From 3f810e038bc3df89b5d8c0fac5007d4c1a272206 Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Fri, 25 Jul 2025 11:12:11 +0200 Subject: [PATCH] dce-rpc: Make named_pipe filed docs extensive Closes #3935 --- scripts/base/protocols/dce-rpc/main.zeek | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/scripts/base/protocols/dce-rpc/main.zeek b/scripts/base/protocols/dce-rpc/main.zeek index 6d81d55c84..d408415be3 100644 --- a/scripts/base/protocols/dce-rpc/main.zeek +++ b/scripts/base/protocols/dce-rpc/main.zeek @@ -21,6 +21,18 @@ export { rtt : interval &log &optional; ## Remote pipe name. + ## + ## Note that this value is from the "sec_addr" field in the + ## protocol. Zeek uses the "named_pipe" name for historical reasons, + ## but it may also contain local port numbers rather than named pipes. + ## + ## If you prefer to use the "secondary address" name, consider + ## using :zeek:see:`Log::default_field_name_map`, a ``Log::Filter``'s + ## :zeek:field:`Log::Filter$field_name_map` field, or removing + ## the :zeek:attr:`&log` attribute from this field, adding a + ## new :zeek:field:`sec_addr` field and populating it in a custom + ## :zeek:see:`dce_rpc_bind_ack` event handler based on the + ## :zeek:field:`named_pipe` value. named_pipe : string &log &optional; ## Endpoint name looked up from the uuid. endpoint : string &log &optional;