mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
d72f5458f1
* 'rdp_client_cluster_data' of https://github.com/neslog/zeek: Fixing types. Correcting types. Removing misc data from Client Cluster data trying to assign values. Adding options field to RDP::ClientChannelDef Adding Client Cluster Data Adjustments: - Reformatting - Added comments - Changed the REDIRECTED_SESSIONID_FIELD_VALID field to a bool
22 lines
842 B
Text
22 lines
842 B
Text
# @TEST-EXEC: zeek -r $TRACES/rdp/rdp-proprietary-encryption.pcap %INPUT >out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
@load base/protocols/rdp
|
|
|
|
event rdp_client_cluster_data(c: connection, data: RDP::ClientClusterData)
|
|
{
|
|
print "RDP Client Cluster Data";
|
|
print fmt("Flags: %08x",data$flags);
|
|
print fmt("RedirSessionId: %08x",data$redir_session_id);
|
|
print fmt("Redirection Supported: %08x",data$redir_supported);
|
|
print fmt("ServerSessionRedirectionVersionMask: %08x",data$svr_session_redir_version_mask);
|
|
print fmt("RedirectionSessionIDFieldValid: %08x",data$redir_sessionid_field_valid);
|
|
print fmt("RedirectedSmartCard: %08x",data$redir_smartcard);
|
|
}
|
|
|
|
event rdp_client_network_data(c: connection, channels: RDP::ClientChannelList)
|
|
{
|
|
print "RDP Client Channel List Options";
|
|
for ( i in channels )
|
|
print fmt("%08x", channels[i]$options);
|
|
}
|