Beats: New protocol support: Oracle TNS

[tsg]

Split from #22.

[juerkan]

+1

[yeroc]

Someone referenced this link on the original ticket this was split off from: http://www.pythian.com/blog/repost-oracle-protocol/ (it has useful information on the Oracle TNS protocol).

[darxriggs]

I did some research.

Here are some interesting references:

• http://www.pythian.com/blog/repost-oracle-protocol/
• Wireshark already has a TNS dissector. See packet-tns.h and packet-tns.c
• Wireshark had code to dissect TTI (see wiki)
• https://community.oracle.com/thread/615450?tstart=0
• http://ckng62.blogspot.de/2014/02/tns-headers.html
• http://ckng62.blogspot.de/2014/02/tns-data-packet-structure.html
• https://www.thesprawl.org/research/oracle-tns-protocol/
• http://www.nyoug.org/Presentations/2008/Sep/Harris_Listening%20In.pdf
• https://community.dynatrace.com/community/display/DNA123/Oracle+SQL+Decode
• https://github.com/SpiderLabs/net-tns
• book "The Oracle® Hacker's Handbook: Hacking and Defending Oracle"
• leaked/disassembled Oracle JDBC driver sources? (e.g. T4CTTIMsg.java or T4CTTIfun.java)

Conclusion:

• Copyright & Licenses are an issue.
• TNS without TTI/TTC is of little use as TTI/TTC is required to extract fields like method, resource, path and query.

@tsg If Elastic is willing to get the licensing resolved I can have a further look at the implementation.

[julienmathevet]

+1

[oraant]

+1
How's it going now?
How can we help?
@darxriggs

[binlaniua]

@darxriggs +1

[JosefJezek]

Any progress? :+1:

[darxriggs]

From my side it's on hold until someone resolves the legal aspects.

[monicasarbu]

We are currently not planning to add support for Oracle TNS as it's a proprietary protocol and an implementation would require a special license from Oracle. If you are an Oracle partner/customer you might be able to help us with this. Please contact me privately at [email protected].

[binlaniua]

@darxriggs expect

[kimchy]

to add to @monicasarbu note, we would love to work with Oracle to make sure this is available. The best solution from my perspective is that it will end up being a joint work with the community, Elastic, and Oracle, to make sure this is something that is well maintained. We will try and reach out and see what we can do, but we need your help as Oracle customers to raise it with Oracle as well.

[tinisky]

+1

[alrocar]

+1

[smougenot]

@monicasarbu Sounds strage to me that Wireshark team can openly (like in opensourced code) analyse Oracle protocol whereas Elastic team could not.

In fact as mentioned in the links posted by @darxriggs (on this issue), The code in Wireshark is based on reversed engineering and not on the official partnership access to Oracle documentations.

Might be worth to contact Wireshark team about it?

[michalpristas]

@monicasarbu do you recall if there was a conversation with Oracle about this one?
If no actions were made can we close this issue?

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic[bot]]

This issue doesn't have a Team:<team> label.