base/bif/plugins/Bro_POP3.events.bif.bro
-
GLOBAL
| Namespace: | GLOBAL |
|---|---|
| Source File: | /scripts/base/bif/plugins/Bro_POP3.events.bif.bro |
Summary
Events
pop3_data: event |
Generated for server-side multi-line responses on POP3 connections. |
pop3_login_failure: event |
Generated for unsuccessful authentications on POP3 connections. |
pop3_login_success: event |
Generated for successful authentications on POP3 connections. |
pop3_reply: event |
Generated for server-side replies to commands on POP3 connections. |
pop3_request: event |
Generated for client-side commands on POP3 connections. |
pop3_starttls: event |
Generated when a POP3 connection goes encrypted. |
pop3_unexpected: event |
Generated for errors encountered on POP3 sessions. |
Detailed Interface
Events
-
pop3_data Type: event(c:connection, is_orig:bool, data:string)Generated for server-side multi-line responses on POP3 connections. POP3 connections use multi-line responses to send bulk data, such as the actual mails. This event is generated once for each line that’s part of such a response.
See Wikipedia for more information about the POP3 protocol.
C: The connection. Is_orig: True if the data was sent by the originator of the TCP connection. Data: The data sent. See also:
pop3_login_failure,pop3_login_success,pop3_reply,pop3_request,pop3_unexpectedTodo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
-
pop3_login_failure Type: event(c:connection, is_orig:bool, user:string, password:string)Generated for unsuccessful authentications on POP3 connections.
See Wikipedia for more information about the POP3 protocol.
C: The connection. Is_orig: Always false. User: The user name attempted for authentication. The event is only generated if a non-empty user name was used. Password: The password attempted for authentication. See also:
pop3_data,pop3_login_success,pop3_reply,pop3_request,pop3_unexpectedTodo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
-
pop3_login_success Type: event(c:connection, is_orig:bool, user:string, password:string)Generated for successful authentications on POP3 connections.
See Wikipedia for more information about the POP3 protocol.
C: The connection. Is_orig: Always false. User: The user name used for authentication. The event is only generated if a non-empty user name was used. Password: The password used for authentication. See also:
pop3_data,pop3_login_failure,pop3_reply,pop3_request,pop3_unexpectedTodo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
-
pop3_reply Type: event(c:connection, is_orig:bool, cmd:string, msg:string)Generated for server-side replies to commands on POP3 connections.
See Wikipedia for more information about the POP3 protocol.
C: The connection. Is_orig: True if the command was sent by the originator of the TCP connection. Cmd: The success indicator sent by the server. This corresponds to the first token on the line sent, and should be either OKorERR.Msg: The textual description the server sent along with cmd. See also:
pop3_data,pop3_login_failure,pop3_login_success,pop3_request,pop3_unexpectedTodo
This event is receiving odd parameters, should unify.
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
-
pop3_request Type: event(c:connection, is_orig:bool, command:string, arg:string)Generated for client-side commands on POP3 connections.
See Wikipedia for more information about the POP3 protocol.
C: The connection. Is_orig: True if the command was sent by the originator of the TCP connection. Command: The command sent. Arg: The argument to the command. See also:
pop3_data,pop3_login_failure,pop3_login_success,pop3_reply,pop3_unexpectedTodo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
-
pop3_starttls Type: event(c:connection)Generated when a POP3 connection goes encrypted. While POP3 is by default a clear-text protocol, extensions exist to switch to encryption. This event is generated if that happens and the analyzer then stops processing the connection.
See Wikipedia for more information about the POP3 protocol.
C: The connection. See also:
pop3_data,pop3_login_failure,pop3_login_success,pop3_reply,pop3_request,pop3_unexpectedTodo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
-
pop3_unexpected Type: event(c:connection, is_orig:bool, msg:string, detail:string)Generated for errors encountered on POP3 sessions. If the POP3 analyzer finds state transitions that do not conform to the protocol specification, or other situations it can’t handle, it raises this event.
See Wikipedia for more information about the POP3 protocol.
C: The connection. Is_orig: True if the data was sent by the originator of the TCP connection. Msg: A textual description of the situation. Detail: The input that triggered the event. See also:
pop3_data,pop3_login_failure,pop3_login_success,pop3_reply,pop3_requestTodo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
