prelude: add missing TCP header to additional data

9 years ago · dcce225102
parent 671320aab8
commit dcce225102
1 changed files with 16 additions and 0 deletions
--- a/src/alert-prelude.c
+++ b/src/alert-prelude.c
@ -502,6 +502,22 @@ static int PacketToData(const Packet *p, const PacketAlert *pa, idmef_alert_t *a
            AddIntData(alert, "tcp_win", TCP_GET_WINDOW(p));
            AddIntData(alert, "tcp_sum", TCP_GET_SUM(p));
            AddIntData(alert, "tcp_urp", TCP_GET_URG_POINTER(p));
+            if (p->tcpvars.ts_val != NULL) {
+                AddIntData(alert, "tcp_tsval", TCP_GET_TSVAL(p));
+            }
+            if (p->tcpvars.ts_ecr != NULL) {
+                AddIntData(alert, "tcp_tsecr", TCP_GET_TSECR(p));
+            }
+            if (p->tcph != NULL) {
+                AddIntData(alert, "tcp_wscale", TCP_GET_WSCALE(p));
+            }
+            if (TCP_HAS_SACKOK(p)) {
+                AddIntData(alert, "tcp_sackok", TCP_GET_SACKOK(p));
+            }
+            if (TCP_HAS_SACK(p)) {
+                AddIntData(alert, "tcp_sack_cnt", TCP_GET_SACK_CNT(p));
+            }
+            AddIntData(alert, "tcp_hlen", TCP_GET_HLEN(p));
        }

        else if ( PKT_IS_UDP(p) ) {