Merge remote-tracking branch 'origin/topic/jsiwek/ncp-fixes'

* origin/topic/jsiwek/ncp-fixes:
  Add NCP::max_frame_size tuning option
  Migrate NCP analyzer to use latest analyzer API
This commit is contained in:
Jon Siwek 2018-06-05 11:31:43 -05:00
commit a43c7d0691
15 changed files with 1012 additions and 39 deletions

View file

@ -3,7 +3,7 @@
#empty_field (empty)
#unset_field -
#path loaded_scripts
#open 2018-03-01-16-07-03
#open 2018-06-05-16-19-04
#fields name
#types string
scripts/base/init-bare.bro
@ -93,6 +93,7 @@ scripts/base/init-bare.bro
build/scripts/base/bif/plugins/Bro_Modbus.events.bif.bro
build/scripts/base/bif/plugins/Bro_MySQL.events.bif.bro
build/scripts/base/bif/plugins/Bro_NCP.events.bif.bro
build/scripts/base/bif/plugins/Bro_NCP.consts.bif.bro
build/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro
build/scripts/base/bif/plugins/Bro_NetBIOS.functions.bif.bro
build/scripts/base/bif/plugins/Bro_NTLM.types.bif.bro
@ -175,4 +176,4 @@ scripts/base/init-bare.bro
build/scripts/base/bif/plugins/Bro_SQLiteWriter.sqlite.bif.bro
scripts/policy/misc/loaded-scripts.bro
scripts/base/utils/paths.bro
#close 2018-03-01-16-07-03
#close 2018-06-05-16-19-04

View file

@ -3,7 +3,7 @@
#empty_field (empty)
#unset_field -
#path loaded_scripts
#open 2018-05-17-23-49-59
#open 2018-06-05-16-19-07
#fields name
#types string
scripts/base/init-bare.bro
@ -93,6 +93,7 @@ scripts/base/init-bare.bro
build/scripts/base/bif/plugins/Bro_Modbus.events.bif.bro
build/scripts/base/bif/plugins/Bro_MySQL.events.bif.bro
build/scripts/base/bif/plugins/Bro_NCP.events.bif.bro
build/scripts/base/bif/plugins/Bro_NCP.consts.bif.bro
build/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro
build/scripts/base/bif/plugins/Bro_NetBIOS.functions.bif.bro
build/scripts/base/bif/plugins/Bro_NTLM.types.bif.bro
@ -364,4 +365,4 @@ scripts/base/init-default.bro
scripts/base/misc/find-filtered-trace.bro
scripts/base/misc/version.bro
scripts/policy/misc/loaded-scripts.bro
#close 2018-05-17-23-49-59
#close 2018-06-05-16-19-07

View file

@ -264,7 +264,7 @@
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Broker::LOG)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Config::LOG)) -> <no result>
@ -441,7 +441,7 @@
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
0.000000 MetaHookPost CallFunction(NetControl::check_plugins, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(NetControl::init, <null>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(Notice::want_pp, <frame>, ()) -> <no result>
@ -522,6 +522,7 @@
0.000000 MetaHookPost LoadFile(0, .<...>/Bro_MIME.events.bif.bro) -> -1
0.000000 MetaHookPost LoadFile(0, .<...>/Bro_Modbus.events.bif.bro) -> -1
0.000000 MetaHookPost LoadFile(0, .<...>/Bro_MySQL.events.bif.bro) -> -1
0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NCP.consts.bif.bro) -> -1
0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NCP.events.bif.bro) -> -1
0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NTLM.events.bif.bro) -> -1
0.000000 MetaHookPost LoadFile(0, .<...>/Bro_NTLM.types.bif.bro) -> -1
@ -1062,7 +1063,7 @@
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Broker::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Config::LOG))
@ -1239,7 +1240,7 @@
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(NetControl::check_plugins, <frame>, ())
0.000000 MetaHookPre CallFunction(NetControl::init, <null>, ())
0.000000 MetaHookPre CallFunction(Notice::want_pp, <frame>, ())
@ -1320,6 +1321,7 @@
0.000000 MetaHookPre LoadFile(0, .<...>/Bro_MIME.events.bif.bro)
0.000000 MetaHookPre LoadFile(0, .<...>/Bro_Modbus.events.bif.bro)
0.000000 MetaHookPre LoadFile(0, .<...>/Bro_MySQL.events.bif.bro)
0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NCP.consts.bif.bro)
0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NCP.events.bif.bro)
0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NTLM.events.bif.bro)
0.000000 MetaHookPre LoadFile(0, .<...>/Bro_NTLM.types.bif.bro)
@ -1859,7 +1861,7 @@
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Config::LOG)
@ -2036,7 +2038,7 @@
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction NetControl::check_plugins()
0.000000 | HookCallFunction NetControl::init()
0.000000 | HookCallFunction Notice::want_pp()
@ -2117,6 +2119,7 @@
0.000000 | HookLoadFile .<...>/Bro_MIME.events.bif.bro
0.000000 | HookLoadFile .<...>/Bro_Modbus.events.bif.bro
0.000000 | HookLoadFile .<...>/Bro_MySQL.events.bif.bro
0.000000 | HookLoadFile .<...>/Bro_NCP.consts.bif.bro
0.000000 | HookLoadFile .<...>/Bro_NCP.events.bif.bro
0.000000 | HookLoadFile .<...>/Bro_NTLM.events.bif.bro
0.000000 | HookLoadFile .<...>/Bro_NTLM.types.bif.bro
@ -2387,7 +2390,7 @@
0.000000 | HookLoadFile base<...>/x509
0.000000 | HookLoadFile base<...>/xmpp
0.000000 | HookLogInit packet_filter 1/1 {ts (time), node (string), filter (string), init (bool), success (bool)}
0.000000 | HookLogWrite packet_filter [ts=1525287517.317589, node=bro, filter=ip or not ip, init=T, success=T]
0.000000 | HookLogWrite packet_filter [ts=1528215692.710382, node=bro, filter=ip or not ip, init=T, success=T]
0.000000 | HookQueueEvent NetControl::init()
0.000000 | HookQueueEvent bro_init()
0.000000 | HookQueueEvent filter_change_tracking()

View file

@ -0,0 +1,468 @@
ncp reply, 13107, 70, 0, 0, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 59, 89
ncp reply, 13107, 2, 8738, 89, 255
ncp request, 8738, 59, 89
ncp reply, 13107, 2, 8738, 89, 255
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 66, 89
ncp reply, 13107, 92, 8738, 89, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 66, 89
ncp reply, 13107, 92, 8738, 89, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 46, 89
ncp reply, 13107, 88, 8738, 89, 0
ncp request, 8738, 40, 89
ncp reply, 13107, 11, 8738, 89, 0
ncp request, 8738, 40, 89
ncp reply, 13107, 102, 8738, 89, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 6, 22338
ncp reply, 13107, 10, 8738, 22338, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 163, 8738, 72, 0
ncp request, 8738, 14, 72

View file

@ -0,0 +1,418 @@
ncp reply, 13107, 70, 0, 0, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 59, 89
ncp reply, 13107, 2, 8738, 89, 255
ncp request, 8738, 59, 89
ncp reply, 13107, 2, 8738, 89, 255
ncp request, 8738, 79, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp reply, 13107, 86, 8738, 72, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 66, 89
ncp reply, 13107, 92, 8738, 89, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 66, 89
ncp reply, 13107, 92, 8738, 89, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 14, 72
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 46, 89
ncp reply, 13107, 88, 8738, 89, 0
ncp request, 8738, 40, 89
ncp reply, 13107, 11, 8738, 89, 0
ncp request, 8738, 40, 89
ncp reply, 13107, 102, 8738, 89, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 6, 22338
ncp reply, 13107, 10, 8738, 22338, 0
ncp request, 8738, 14, 72
ncp request, 8738, 8, 66
ncp reply, 13107, 2, 8738, 66, 0
ncp request, 8738, 72, 89
ncp reply, 13107, 70, 8738, 89, 0
ncp request, 8738, 7, 22306
ncp reply, 13107, 2, 8738, 22306, 0
ncp request, 8738, 14, 72
ncp request, 8738, 14, 72

Binary file not shown.

View file

@ -0,0 +1,20 @@
# @TEST-EXEC: bro -C -r $TRACES/ncp.pcap %INPUT >out
# @TEST-EXEC: btest-diff out
redef likely_server_ports += { 524/tcp };
event bro_init()
{
const ports = { 524/tcp };
Analyzer::register_for_ports(Analyzer::ANALYZER_NCP, ports);
}
event ncp_request(c: connection, frame_type: count, length: count, func: count)
{
print "ncp request", frame_type, length, func;
}
event ncp_reply(c: connection, frame_type: count, length: count, req_frame: count, req_func: count, completion_code: count)
{
print "ncp reply", frame_type, length, req_frame, req_func, completion_code;
}

View file

@ -0,0 +1,20 @@
# @TEST-EXEC: bro -C -r $TRACES/ncp.pcap %INPUT NCP::max_frame_size=150 >out
# @TEST-EXEC: btest-diff out
redef likely_server_ports += { 524/tcp };
event bro_init()
{
const ports = { 524/tcp };
Analyzer::register_for_ports(Analyzer::ANALYZER_NCP, ports);
}
event ncp_request(c: connection, frame_type: count, length: count, func: count)
{
print "ncp request", frame_type, length, func;
}
event ncp_reply(c: connection, frame_type: count, length: count, req_frame: count, req_func: count, completion_code: count)
{
print "ncp reply", frame_type, length, req_frame, req_func, completion_code;
}