base/bif/plugins/Bro_SOCKS.events.bif.bro

GLOBAL
Namespace:GLOBAL
Source File:/scripts/base/bif/plugins/Bro_SOCKS.events.bif.bro

Summary

Events

socks_login_userpass_reply: event Generated when a SOCKS server replies to a username/password login attempt.
socks_login_userpass_request: event Generated when a SOCKS client performs username and password based login.
socks_reply: event Generated when a SOCKS reply is analyzed.
socks_request: event Generated when a SOCKS request is analyzed.

Detailed Interface

Events

socks_login_userpass_reply
Type:event (c: connection, code: count)

Generated when a SOCKS server replies to a username/password login attempt.

C:The parent connection of the proxy.
Code:The response code for the attempted login.
socks_login_userpass_request
Type:event (c: connection, user: string, password: string)

Generated when a SOCKS client performs username and password based login.

C:The parent connection of the proxy.
User:The given username.
Password:The given password.
socks_reply
Type:event (c: connection, version: count, reply: count, sa: SOCKS::Address, p: port)

Generated when a SOCKS reply is analyzed.

C:The parent connection of the proxy.
Version:The version of SOCKS this message used.
Reply:The status reply from the server.
Sa:The address that the server sent the traffic to.
P:The destination port for the proxied traffic.
socks_request
Type:event (c: connection, version: count, request_type: count, sa: SOCKS::Address, p: port, user: string)

Generated when a SOCKS request is analyzed.

C:The parent connection of the proxy.
Version:The version of SOCKS this message used.
Request_type:The type of the request.
Sa:Address that the tunneled traffic should be sent to.
P:The destination port for the proxied traffic.
User:Username given for the SOCKS connection. This is not yet implemented for SOCKSv5.

Copyright 2016, The Bro Project. Last updated on January 10, 2019. Created using Sphinx 1.7.5.