5 commits

Author	SHA1	Message	Date
Daniel Thayer	2d9127888f	Add some missing Bro script documentation ... Also fixed a few reST formatting issues.	2016-05-05 16:35:31 -05:00
Seth Hall	9d0899325a	Merge remote-tracking branch 'martin/topic/fox/rfb' ... * martin/topic/fox/rfb: Fixed issue in state machine Some styling tweaks Implement protocol confirmation Analyzer and bro script for RFB protocol (VNC) * <seth> I also applied a bit of clean up to the base script to make it match other scripts better and updated tests.	2016-04-12 17:00:06 -04:00
Martin van Hensbergen	034f725f3f	Some styling tweaks ... - used transient declarations where appropriate - fixed brackets - cleaned up some comments	2016-04-11 11:35:36 +02:00
Martin van Hensbergen	04dd65cbaf	Implement protocol confirmation ... Do not set the service field in the bro script but use the protocol confirmation paradigm. Protocol is considered confirmed if both a succesful client and server banner have been parsed.	2016-04-11 11:28:22 +02:00
Martin van Hensbergen	849875e8be	Analyzer and bro script for RFB protocol (VNC) ... This analyzer parses the Remote Frame Buffer protocol, usually referred to as the 'VNC protocol'. It supports several dialects (3.3, 3.7, 3.8) and also handles the Apple Remote Desktop variant. It will log such facts as client/server versions, authentication method used, authentication result, height, width and name of the shared screen. It also includes two testcases. Todo: Apple Remote Desktop seems to have some bytes prepended to the screen name. This is not interepreted correctly.	2016-04-11 10:35:00 +02:00