mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 14:08:20 +00:00
7e9d48f532
The broxygen-generated files now live in the git repo, have tests that check that they are up-to-date, and a script to re-generate them on-demand.
86 lines
2.6 KiB
ReStructuredText
86 lines
2.6 KiB
ReStructuredText
:tocdepth: 3
|
|
|
|
base/bif/plugins/Bro_NCP.events.bif.bro
|
|
=======================================
|
|
.. bro:namespace:: GLOBAL
|
|
|
|
|
|
:Namespace: GLOBAL
|
|
|
|
Summary
|
|
~~~~~~~
|
|
Events
|
|
######
|
|
======================================== ===================================================
|
|
:bro:id:`ncp_reply`: :bro:type:`event` Generated for NCP replies (Netware Core Protocol).
|
|
:bro:id:`ncp_request`: :bro:type:`event` Generated for NCP requests (Netware Core Protocol).
|
|
======================================== ===================================================
|
|
|
|
|
|
Detailed Interface
|
|
~~~~~~~~~~~~~~~~~~
|
|
Events
|
|
######
|
|
.. bro:id:: ncp_reply
|
|
|
|
:Type: :bro:type:`event` (c: :bro:type:`connection`, frame_type: :bro:type:`count`, length: :bro:type:`count`, req_frame: :bro:type:`count`, req_func: :bro:type:`count`, completion_code: :bro:type:`count`)
|
|
|
|
Generated for NCP replies (Netware Core Protocol).
|
|
|
|
See `Wikipedia <http://en.wikipedia.org/wiki/NetWare_Core_Protocol>`__ for
|
|
more information about the NCP protocol.
|
|
|
|
|
|
:c: The connection.
|
|
|
|
|
|
:frame_type: The frame type, as specified by the protocol.
|
|
|
|
|
|
:length: The length of the request body, excluding the frame header.
|
|
|
|
|
|
:req_frame: The frame type from the corresponding request.
|
|
|
|
|
|
:req_func: The function code from the corresponding request.
|
|
|
|
|
|
:completion_code: The reply's completion code, as specified by the protocol.
|
|
|
|
.. bro:see:: ncp_request
|
|
|
|
.. todo:: Bro's current default configuration does not activate the protocol
|
|
analyzer that generates this event; the corresponding script has not yet
|
|
been ported to Bro 2.x. To still enable this event, one needs to
|
|
register a port for it or add a DPD payload signature.
|
|
|
|
.. bro:id:: ncp_request
|
|
|
|
:Type: :bro:type:`event` (c: :bro:type:`connection`, frame_type: :bro:type:`count`, length: :bro:type:`count`, func: :bro:type:`count`)
|
|
|
|
Generated for NCP requests (Netware Core Protocol).
|
|
|
|
See `Wikipedia <http://en.wikipedia.org/wiki/NetWare_Core_Protocol>`__ for
|
|
more information about the NCP protocol.
|
|
|
|
|
|
:c: The connection.
|
|
|
|
|
|
:frame_type: The frame type, as specified by the protocol.
|
|
|
|
|
|
:length: The length of the request body, excluding the frame header.
|
|
|
|
|
|
:func: The requested function, as specified by the protocol.
|
|
|
|
.. bro:see:: ncp_reply
|
|
|
|
.. todo:: Bro's current default configuration does not activate the protocol
|
|
analyzer that generates this event; the corresponding script has not yet
|
|
been ported to Bro 2.x. To still enable this event, one needs to
|
|
register a port for it or add a DPD payload signature.
|
|
|
|
|