Commit graph

3 commits

Author SHA1 Message Date
Jon Siwek
7965dcd041 Convert pcapng test suite files to pcap format
The former isn't supported by default on OpenBSD.
2019-11-08 13:08:06 -08:00
Jon Siwek
2696ca3005 GH-320: Improve RFB (VNC) protocol parsing
Mostly rewrote the parsing logic to support incremental parsing and
to support parsing of client messages.  Though I did not add events
for client messages, that's easy to add later.

Parsing now stops for both client and server if either encounters
any parsing error or invalid state.

After a complete handshake, server messages are no longer parsed.
Support for that is incomplete and not sure it's that useful anyway
since it mostly contains pixel data.
2019-04-03 13:59:03 -07:00
Martin van Hensbergen
849875e8be Analyzer and bro script for RFB protocol (VNC)
This analyzer parses the Remote Frame Buffer
protocol, usually referred to as the 'VNC protocol'.

It supports several dialects (3.3, 3.7, 3.8) and
also handles the Apple Remote Desktop variant.

It will log such facts as client/server versions,
authentication method used, authentication result,
height, width and name of the shared screen.

It also includes two testcases.

Todo: Apple Remote Desktop seems to have some
bytes prepended to the screen name. This is
not interepreted correctly.
2016-04-11 10:35:00 +02:00