Commit graph

11 commits

Author SHA1 Message Date
Johanna Amann
c0e3b8c66f Deprecate rfb_event.
Fixes GH-446
2019-07-03 02:15:34 -07:00
Jon Siwek
a994be9eeb Merge remote-tracking branch 'origin/topic/seth/zeek_init'
* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.
2019-04-19 11:24:29 -07:00
Seth Hall
8cefb9be42 Implement the zeek_init handler.
Implements the change and a test.
2019-04-14 08:37:35 -04:00
Daniel Thayer
18bd74454b Rename all scripts to have ".zeek" file extension 2019-04-11 21:12:40 -05:00
Zhongjie Wang
e31563069b Added missing tcp-state for signature dpd_rfb_server 2018-07-24 14:07:12 -07:00
Daniel Thayer
5745213326 Fix minor typos in documentation of various scripts 2016-11-11 14:08:17 -06:00
Daniel Thayer
2d9127888f Add some missing Bro script documentation
Also fixed a few reST formatting issues.
2016-05-05 16:35:31 -05:00
Seth Hall
9d0899325a Merge remote-tracking branch 'martin/topic/fox/rfb'
* martin/topic/fox/rfb:
  Fixed issue in state machine
  Some styling tweaks
  Implement protocol confirmation
  Analyzer and bro script for RFB protocol (VNC)

* <seth> I also applied a bit of clean up to the base
  script to make it match other scripts better and
  updated tests.
2016-04-12 17:00:06 -04:00
Martin van Hensbergen
034f725f3f Some styling tweaks
- used transient declarations where appropriate
- fixed brackets
- cleaned up some comments
2016-04-11 11:35:36 +02:00
Martin van Hensbergen
04dd65cbaf Implement protocol confirmation
Do not set the service field in the bro script but
use the protocol confirmation paradigm.

Protocol is considered confirmed if both a
succesful client and server banner have been
parsed.
2016-04-11 11:28:22 +02:00
Martin van Hensbergen
849875e8be Analyzer and bro script for RFB protocol (VNC)
This analyzer parses the Remote Frame Buffer
protocol, usually referred to as the 'VNC protocol'.

It supports several dialects (3.3, 3.7, 3.8) and
also handles the Apple Remote Desktop variant.

It will log such facts as client/server versions,
authentication method used, authentication result,
height, width and name of the shared screen.

It also includes two testcases.

Todo: Apple Remote Desktop seems to have some
bytes prepended to the screen name. This is
not interepreted correctly.
2016-04-11 10:35:00 +02:00