mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 08:08:19 +00:00
Change doc/ subdir into a git submodule
The docs now live at https://github.com/zeek/zeek-docs
This commit is contained in:
Jon Siwek
parent
0d685efbf5
commit
2ff746fea7
693 changed files with 26 additions and 105609 deletions
|
|
@ -1,14 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/protocols/dhcp/__load__.bro
|
||||
================================
|
||||
|
||||
|
||||
:Imports: :doc:`base/protocols/dhcp/consts.bro </scripts/base/protocols/dhcp/consts.bro>`, :doc:`base/protocols/dhcp/main.bro </scripts/base/protocols/dhcp/main.bro>`
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
|
|
@ -1,227 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/protocols/dhcp/consts.bro
|
||||
==============================
|
||||
.. bro:namespace:: DHCP
|
||||
|
||||
Types, errors, and fields for analyzing DHCP data. A helper file
|
||||
for DHCP analysis scripts.
|
||||
|
||||
:Namespace: DHCP
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Constants
|
||||
#########
|
||||
================================================================================================================== ===================================
|
||||
:bro:id:`DHCP::message_types`: :bro:type:`table` :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional` Types of DHCP messages.
|
||||
:bro:id:`DHCP::option_types`: :bro:type:`table` :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional` Option types mapped to their names.
|
||||
================================================================================================================== ===================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Constants
|
||||
#########
|
||||
.. bro:id:: DHCP::message_types
|
||||
|
||||
:Type: :bro:type:`table` [:bro:type:`count`] of :bro:type:`string`
|
||||
:Attributes: :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional`
|
||||
:Default:
|
||||
|
||||
::
|
||||
|
||||
{
|
||||
[2] = "OFFER",
|
||||
[9] = "FORCERENEW",
|
||||
[17] = "LEASEQUERYSTATUS",
|
||||
[6] = "NAK",
|
||||
[11] = "LEASEUNASSIGNED",
|
||||
[14] = "BULKLEASEQUERY",
|
||||
[4] = "DECLINE",
|
||||
[1] = "DISCOVER",
|
||||
[8] = "INFORM",
|
||||
[7] = "RELEASE",
|
||||
[15] = "LEASEQUERYDONE",
|
||||
[5] = "ACK",
|
||||
[10] = "LEASEQUERY",
|
||||
[3] = "REQUEST",
|
||||
[12] = "LEASEUNKNOWN",
|
||||
[13] = "LEASEACTIVE",
|
||||
[18] = "TLS",
|
||||
[16] = "ACTIVELEASEQUERY"
|
||||
}
|
||||
|
||||
Types of DHCP messages. See :rfc:`1533`, :rfc:`3203`,
|
||||
:rfc:`4388`, :rfc:`6926`, and :rfc:`7724`.
|
||||
|
||||
.. bro:id:: DHCP::option_types
|
||||
|
||||
:Type: :bro:type:`table` [:bro:type:`int`] of :bro:type:`string`
|
||||
:Attributes: :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional`
|
||||
:Default:
|
||||
|
||||
::
|
||||
|
||||
{
|
||||
[124] = "V-I Vendor Class",
|
||||
[7] = "Log Server",
|
||||
[22] = "Max DG Assembly",
|
||||
[211] = "Reboot Time",
|
||||
[213] = "OPTION_V4_ACCESS_DOMAIN",
|
||||
[51] = "Address Time",
|
||||
[3] = "Router",
|
||||
[75] = "StreetTalk-Server",
|
||||
[156] = "dhcp-state",
|
||||
[4] = "Time Server",
|
||||
[48] = "X Window Font",
|
||||
[26] = "MTU Interface",
|
||||
[10] = "Impress Server",
|
||||
[11] = "RLP Server",
|
||||
[90] = "Authentication",
|
||||
[125] = "V-I Vendor-Specific Information",
|
||||
[212] = "OPTION_6RD",
|
||||
[123] = "GeoConf Option",
|
||||
[175] = "Etherboot (Tentatively Assigned - 2005-06-23)",
|
||||
[45] = "NETBIOS Dist Srv",
|
||||
[39] = "Keepalive Data",
|
||||
[62] = "NetWare/IP Domain",
|
||||
[132] = "IEEE 802.1Q VLAN ID",
|
||||
[35] = "ARP Timeout",
|
||||
[93] = "Client System",
|
||||
[129] = "PXE - undefined (vendor specific)",
|
||||
[34] = "Trailers",
|
||||
[97] = "UUID/GUID",
|
||||
[153] = "start-time-of-state",
|
||||
[1] = "Subnet Mask",
|
||||
[30] = "Mask Supplier",
|
||||
[65] = "NIS-Server-Addr",
|
||||
[42] = "NTP Servers",
|
||||
[142] = "OPTION-IPv4_Address-ANDSF",
|
||||
[76] = "STDA-Server",
|
||||
[137] = "OPTION_V4_LOST",
|
||||
[209] = "Configuration File",
|
||||
[56] = "DHCP Message",
|
||||
[46] = "NETBIOS Node Type",
|
||||
[100] = "PCode",
|
||||
[146] = "RDNSS Selection",
|
||||
[220] = "Subnet Allocation Option",
|
||||
[151] = "status-code",
|
||||
[67] = "Bootfile-Name",
|
||||
[81] = "Client FQDN",
|
||||
[144] = "GeoLoc",
|
||||
[70] = "POP3-Server",
|
||||
[2] = "Time Offset",
|
||||
[15] = "Domain Name",
|
||||
[210] = "Path Prefix",
|
||||
[119] = "Domain Search",
|
||||
[83] = "iSNS",
|
||||
[36] = "Ethernet",
|
||||
[79] = "Service Scope",
|
||||
[32] = "Router Request",
|
||||
[23] = "Default IP TTL",
|
||||
[221] = "Virtual Subnet Selection (VSS) Option",
|
||||
[120] = "SIP Servers DHCP Option",
|
||||
[40] = "NIS Domain",
|
||||
[16] = "Swap Server",
|
||||
[80] = "Rapid Commit",
|
||||
[159] = "OPTION_V4_PORTPARAMS",
|
||||
[94] = "Client NDI",
|
||||
[8] = "Quotes Server",
|
||||
[131] = "PXE - undefined (vendor specific)",
|
||||
[78] = "Directory Agent",
|
||||
[134] = "Diffserv Code Point (DSCP) for VoIP signalling and media streams",
|
||||
[141] = "SIP UA Configuration Service Domains",
|
||||
[69] = "SMTP-Server",
|
||||
[59] = "Rebinding Time",
|
||||
[154] = "query-start-time",
|
||||
[55] = "Parameter List",
|
||||
[155] = "query-end-time",
|
||||
[77] = "User-Class",
|
||||
[49] = "X Window Manager",
|
||||
[50] = "Address Request",
|
||||
[113] = "Netinfo Tag",
|
||||
[9] = "LPR Server",
|
||||
[0] = "Pad",
|
||||
[66] = "Server-Name",
|
||||
[138] = "OPTION_CAPWAP_AC_V4",
|
||||
[139] = "OPTION-IPv4_Address-MoS",
|
||||
[20] = "SrcRte On/Off",
|
||||
[18] = "Extension File",
|
||||
[37] = "Default TCP TTL",
|
||||
[89] = "BCMCS Controller IPv4 address option",
|
||||
[98] = "User-Auth",
|
||||
[122] = "CCC",
|
||||
[158] = "OPTION_V4_PCP_SERVER",
|
||||
[255] = "End",
|
||||
[63] = "NetWare/IP Option",
|
||||
[53] = "DHCP Msg Type",
|
||||
[128] = "PXE - undefined (vendor specific)",
|
||||
[60] = "Class Id",
|
||||
[136] = "OPTION_PANA_AGENT",
|
||||
[72] = "WWW-Server",
|
||||
[116] = "Auto-Config",
|
||||
[130] = "PXE - undefined (vendor specific)",
|
||||
[85] = "NDS Servers",
|
||||
[73] = "Finger-Server",
|
||||
[88] = "BCMCS Controller Domain Name list",
|
||||
[208] = "PXELINUX Magic",
|
||||
[19] = "Forward On/Off",
|
||||
[112] = "Netinfo Address",
|
||||
[54] = "DHCP Server Id",
|
||||
[68] = "Home-Agent-Addrs",
|
||||
[5] = "Name Server",
|
||||
[114] = "URL",
|
||||
[44] = "NETBIOS Name Srv",
|
||||
[13] = "Boot File Size",
|
||||
[47] = "NETBIOS Scope",
|
||||
[58] = "Renewal Time",
|
||||
[29] = "Mask Discovery",
|
||||
[12] = "Hostname",
|
||||
[17] = "Root Path",
|
||||
[135] = "HTTP Proxy for phone-specific applications",
|
||||
[61] = "Client Id",
|
||||
[99] = "GEOCONF_CIVIC",
|
||||
[25] = "MTU Plateau",
|
||||
[121] = "Classless Static Route Option",
|
||||
[71] = "NNTP-Server",
|
||||
[117] = "Name Service Search",
|
||||
[118] = "Subnet Selection Option",
|
||||
[176] = "IP Telephone (Tentatively Assigned - 2005-06-23)",
|
||||
[38] = "Keepalive Time",
|
||||
[57] = "DHCP Max Msg Size",
|
||||
[252] = "auto-proxy-config",
|
||||
[52] = "Overload",
|
||||
[150] = "TFTP server address",
|
||||
[140] = "OPTION-IPv4_FQDN-MoS",
|
||||
[43] = "Vendor Specific",
|
||||
[41] = "NIS Servers",
|
||||
[101] = "TCode",
|
||||
[87] = "NDS Context",
|
||||
[74] = "IRC-Server",
|
||||
[6] = "Domain Server",
|
||||
[177] = "PacketCable and CableHome (replaced by 122)",
|
||||
[91] = "client-last-transaction-time option",
|
||||
[82] = "Relay Agent Information",
|
||||
[161] = "OPTION_MUD_URL_V4 (TEMPORARY - registered 2016-11-17)",
|
||||
[64] = "NIS-Domain-Name",
|
||||
[95] = "LDAP",
|
||||
[133] = "IEEE 802.1D/p Layer 2 Priority",
|
||||
[14] = "Merit Dump File",
|
||||
[27] = "MTU Subnet",
|
||||
[31] = "Router Discovery",
|
||||
[24] = "MTU Timeout",
|
||||
[152] = "base-time",
|
||||
[160] = "DHCP Captive-Portal",
|
||||
[145] = "FORCERENEW_NONCE_CAPABLE",
|
||||
[28] = "Broadcast Address",
|
||||
[33] = "Static Route",
|
||||
[92] = "associated-ip option",
|
||||
[21] = "Policy Filter",
|
||||
[157] = "data-source",
|
||||
[86] = "NDS Tree Name"
|
||||
}
|
||||
|
||||
Option types mapped to their names.
|
||||
|
||||
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
:orphan:
|
||||
|
||||
Package: base/protocols/dhcp
|
||||
============================
|
||||
|
||||
Support for Dynamic Host Configuration Protocol (DHCP) analysis.
|
||||
|
||||
:doc:`/scripts/base/protocols/dhcp/__load__.bro`
|
||||
|
||||
|
||||
:doc:`/scripts/base/protocols/dhcp/consts.bro`
|
||||
|
||||
Types, errors, and fields for analyzing DHCP data. A helper file
|
||||
for DHCP analysis scripts.
|
||||
|
||||
:doc:`/scripts/base/protocols/dhcp/main.bro`
|
||||
|
||||
Analyze DHCP traffic and provide a log that is organized around
|
||||
the idea of a DHCP "conversation" defined by messages exchanged within
|
||||
a relatively short period of time using the same transaction ID.
|
||||
The log will have information from clients and servers to give a more
|
||||
complete picture of what happened.
|
||||
|
||||
|
|
@ -1,257 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/protocols/dhcp/main.bro
|
||||
============================
|
||||
.. bro:namespace:: DHCP
|
||||
|
||||
Analyze DHCP traffic and provide a log that is organized around
|
||||
the idea of a DHCP "conversation" defined by messages exchanged within
|
||||
a relatively short period of time using the same transaction ID.
|
||||
The log will have information from clients and servers to give a more
|
||||
complete picture of what happened.
|
||||
|
||||
:Namespace: DHCP
|
||||
:Imports: :doc:`base/frameworks/cluster </scripts/base/frameworks/cluster/index>`, :doc:`base/protocols/dhcp/consts.bro </scripts/base/protocols/dhcp/consts.bro>`
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
============================================================================ ===============================================================
|
||||
:bro:id:`DHCP::max_txid_watch_time`: :bro:type:`interval` :bro:attr:`&redef` The maximum amount of time that a transation ID will be watched
|
||||
for to try and tie messages together into a single DHCP
|
||||
transaction narrative.
|
||||
============================================================================ ===============================================================
|
||||
|
||||
State Variables
|
||||
###############
|
||||
================================================ ========================================================
|
||||
:bro:id:`DHCP::log_info`: :bro:type:`DHCP::Info` This is a global variable that is only to be used in the
|
||||
:bro::see::`DHCP::aggregate_msgs` event.
|
||||
================================================ ========================================================
|
||||
|
||||
Types
|
||||
#####
|
||||
========================================== =================================================================
|
||||
:bro:type:`DHCP::Info`: :bro:type:`record` The record type which contains the column fields of the DHCP log.
|
||||
========================================== =================================================================
|
||||
|
||||
Redefinitions
|
||||
#############
|
||||
================================================================= =
|
||||
:bro:type:`DHCP::Info`: :bro:type:`record`
|
||||
:bro:type:`Log::ID`: :bro:type:`enum`
|
||||
:bro:type:`connection`: :bro:type:`record`
|
||||
:bro:id:`likely_server_ports`: :bro:type:`set` :bro:attr:`&redef`
|
||||
================================================================= =
|
||||
|
||||
Events
|
||||
######
|
||||
================================================= ================================================================
|
||||
:bro:id:`DHCP::aggregate_msgs`: :bro:type:`event` This event is used internally to distribute data around clusters
|
||||
since DHCP doesn't follow the normal "connection" model used by
|
||||
most protocols.
|
||||
:bro:id:`DHCP::log_dhcp`: :bro:type:`event` Event that can be handled to access the DHCP
|
||||
record as it is sent on to the logging framework.
|
||||
================================================= ================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
.. bro:id:: DHCP::max_txid_watch_time
|
||||
|
||||
:Type: :bro:type:`interval`
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default: ``30.0 secs``
|
||||
|
||||
The maximum amount of time that a transation ID will be watched
|
||||
for to try and tie messages together into a single DHCP
|
||||
transaction narrative.
|
||||
|
||||
State Variables
|
||||
###############
|
||||
.. bro:id:: DHCP::log_info
|
||||
|
||||
:Type: :bro:type:`DHCP::Info`
|
||||
:Default:
|
||||
|
||||
::
|
||||
|
||||
{
|
||||
ts=<uninitialized>
|
||||
uids={
|
||||
|
||||
}
|
||||
client_addr=<uninitialized>
|
||||
server_addr=<uninitialized>
|
||||
client_port=<uninitialized>
|
||||
server_port=<uninitialized>
|
||||
mac=<uninitialized>
|
||||
host_name=<uninitialized>
|
||||
client_fqdn=<uninitialized>
|
||||
domain=<uninitialized>
|
||||
requested_addr=<uninitialized>
|
||||
assigned_addr=<uninitialized>
|
||||
lease_time=<uninitialized>
|
||||
client_message=<uninitialized>
|
||||
server_message=<uninitialized>
|
||||
msg_types=[]
|
||||
duration=0 secs
|
||||
last_message_ts=<uninitialized>
|
||||
msg_orig=<uninitialized>
|
||||
client_software=<uninitialized>
|
||||
server_software=<uninitialized>
|
||||
circuit_id=<uninitialized>
|
||||
agent_remote_id=<uninitialized>
|
||||
subscriber_id=<uninitialized>
|
||||
}
|
||||
|
||||
This is a global variable that is only to be used in the
|
||||
:bro::see::`DHCP::aggregate_msgs` event. It can be used to avoid
|
||||
looking up the info record for a transaction ID in every event handler
|
||||
for :bro:see::`DHCP::aggregate_msgs`.
|
||||
|
||||
Types
|
||||
#####
|
||||
.. bro:type:: DHCP::Info
|
||||
|
||||
:Type: :bro:type:`record`
|
||||
|
||||
ts: :bro:type:`time` :bro:attr:`&log`
|
||||
The earliest time at which a DHCP message over the
|
||||
associated connection is observed.
|
||||
|
||||
uids: :bro:type:`set` [:bro:type:`string`] :bro:attr:`&log`
|
||||
A series of unique identifiers of the connections over which
|
||||
DHCP is occurring. This behavior with multiple connections is
|
||||
unique to DHCP because of the way it uses broadcast packets
|
||||
on local networks.
|
||||
|
||||
client_addr: :bro:type:`addr` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
IP address of the client. If a transaction
|
||||
is only a client sending INFORM messages then
|
||||
there is no lease information exchanged so this
|
||||
is helpful to know who sent the messages.
|
||||
Getting an address in this field does require
|
||||
that the client sources at least one DHCP message
|
||||
using a non-broadcast address.
|
||||
|
||||
server_addr: :bro:type:`addr` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
IP address of the server involved in actually
|
||||
handing out the lease. There could be other
|
||||
servers replying with OFFER messages which won't
|
||||
be represented here. Getting an address in this
|
||||
field also requires that the server handing out
|
||||
the lease also sources packets from a non-broadcast
|
||||
IP address.
|
||||
|
||||
client_port: :bro:type:`port` :bro:attr:`&optional`
|
||||
Client port number seen at time of server handing out IP (expected
|
||||
as 68/udp).
|
||||
|
||||
server_port: :bro:type:`port` :bro:attr:`&optional`
|
||||
Server port number seen at time of server handing out IP (expected
|
||||
as 67/udp).
|
||||
|
||||
mac: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
Client's hardware address.
|
||||
|
||||
host_name: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
Name given by client in Hostname option 12.
|
||||
|
||||
client_fqdn: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
FQDN given by client in Client FQDN option 81.
|
||||
|
||||
domain: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
Domain given by the server in option 15.
|
||||
|
||||
requested_addr: :bro:type:`addr` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
IP address requested by the client.
|
||||
|
||||
assigned_addr: :bro:type:`addr` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
IP address assigned by the server.
|
||||
|
||||
lease_time: :bro:type:`interval` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
IP address lease interval.
|
||||
|
||||
client_message: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
Message typically accompanied with a DHCP_DECLINE
|
||||
so the client can tell the server why it rejected
|
||||
an address.
|
||||
|
||||
server_message: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
Message typically accompanied with a DHCP_NAK to let
|
||||
the client know why it rejected the request.
|
||||
|
||||
msg_types: :bro:type:`vector` of :bro:type:`string` :bro:attr:`&log` :bro:attr:`&default` = ``[]`` :bro:attr:`&optional`
|
||||
The DHCP message types seen by this DHCP transaction
|
||||
|
||||
duration: :bro:type:`interval` :bro:attr:`&log` :bro:attr:`&default` = ``0 secs`` :bro:attr:`&optional`
|
||||
Duration of the DHCP "session" representing the
|
||||
time from the first message to the last.
|
||||
|
||||
last_message_ts: :bro:type:`time` :bro:attr:`&optional`
|
||||
|
||||
msg_orig: :bro:type:`vector` of :bro:type:`addr` :bro:attr:`&log` :bro:attr:`&default` = ``[]`` :bro:attr:`&optional`
|
||||
(present if :doc:`/scripts/policy/protocols/dhcp/msg-orig.bro` is loaded)
|
||||
|
||||
The address that originated each message from the
|
||||
`msg_types` field.
|
||||
|
||||
client_software: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
(present if :doc:`/scripts/policy/protocols/dhcp/software.bro` is loaded)
|
||||
|
||||
Software reported by the client in the `vendor_class` option.
|
||||
|
||||
server_software: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
(present if :doc:`/scripts/policy/protocols/dhcp/software.bro` is loaded)
|
||||
|
||||
Software reported by the server in the `vendor_class` option.
|
||||
|
||||
circuit_id: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
(present if :doc:`/scripts/policy/protocols/dhcp/sub-opts.bro` is loaded)
|
||||
|
||||
Added by DHCP relay agents which terminate switched or
|
||||
permanent circuits. It encodes an agent-local identifier
|
||||
of the circuit from which a DHCP client-to-server packet was
|
||||
received. Typically it should represent a router or switch
|
||||
interface number.
|
||||
|
||||
agent_remote_id: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
(present if :doc:`/scripts/policy/protocols/dhcp/sub-opts.bro` is loaded)
|
||||
|
||||
A globally unique identifier added by relay agents to identify
|
||||
the remote host end of the circuit.
|
||||
|
||||
subscriber_id: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
(present if :doc:`/scripts/policy/protocols/dhcp/sub-opts.bro` is loaded)
|
||||
|
||||
The subscriber ID is a value independent of the physical
|
||||
network configuration so that a customer's DHCP configuration
|
||||
can be given to them correctly no matter where they are
|
||||
physically connected.
|
||||
|
||||
The record type which contains the column fields of the DHCP log.
|
||||
|
||||
Events
|
||||
######
|
||||
.. bro:id:: DHCP::aggregate_msgs
|
||||
|
||||
:Type: :bro:type:`event` (ts: :bro:type:`time`, id: :bro:type:`conn_id`, uid: :bro:type:`string`, is_orig: :bro:type:`bool`, msg: :bro:type:`DHCP::Msg`, options: :bro:type:`DHCP::Options`)
|
||||
|
||||
This event is used internally to distribute data around clusters
|
||||
since DHCP doesn't follow the normal "connection" model used by
|
||||
most protocols. It can also be handled to extend the DHCP log.
|
||||
|
||||
:bro:see::`DHCP::log_info`.
|
||||
|
||||
.. bro:id:: DHCP::log_dhcp
|
||||
|
||||
:Type: :bro:type:`event` (rec: :bro:type:`DHCP::Info`)
|
||||
|
||||
Event that can be handled to access the DHCP
|
||||
record as it is sent on to the logging framework.
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue