ServerHello.

subTemplateList IE 292, subTemplateList, varies

This contains zero or more records, represented by the yaf_ssl_cert template, that describe the X.509 Certificates yaf was able to parse in the captured payload. Note that most certificate chains are about 3000 bytes. In order to capture the entire certificate chain, --max-payload should be set appropriately.

sslServerName CERT (PEN 6871) IE 294, string, varies

The server name from the SSL/TLS Client Hello. This is typically the name of the server that the client is connecting to.

sslClientJA3 CERT (PEN 6871) IE 463, 16 octets

The JA3 MD5 hash of the sslClientJA3Fingerprint (CERT/464) calculated on the client-side TLS/SSL fingerprint string. Added in YAF-2.15.0.

sslServerJA3S CERT (PEN 6871) IE 465, 16 octets

The JA3S MD5 hash of the sslServerJA3SFingerprint (CERT/466) calculated on the server-side TLS/SSL fingerprint string. Added in YAF-2.15.0.

sslClientJA3Fingerprint CERT (PEN 6871) IE 464, string, varies

The JA3 fingerprint string enumerated from the TLS/SSL ClientHello packet. Element sslClientJA3 (CERT/463) holds the MD5 of this. Added in YAF-2.15.0.

sslServerJA3SFingerprint CERT (PEN 6871) IE 466, string, varies

The JA3S fingerprint string enumerated from the TLS/SSL ServerHello packet. Element sslServerJA3S (CERT/465) holds the MD5 of this. Added in YAF-2.15.0.

ja4 CERT (PEN 6871) IE 480, string, varies

The JA4 TLS client fingerprint. Added in YAF-2.20.0.

TLS/SSL Certificate - yaf_ssl_cert

This template describes a certificate, and there is one record for each certificate found in the captured payload. Each record contains basic information such as the certificate's serial number and validity timestamps.

The record also holds three subTemplateLists: the first describes the Issuer, the second describes the Subject, and the third holds Extension fields. Each of these subTemplateLists use the yaf_ssl_subcert template described below.

subTemplateList IE 292, subTemplateList, varies

The Issuer field identifies the entity that has signed and issued the certificate, and it is encoded as a sequence of Relative Distinguished Names, which are basically type, value pairs. This list contains zero or more occurrences of yaf_ssl_subcert records containing RelativeDistinguishedName id-value pairs captured from the X.509 Certificate Issuer RDNSequence. There is one entry in the list for each pair. See below for a common list of attributes.

subTemplateList IE 292, subTemplateList, varies

The Subject field identifies the entity associated with the public key stored in the subject public key field, and it is encoded as a sequence of Relative Distinguished Names, which are basically type, value pairs. This list contains zero or more occurrences of yaf_ssl_subcert records containing RelativeDistinguishedName id-value pairs captured from the X.509 Certificate Subject RDNSequence. There is one entry in the list for each pair. See below for a common list of attributes.

subTemplateList IE 292, subTemplateList, varies

Extensions are defined for X.509 v3 certificates and provide methods for associating additional attributes with the Issuer and Subject information. Each extension includes an object identifier and a value encoded in an ASN.1 structure. This list contains zero or more occurrences of yaf_ssl_subcert records holding the object ids and ASN.1 values. For extensios, yaf does not always parse the ASN.1 values, and sslObjectValue may contain the entire ASN.1 structure in the value field. However, it does not contain the entire Extension ID. Object IDs that yaf captures for extensions are documented below.

sslCertSignature CERT (PEN 6871) IE 190, octetArray, varies

The signature contained in a SSL certificate. This is typically the hashing algorithm identifier.

sslCertSerialNumber CERT (PEN 6871) IE 244, octetArray, varies

The Serial Number from the X.509 certificate.

sslCertValidityNotBefore CERT (PEN 6871) IE 247, string, varies

The notBefore field in the Validity Sequence of the X.509 Certificate.

sslCertValidityNotAfter CERT (PEN 6871) IE 248, string, varies

The notAfter field in the Validity Sequence of the X.509 Certificate.

sslPublicKeyAlgorithm CERT (PEN 6871) IE 249, octetArray, varies

The algorithm, encoded in ASN.1, in the SubjectPublicKeyInfo Sequence of the X.509 Certificate.

sslPublicKeyLength CERT (PEN 6871) IE 250, unsigned16, 2 octets

The length of the public key in the X.509 Certificate.

sslCertVersion CERT (PEN 6871) IE 189, unsigned8, 1 octet

The Certificate Version. This is the value contained in the certificate v1(0), v2(1), v3(2).

sslCertificateHash CERT (PEN 6871) IE 295, octetArray, varies, optional

The hash of the X.509 certificate. This field is off by default. To enable it, modify the yafDPIRules.conf file to set cert_hash_enabled to 1.

Issuer, Subject, and Extension Templates - yaf_ssl_subcert

Each subTemplateList for the above Issuer, Subject, and Extension sequences contain zero or more records that contain two elements represented a key-value pair. See the sections after this one for a description of the values specific to the Issuer, Subject, and Extension subTemplateLists.

sslObjectValue CERT (PEN 6871) IE 246, octetArray, varies

The values associated with the below attribute types. Depending the source of the value, this field may contain a simple string or a DER-encoded value.

sslObjectType CERT (PEN 6871) IE 245, unsigned8, 1 octet

This field contains the final member id of an attribute type describing an Issuer, Subject, or Extension value. Common values are listed next.

Issuer and Subject sslObjectType values

For the subTemplateLists holding the values from Issuer and Subject RelativeDistinguishedName sequences, yaf only parses objects that are members of the id-at arc {joint-iso-ccitt(2) ds(5) 4}, pkcs-9 {iso(1) member-body (2) us(840) rsadsi(113459) pkcs(1) 9}, and LDAP dc 0.9.2342.19200300.100.1.25. The sslObjectType field does not contain the full object identifier; it only contains the member id. For example, for an issuer common name, sslObjectType contains 3. Below is a list of common objects in an X.509 RelativeDistinguishedName Sequence for X.509 Certificates:

Extension sslObjectType values

For the subTemplateList holding Extension attributes, yaf only parses extensions that are members of the id-ce arc. The last member of the id is stored in sslObjectType, and yaf only exports information about the following objects:

TLS/SSL Full Certificate Template - yaf_ssl_cert_full

yaf exports full X.509 certificates when the cert_export_enabled variable is present and set to 1 in the yafDPIRules.conf configuration file. When the feature is enabled and yaf captures a certificate, an additional record is added to the subTemplateMultiList, where the template contains a basicList of the variable length octetArray sslCertificate elements.

sslCertificate ✳, CERT (PEN 6871) IE 296, octetArray, varies

IRC (194) - yaf_irc

Internet Relay Chat (IRC) Deep Packet Inspection is based on RFC 2812. The following information element is exported as a template in the subTemplateMultiList as a basicList (indicated by ✳) of variable length string elements:

ircTextMessage ✳ CERT (PEN 6871) IE 125, string, varies

IRC Chat or Join Message. This field contains any IRC Command and the following arguments.

NNTP (119) - yaf_nntp

Network News Transfer Protocol (NNTP) Deep Packet Inspection is based on RFC 977. The following information elements are exported as a template containing two basicLists (indicated by ✳) of variable length string elements in the subTemplateMultiList in the following order:

nntpResponse ✳ CERT (PEN 6871) IE 172, string, varies

NNTP Reply. This consists of a three digit status code and text message.

nntpCommand ✳ CERT (PEN 6871) IE 173, string, varies

NNTP Command. Contains an NNTP Command and following argument(s).

POP3 (110) - yaf_pop3

Post Office Protocol 3 (POP3) Deep Packet Inspection is based on RFC 1939. The following information element is exported as a template in the subTemplateMultiList as a basicList (indicated by ✳) of variable length string elements:

pop3TextMessage ✳ CERT (PEN 6871) IE 124, string, varies

POP3 Command and Replies. Contains any command or reply message found in POP3 payload data.

subTemplateList IE 292, subTemplateList, varies

The TLS/SSL connection parameters and certificates if the client and server negotiated a TLS session after an initial clear-text connection. The contents of this subTemplateList is described in "TLS/SSL (443) - yaf_ssl". This support was added in YAF-2.17.0.

SLP (427) - yaf_slp

Service Location Protocol (SLP) Deep Packet Inspection is based on RFC 2608. The following information elements are exported as a template in the subTemplateMultiList in the following order:

slpString ✳ CERT (PEN 6871) IE 130, string, varies

Contains the text elements found in an SLP Service Request.

slpVersion CERT (PEN 6871) IE 128, unsigned8, 1 octet

SLP Version Number.

slpMessageType CERT (PEN 6871) IE 129, unsigned8, 1 octet

SLP Message Type. This value should be between 1 and 11 and describes the type of SLP message.

TFTP (69) - yaf_tftp

Trivial File Transfer Protocol (TFTP) Deep Packet Inspection is based on RFC 1350. The following information elements are exported as a template in the subTemplateMultiList in the following order:

tftpFilename CERT (PEN 6871) IE 126, string, varies

TFTP Name of File being transferred.

tftpMode CERT (PEN 6871) IE 127, string, varies

Contains the mode of transfer. (Currently supported: netascii, octet, mail).

MySQL (3306) - yaf_mysql

MySQL Deep Packet Inspection is based on information found at http://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol. MySQL packet capture information is exported in the yaf subTemplateMultiList as a subTemplateList of Command Code, Command Text pairs.

subTemplateList IE 292, subTemplateList, varies

An IPFIX SubTemplateList. This type represents a list of zero or more instances of the structured data type represented by the yaf_mysql_text template described next. Each record in this list describes one MySQL Command as a Code-Text pair.

mysqlUsername CERT (PEN 6871) IE 223, string, varies

MySQL Login User Name.

MySQL Command - yaf_mysql_txt

mysqlCommandText CERT (PEN 6871) IE 225, string, varies

MySQL Command Text. For example, this can be a SELECT, INSERT, DELETE statement. This is the first element in the MySQL subTemplateList.

mysqlCommandCode CERT (PEN 6871) IE 224, unsigned8, 1 octet

MySQL Command Code. This number should be between 0 and 28. This is the second element in the above MySQL subTemplateList.

DNP3 (20000) - yaf_dnp

Distributed Network Protocol (DNP3) Deep Packet Inspection is slightly different than other plugin-based protocols. yaf exports the following information if the yafDPIRules.conf contain regular expressions with the label ID 20000. The regular expressions are compared against the payload of DNP3 packets starting with the function code in the DNP Application Layer header. yaf loops through all the the available DNP3 packets contained in the captured payload. For each packet that matches one of the regular expressions listed in yafDPIRules.conf, yaf includes an entry in the exported subTemplateList. The subTemplateMultiList contains the following information elements in the following order:

subTemplateList IE 292, subTemplateList, varies

An IPFIX subTemplateList. This type represents a list of zero or more instances of the structured data type represented by the yaf_dnp_rec template described next. There is one record in the subTemplateList for each DNP3 packet that matches one of the DNP3 regular expressions found in the yafDPIRules.conf file.

DNP3 Record - yaf_dnp_rec

The template that describes a single packet captured within the DNP3 session.

dnp3SourceAddress CERT (PEN 6871) IE 281, unsigned16, 2 octets

The DNP3 Source Address found in the Data Link Layer of the DNP Header.

dnp3DestinationAddress CERT (PEN 6871) IE 282, unsigned16, 2 octets

The DNP3 Destination Address found in the Data Link Layer of the DNP Header.

dnp3Function CERT (PEN 6871) IE 283, unsigned8, 1 octet

The DNP3 Function Code found in the first byte of the Application Layer.

dnp3ObjectData CERT (PEN 6871) IE 284, octetArray, varies

The pattern captured from the DNP3 regular expression in yafDPIRules.conf

Modbus (502) - yaf_modbus

Modbus DPI is similar to DNP3 DPI. yaf exports any patterns matched by the regular expressions labeled with the ID 502 found in the yafDPIRules.conf file. The regular expressions are compared against the payload of all valid Modbus packets starting right after the MBAP header (offset 7), beginning with the Modbus function code. The information is exported as a basicList (indicated by ✳) of variable length octetArray fields. All regular expressions for Modbus should use the label 502. No user-defined information elements are accepted for Modbus.

modbusData ✳ CERT (PEN 6871) IE 285, octetArray, varies

Any patterns captured from the Modbus regular expressions in yafDPIRules.conf

Ethernet/IP (44818) - yaf_enip

Ethernet/IP DPI is similar to Modbus DPI. yaf exports any patterns matched by the regular expressions labeled with the ID 44818 in the yafDPIRules.conf file. The regular expressions are compared against the start of the payload of all valid Ethernet/IP packets (Command in the Encapsulation Header is the first byte). The matched patterns are exported as a basicList (indicated by ✳) of variable length octetArray fields. All regular expressions for Ethernet/IP should use the label 44818. No user-defined information elements are accepted for Ethernet/IP.

ethernetIPData ✳ CERT (PEN 6871) IE 286, octetArray, varies

The pattern captured from the Ethernet/IP regular expressions in yafDPIRules.conf.

RTP (5004) - yaf_rtp

yaf exports the Payload Type in the Real-time Transport Protocol (RTP) header if RTP DPI is enabled. The Payload Type indicates the format of the payload and how it should be interpreted by the receiving application. The following two elements are exported for each flow labeled as RTP. If the flow is a uniflow, the reverse element is exported but contains the value of 0.

rtpPayloadType CERT (PEN 6871) IE 287, unsigned8, 1 octet

The payload type in the RTP header of the first payload in the forward direction.

reverseRtpPayloadType CERT (PEN 6871) IE 16672, unsigned8, 1 octet

The payload type in the RTP header of the first payload in the reverse direction.

ENVIRONMENT

YAF_DPI_DEBUG_LIMITS

If true, causes dpacketplugin to log messages about the lengths and counts of fields as they are captured during deep packet inspection. This feature is optional and may not be enabled in your yaf installation. Since yaf-2.20.0.

NOTES

The ability to set the number of fields yaf captures was added in yaf-2.20. That version also included a change to the limit statements, though older files are still compatible.

The label statements for IMAP were removed In yaf-2.17.0 when its DPI was moved to a plug-in.

The label statements for SSH were removed In yaf-2.15.0 when its DPI was moved to a plug-in.

The label statements for SMTP were removed In yaf-2.12.0 when its DPI was moved to a plug-in.

AUTHORS

Emily Sarneso and the CERT Network Situational Awareness Group Engineering Team <netsa-help@cert.org>.

SEE ALSO

yaf(1), yafscii(1), applabel(1), super_mediator(1), pcre2pattern(1), PCRE2 Documentation at https://www.pcre.org/