Namespace: | GLOBAL |
---|---|
Source File: | /scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro |
dce_rpc_bind: event | Generated for every DCE-RPC bind request message. |
dce_rpc_bind_ack: event | Generated for every DCE-RPC bind request ack message. |
dce_rpc_message: event | Generated for every DCE-RPC message. |
dce_rpc_request: event | Generated for every DCE-RPC request message. |
dce_rpc_response: event | Generated for every DCE-RPC response message. |
Type : | event (c: connection, fid: count, uuid: string, ver_major: count, ver_minor: count) |
---|
Generated for every DCE-RPC bind request message. Since RPC offers the ability for a client to request connections to multiple endpoints, this event can occur multiple times for a single RPC message.
C : | The connection. |
---|---|
Fid : | File ID of the PIPE that carried the DCE-RPC message. Zero will be used if the DCE-RPC was not transported over a pipe. |
Uuid : | The string interpretted uuid of the endpoint being requested. |
Ver_major : | The major version of the endpoint being requested. |
Ver_minor : | The minor version of the endpoint being requested. |
See also: dce_rpc_message, dce_rpc_bind_ack, dce_rpc_request, dce_rpc_response
Type : | event (c: connection, fid: count, sec_addr: string) |
---|
Generated for every DCE-RPC bind request ack message.
C : | The connection. |
---|---|
Fid : | File ID of the PIPE that carried the DCE-RPC message. Zero will be used if the DCE-RPC was not transported over a pipe. |
Sec_addr : | Secondary address for the ack. |
See also: dce_rpc_message, dce_rpc_bind, dce_rpc_request, dce_rpc_response
Type : | event (c: connection, is_orig: bool, fid: count, ptype_id: count, ptype: DCE_RPC::PType) |
---|
Generated for every DCE-RPC message.
C : | The connection. |
---|---|
Is_orig : | True if the message was sent by the originator of the TCP connection. |
Fid : | File ID of the PIPE that carried the DCE-RPC message. Zero will be used if the DCE-RPC was not transported over a pipe. |
Ptype_id : | Numeric representation of the procedure type of the message. |
Ptype : | Enum representation of the prodecure type of the message. |
See also: dce_rpc_bind, dce_rpc_bind_ack, dce_rpc_request, dce_rpc_response
Type : | event (c: connection, fid: count, opnum: count, stub_len: count) |
---|
Generated for every DCE-RPC request message.
C : | The connection. |
---|---|
Fid : | File ID of the PIPE that carried the DCE-RPC message. Zero will be used if the DCE-RPC was not transported over a pipe. |
Opnum : | Number of the RPC operation. |
Stub_len : | Length of the data for the request. |
See also: dce_rpc_message, dce_rpc_bind, dce_rpc_bind_ack, dce_rpc_response
Type : | event (c: connection, fid: count, opnum: count, stub_len: count) |
---|
Generated for every DCE-RPC response message.
C : | The connection. |
---|---|
Fid : | File ID of the PIPE that carried the DCE-RPC message. Zero will be used if the DCE-RPC was not transported over a pipe. |
Opnum : | Number of the RPC operation. |
Stub_len : | Length of the data for the response. |
See also: dce_rpc_message, dce_rpc_bind, dce_rpc_bind_ack, dce_rpc_request