base/bif/plugins/Bro_DCE_RPC.events.bif.bro

GLOBAL
Namespace:GLOBAL
Source File:/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro

Summary

Events

dce_rpc_bind: event Generated for every DCE-RPC bind request message.
dce_rpc_bind_ack: event Generated for every DCE-RPC bind request ack message.
dce_rpc_message: event Generated for every DCE-RPC message.
dce_rpc_request: event Generated for every DCE-RPC request message.
dce_rpc_response: event Generated for every DCE-RPC response message.

Detailed Interface

Events

dce_rpc_bind
Type:event (c: connection, fid: count, uuid: string, ver_major: count, ver_minor: count)

Generated for every DCE-RPC bind request message. Since RPC offers the ability for a client to request connections to multiple endpoints, this event can occur multiple times for a single RPC message.

C:The connection.
Fid:File ID of the PIPE that carried the DCE-RPC message. Zero will be used if the DCE-RPC was not transported over a pipe.
Uuid:The string interpretted uuid of the endpoint being requested.
Ver_major:The major version of the endpoint being requested.
Ver_minor:The minor version of the endpoint being requested.

See also: dce_rpc_message, dce_rpc_bind_ack, dce_rpc_request, dce_rpc_response

dce_rpc_bind_ack
Type:event (c: connection, fid: count, sec_addr: string)

Generated for every DCE-RPC bind request ack message.

C:The connection.
Fid:File ID of the PIPE that carried the DCE-RPC message. Zero will be used if the DCE-RPC was not transported over a pipe.
Sec_addr:Secondary address for the ack.

See also: dce_rpc_message, dce_rpc_bind, dce_rpc_request, dce_rpc_response

dce_rpc_message
Type:event (c: connection, is_orig: bool, fid: count, ptype_id: count, ptype: DCE_RPC::PType)

Generated for every DCE-RPC message.

C:The connection.
Is_orig:True if the message was sent by the originator of the TCP connection.
Fid:File ID of the PIPE that carried the DCE-RPC message. Zero will be used if the DCE-RPC was not transported over a pipe.
Ptype_id:Numeric representation of the procedure type of the message.
Ptype:Enum representation of the prodecure type of the message.

See also: dce_rpc_bind, dce_rpc_bind_ack, dce_rpc_request, dce_rpc_response

dce_rpc_request
Type:event (c: connection, fid: count, opnum: count, stub_len: count)

Generated for every DCE-RPC request message.

C:The connection.
Fid:File ID of the PIPE that carried the DCE-RPC message. Zero will be used if the DCE-RPC was not transported over a pipe.
Opnum:Number of the RPC operation.
Stub_len:Length of the data for the request.

See also: dce_rpc_message, dce_rpc_bind, dce_rpc_bind_ack, dce_rpc_response

dce_rpc_response
Type:event (c: connection, fid: count, opnum: count, stub_len: count)

Generated for every DCE-RPC response message.

C:The connection.
Fid:File ID of the PIPE that carried the DCE-RPC message. Zero will be used if the DCE-RPC was not transported over a pipe.
Opnum:Number of the RPC operation.
Stub_len:Length of the data for the response.

See also: dce_rpc_message, dce_rpc_bind, dce_rpc_bind_ack, dce_rpc_request


Copyright 2016, The Bro Project. Last updated on December 13, 2017. Created using Sphinx 1.5.2.