Namespace: | GLOBAL |
---|---|
Source File: | /scripts/base/bif/plugins/Bro_SMB.events.bif.bro |
smb_com_close: event | Generated for SMB/CIFS messages of type close. |
smb_com_generic_andx: event | Generated for SMB/CIFS messages of type generic andx. |
smb_com_logoff_andx: event | Generated for SMB/CIFS messages of type logoff andx. |
smb_com_negotiate: event | Generated for SMB/CIFS messages of type negotiate. |
smb_com_negotiate_response: event | Generated for SMB/CIFS messages of type negotiate response. |
smb_com_nt_create_andx: event | Generated for SMB/CIFS messages of type nt create andx. |
smb_com_read_andx: event | Generated for SMB/CIFS messages of type read andx. |
smb_com_setup_andx: event | Generated for SMB/CIFS messages of type setup andx. |
smb_com_trans_mailslot: event | Generated for SMB/CIFS messages of type transaction mailslot. |
smb_com_trans_pipe: event | Generated for SMB/CIFS messages of type transaction pipe. |
smb_com_trans_rap: event | Generated for SMB/CIFS messages of type transaction rap. |
smb_com_transaction: event | Generated for SMB/CIFS messages of type nt transaction. |
smb_com_transaction2: event | Generated for SMB/CIFS messages of type nt transaction 2. |
smb_com_tree_connect_andx: event | Generated for SMB/CIFS messages of type tree connect andx. |
smb_com_tree_disconnect: event | Generated for SMB/CIFS messages of type tree disconnect. |
smb_com_write_andx: event | Generated for SMB/CIFS messages of type read andx. |
smb_error: event | Generated for SMB/CIFS messages that indicate an error. |
smb_get_dfs_referral: event | Generated for SMB/CIFS messages of type get dfs referral. |
smb_message: event | Generated for all SMB/CIFS messages. |
Type: | event (c: connection, hdr: smb_hdr) |
---|
Generated for SMB/CIFS messages of type close.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr) |
---|
Generated for SMB/CIFS messages of type generic andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_close, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr) |
---|
Generated for SMB/CIFS messages of type logoff andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_close, smb_com_generic_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr) |
---|
Generated for SMB/CIFS messages of type negotiate.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, dialect_index: count) |
---|
Generated for SMB/CIFS messages of type negotiate response.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Dialect_index: | The dialect indicated in the message. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, name: string) |
---|
Generated for SMB/CIFS messages of type nt create andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Name: | The name attribute specified in the message. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, data: string) |
---|
Generated for SMB/CIFS messages of type read andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Data: | Always empty. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr) |
---|
Generated for SMB/CIFS messages of type setup andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool) |
---|
Generated for SMB/CIFS messages of type transaction mailslot.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Trans: | The parsed transaction header. |
Data: | The raw transaction data. |
Is_orig: | True if the message was sent by the originator of the connection. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool) |
---|
Generated for SMB/CIFS messages of type transaction pipe.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Trans: | The parsed transaction header. |
Data: | The raw transaction data. |
Is_orig: | True if the message was sent by the originator of the connection. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool) |
---|
Generated for SMB/CIFS messages of type transaction rap.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Trans: | The parsed transaction header. |
Data: | The raw transaction data. |
Is_orig: | True if the message was sent by the originator of the connection. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool) |
---|
Generated for SMB/CIFS messages of type nt transaction.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Trans: | The parsed transaction header. |
Data: | The raw transaction data. |
Is_orig: | True if the message was sent by the originator of the connection. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool) |
---|
Generated for SMB/CIFS messages of type nt transaction 2.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Trans: | The parsed transaction header. |
Data: | The raw transaction data. |
Is_orig: | True if the message was sent by the originator of the connection. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, path: string, service: string) |
---|
Generated for SMB/CIFS messages of type tree connect andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Path: | The path attribute specified in the message. |
Service: | The service attribute specified in the message. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr) |
---|
Generated for SMB/CIFS messages of type tree disconnect.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, data: string) |
---|
Generated for SMB/CIFS messages of type read andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Data: | Always empty. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_error, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, cmd: count, cmd_str: string, data: string) |
---|
Generated for SMB/CIFS messages that indicate an error. This event is triggered by an SMB header including a status that signals an error.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Cmd: | The SMB command code. |
Cmd_str: | A string mnemonic of the SMB command code. |
Data: | The raw SMB message body, i.e., the data starting after the SMB header. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_get_dfs_referral, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, max_referral_level: count, file_name: string) |
---|
Generated for SMB/CIFS messages of type get dfs referral.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Max_referral_level: | |
The max_referral_level attribute specified in the message. | |
File_name: | The filene_name attribute specified in the message. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
Type: | event (c: connection, hdr: smb_hdr, is_orig: bool, cmd: string, body_length: count, body: string) |
---|
Generated for all SMB/CIFS messages.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Is_orig: | True if the message was sent by the originator of the underlying transport-level connection. |
Cmd: | A string mnemonic of the SMB command code. |
Body_length: | The length of the SMB message body, i.e. the data starting after the SMB header. |
Body: | The raw SMB message body, i.e., the data starting after the SMB header. |
See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.