PAS-9: Unique list of IP/Ports

The changes made in PAS-10 need to be kept in mind. Where observed traffic is IPv4 encapsulated IPv6 we want the list to show the real (i.e. the IPv6) destination and not the tunnel endpoint.

The simplest way to be sure is probably going to be to extract a full list and then have three runs through the data

- Native IPv4
- Native IPv6
- Tunnelled IPv6

We still want to record that the tunnel endpoint was connected to though, so may need to come up with some sort of indicator to mark it as such.

Data will be output into a new report dest-ip-ports.csv which has the following field structure

Dest IP, Dest Port, Tunnelled

- For both native IPv4 and IPv6, Tunnelled will be N_
- For IPv4 encapsulated IPv6, _Tunnelled will be Y_
- For IPv4 addresses identified as a tunnel endpoint, port will be empty and _Tunnelled will be _T_

Still need to take non-TCP traffic into account, though I'd prefer if we can find a way to avoid clogging the CSV with client ports.

I don't want to simply exclude high-numbered ports, because there's nothing to stop you from having something listen on one of those and the resulting traffic would be excluded from the reports.

Ideally it needs to be done in a way that's more or less protocol agnostic. With DNS (for example) we can easily see whether it's a query or a response, but that means that just to generate a list of dest IP/ports the script has to understand every protocol which might be run over UDP.

That said, also want to think about whether other protocols should be included. Recording ICMP echo requests (for example) would introduce a lot of noise, though by the same token there might be cause to be interested in looking at what hosts have been pinged and how regularly (leading up to looking at the ping payloads themselves to see if it's being used for communication). There are other types of ICMP which might be of interest too.


Also, it occurred that the output of this feature can be used to help decide what other tshark runs to perform later in the script, so I've raised PAS-11 to cover the implementation of that. Can't do very much on it until a sensible solution has been found for non-TCP traffic though.

I've added a new field to the CSV to record the protocol, so that it can more easily be searched/filtered once support for other protocols is added