Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix typos and formatting in the other protocol docs

Browse source
This commit is contained in:
Daniel Thayer 2013-10-16 18:07:34 -05:00
parent 8764850337
commit c224fbe7f8
6 changed files with 23 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/protocols/dnp3/main.bro
View file

@ -10,7 +10,7 @@ export {
type Info: record { type Info: record {
## Time of the request. ## Time of the request.
ts: time &log; ts: time &log;
## Unique identifier for the connnection. ## Unique identifier for the connection.
uid: string &log; uid: string &log;
## Identifier for the connection. ## Identifier for the connection.
id: conn_id &log; id: conn_id &log;

4
scripts/base/protocols/irc/main.bro
View file

@ -15,9 +15,9 @@ export {
uid: string &log; uid: string &log;
## The connection's 4-tuple of endpoint addresses/ports. ## The connection's 4-tuple of endpoint addresses/ports.
id: conn_id &log; id: conn_id &log;
## Nick name given for the connection. ## Nickname given for the connection.
nick: string &log &optional; nick: string &log &optional;
## User name given for the connection. ## Username given for the connection.
user: string &log &optional; user: string &log &optional;
## Command given by the client. ## Command given by the client.

6
scripts/base/protocols/modbus/main.bro
View file

@ -10,7 +10,7 @@ export {
type Info: record { type Info: record {
## Time of the request. ## Time of the request.
ts: time &log; ts: time &log;
## Unique identifier for the connnection. ## Unique identifier for the connection.
uid: string &log; uid: string &log;
## Identifier for the connection. ## Identifier for the connection.
id: conn_id &log; id: conn_id &log;
@ -20,8 +20,8 @@ export {
exception: string &log &optional; exception: string &log &optional;
}; };
## Event that can be handled to access the Modbus record as it is sent on ## Event that can be handled to access the Modbus record as it is sent
## to the logging framework. ## on to the logging framework.
global log_modbus: event(rec: Info); global log_modbus: event(rec: Info);
} }

15
scripts/base/protocols/smtp/main.bro
View file

@ -14,8 +14,8 @@ export {
uid: string &log; uid: string &log;
## The connection's 4-tuple of endpoint addresses/ports. ## The connection's 4-tuple of endpoint addresses/ports.
id: conn_id &log; id: conn_id &log;
## A count to represent the depth of this message transaction in a single ## A count to represent the depth of this message transaction in
## connection where multiple messages were transferred. ## a single connection where multiple messages were transferred.
trans_depth: count &log; trans_depth: count &log;
## Contents of the Helo header. ## Contents of the Helo header.
helo: string &log &optional; helo: string &log &optional;
@ -37,7 +37,7 @@ export {
in_reply_to: string &log &optional; in_reply_to: string &log &optional;
## Contents of the Subject header. ## Contents of the Subject header.
subject: string &log &optional; subject: string &log &optional;
## Contents of the X-Origininating-IP header. ## Contents of the X-Originating-IP header.
x_originating_ip: addr &log &optional; x_originating_ip: addr &log &optional;
## Contents of the first Received header. ## Contents of the first Received header.
first_received: string &log &optional; first_received: string &log &optional;
@ -50,7 +50,8 @@ export {
## Value of the User-Agent header from the client. ## Value of the User-Agent header from the client.
user_agent: string &log &optional; user_agent: string &log &optional;
## Indicates if the "Received: from" headers should still be processed. ## Indicates if the "Received: from" headers should still be
## processed.
process_received_from: bool &default=T; process_received_from: bool &default=T;
## Indicates if client activity has been seen, but not yet logged. ## Indicates if client activity has been seen, but not yet logged.
has_client_activity: bool &default=F; has_client_activity: bool &default=F;
@ -58,9 +59,9 @@ export {
type State: record { type State: record {
helo: string &optional; helo: string &optional;
## Count the number of individual messages transmitted during this ## Count the number of individual messages transmitted during
## SMTP session. Note, this is not the number of recipients, but the ## this SMTP session. Note, this is not the number of
## number of message bodies transferred. ## recipients, but the number of message bodies transferred.
messages_transferred: count &default=0; messages_transferred: count &default=0;
pending_messages: set[Info] &optional; pending_messages: set[Info] &optional;

8
scripts/base/protocols/socks/main.bro
View file

@ -9,17 +9,19 @@ export {
type Info: record { type Info: record {
## Time when the proxy connection was first detected. ## Time when the proxy connection was first detected.
ts: time &log; ts: time &log;
## Unique ID for the tunnel - may correspond to connection uid or be non-existent. ## Unique ID for the tunnel - may correspond to connection uid
## or be non-existent.
uid: string &log; uid: string &log;
## The connection's 4-tuple of endpoint addresses/ports. ## The connection's 4-tuple of endpoint addresses/ports.
id: conn_id &log; id: conn_id &log;
## Protocol version of SOCKS. ## Protocol version of SOCKS.
version: count &log; version: count &log;
## Username for the proxy if extracted from the network.. ## Username for the proxy if extracted from the network.
user: string &log &optional; user: string &log &optional;
## Server status for the attempt at using the proxy. ## Server status for the attempt at using the proxy.
status: string &log &optional; status: string &log &optional;
## Client requested SOCKS address. Could be an address, a name or both. ## Client requested SOCKS address. Could be an address, a name
## or both.
request: SOCKS::Address &log &optional; request: SOCKS::Address &log &optional;
## Client requested port. ## Client requested port.
request_p: port &log &optional; request_p: port &log &optional;

8
scripts/base/protocols/ssh/main.bro
View file

@ -25,8 +25,8 @@ export {
uid: string &log; uid: string &log;
## The connection's 4-tuple of endpoint addresses/ports. ## The connection's 4-tuple of endpoint addresses/ports.
id: conn_id &log; id: conn_id &log;
## Indicates if the login was heuristically guessed to be "success", ## Indicates if the login was heuristically guessed to be
## "failure", or "undetermined". ## "success", "failure", or "undetermined".
status: string &log &default="undetermined"; status: string &log &default="undetermined";
## Direction of the connection. If the client was a local host ## Direction of the connection. If the client was a local host
## logging into an external host, this would be OUTBOUND. INBOUND ## logging into an external host, this would be OUTBOUND. INBOUND
@ -39,8 +39,8 @@ export {
server: string &log &optional; server: string &log &optional;
## Amount of data returned from the server. This is currently ## Amount of data returned from the server. This is currently
## the only measure of the success heuristic and it is logged to ## the only measure of the success heuristic and it is logged to
## assist analysts looking at the logs to make their own determination ## assist analysts looking at the logs to make their own
## about the success on a case-by-case basis. ## determination about the success on a case-by-case basis.
resp_size: count &log &default=0; resp_size: count &log &default=0;
## Indicate if the SSH session is done being watched. ## Indicate if the SSH session is done being watched.