base/bif/plugins/Bro_NCP.events.bif.bro

GLOBAL
Namespace:GLOBAL
Source File:/scripts/base/bif/plugins/Bro_NCP.events.bif.bro

Summary

Events

ncp_reply: event Generated for NCP replies (Netware Core Protocol).
ncp_request: event Generated for NCP requests (Netware Core Protocol).

Detailed Interface

Events

ncp_reply
Type:event (c: connection, frame_type: count, length: count, req_frame: count, req_func: count, completion_code: count)

Generated for NCP replies (Netware Core Protocol).

See Wikipedia for more information about the NCP protocol.

C:The connection.
Frame_type:The frame type, as specified by the protocol.
Length:The length of the request body, excluding the frame header.
Req_frame:The frame type from the corresponding request.
Req_func:The function code from the corresponding request.
Completion_code:
 The reply’s completion code, as specified by the protocol.

See also: ncp_request

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

ncp_request
Type:event (c: connection, frame_type: count, length: count, func: count)

Generated for NCP requests (Netware Core Protocol).

See Wikipedia for more information about the NCP protocol.

C:The connection.
Frame_type:The frame type, as specified by the protocol.
Length:The length of the request body, excluding the frame header.
Func:The requested function, as specified by the protocol.

See also: ncp_reply

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.


Copyright 2016, The Bro Project. Last updated on December 12, 2017. Created using Sphinx 1.5.2.