at.jku.fim.rubanetra.protocol.activity.tls

Class TlsActivityHelper

java.lang.Object

at.jku.fim.rubanetra.protocol.activity.tls.TlsActivityHelper

public class TlsActivityHelper
extends Object

Contains various static methods as indicators of TLS/SSL protocol messages in TcpActivity payloads. These methods are basically unverified and marginally tested - therefore false positives/negatives may be possible.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	TlsActivityHelper.TlsContentType Enumeration of possible SSL/TLS content types including flag values.
static class	TlsActivityHelper.TlsRecord Enumeration of possible SSL/TLS records including byte offset into the payload and length values.

Constructor Summary

Constructors

Constructor and Description
TlsActivityHelper()

Method Summary

Modifier and Type	Method and Description
static boolean	isApplication(org.jnetpcap.protocol.tcpip.Tcp tcp) Returns true if the TCP payload contains an "Application" control message.
static boolean	isChangeCipherSpec(org.jnetpcap.protocol.tcpip.Tcp tcp) Returns true if the TCP payload contains a "ChangeCipherSpec" control message.
static boolean	isClientHello(org.jnetpcap.protocol.tcpip.Tcp tcp) Returns true if the TCP payload contains a "Client Hello" control message.
static boolean	isServerHello(org.jnetpcap.protocol.tcpip.Tcp tcp) Returns true if the TCP payload contains a "Server Hello" control message.
static boolean	isTlsHandshake(org.jnetpcap.protocol.tcpip.Tcp tcp) Returns true if the TCP payload contains a "Handshake" control flag.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

TlsActivityHelper

public TlsActivityHelper()

Method Detail

isTlsHandshake

public static boolean isTlsHandshake(org.jnetpcap.protocol.tcpip.Tcp tcp)

Returns true if the TCP payload contains a "Handshake" control flag.

Parameters:

tcp - the JNetPcap TCP representation containing a payload.

Returns:

true if the TCP payload contains a "Handshake" control flag.

isClientHello

public static boolean isClientHello(org.jnetpcap.protocol.tcpip.Tcp tcp)

Returns true if the TCP payload contains a "Client Hello" control message.

Parameters:

tcp - the JNetPcap TCP representation containing a payload.

Returns:

true if the TCP payload contains a "Client Hello" control message.

isServerHello

public static boolean isServerHello(org.jnetpcap.protocol.tcpip.Tcp tcp)

Returns true if the TCP payload contains a "Server Hello" control message.

Parameters:

tcp - the JNetPcap TCP representation containing a payload.

Returns:

true if the TCP payload contains a "Server Hello" control message.

isChangeCipherSpec

public static boolean isChangeCipherSpec(org.jnetpcap.protocol.tcpip.Tcp tcp)

Returns true if the TCP payload contains a "ChangeCipherSpec" control message.

Parameters:

tcp - the JNetPcap TCP representation containing a payload.

Returns:

true if the TCP payload contains a "ChangeCipherSpec" control message.

isApplication

public static boolean isApplication(org.jnetpcap.protocol.tcpip.Tcp tcp)

Returns true if the TCP payload contains an "Application" control message.

Parameters:

tcp - the JNetPcap TCP representation containing a payload.

Returns:

true if the TCP payload contains an "Application" control message.