policy/protocols/dhcp/deprecated_events.bro

Bro 2.6 removed certain DHCP events, but scripts in the Bro ecosystem are still relying on those events. As a transition, this script will handle the new event, and generate the old events, which are marked as deprecated. Note: This script should be removed in the next Bro version after 2.6.

Imports:base/protocols/dhcp Source File:/scripts/policy/protocols/dhcp/deprecated_events.bro

Summary

Types

dhcp_msg: record	A DHCP message.
dhcp_router_list: table	A list of router addresses offered by a DHCP server.

Events

dhcp_ack: event &deprecated	Generated for DHCP messages of type DHCPACK (Server to client with configuration parameters, including committed network address).
dhcp_decline: event &deprecated	Generated for DHCP messages of type DHCPDECLINE (Client to server indicating network address is already in use).
dhcp_discover: event &deprecated	Generated for DHCP messages of type DHCPDISCOVER (client broadcast to locate available servers).
dhcp_inform: event &deprecated	Generated for DHCP messages of type DHCPINFORM (Client to server, asking only for local configuration parameters; client already has externally configured network address).
dhcp_nak: event &deprecated	Generated for DHCP messages of type DHCPNAK (Server to client indicating client’s notion of network address is incorrect (e.g., client has moved to new subnet) or client’s lease has expired).
dhcp_offer: event &deprecated	Generated for DHCP messages of type DHCPOFFER (server to client in response to DHCPDISCOVER with offer of configuration parameters).
dhcp_release: event &deprecated	Generated for DHCP messages of type DHCPRELEASE (Client to server relinquishing network address and cancelling remaining lease).
dhcp_request: event &deprecated	Generated for DHCP messages of type DHCPREQUEST (Client message to servers either (a) requesting offered parameters from one server and implicitly declining offers from all others, (b) confirming correctness of previously allocated address after, e.g., system reboot, or (c) extending the lease on a particular network address.)

Detailed Interface

Types

dhcp_msg

Type:

record

op: count

Message OP code. 1 = BOOTREQUEST, 2 = BOOTREPLY

m_type: count

The type of DHCP message.

xid: count

Transaction ID of a DHCP session.

h_addr: string

Hardware address of the client.

ciaddr: addr

Original IP address of the client.

yiaddr: addr

IP address assigned to the client.

A DHCP message.

Note

This type is included to support the deprecated events dhcp_ack, dhcp_decline, dhcp_discover, dhcp_inform, dhcp_nak, dhcp_offer, dhcp_release and dhcp_request and is thus similarly deprecated itself. Use dhcp_message instead.

See also: dhcp_message, dhcp_ack, dhcp_decline, dhcp_discover, dhcp_inform, dhcp_nak, dhcp_offer, dhcp_release, dhcp_request

dhcp_router_list

Type:table [count] of addr

A list of router addresses offered by a DHCP server.

Note

This type is included to support the deprecated events dhcp_ack and dhcp_offer and is thus similarly deprecated itself. Use dhcp_message instead.

See also: dhcp_message, dhcp_ack, dhcp_offer

Events

dhcp_ack

Type:event (c: connection, msg: dhcp_msg, mask: addr, router: dhcp_router_list, lease: interval, serv_addr: addr, host_name: string) Attributes:&deprecated

Generated for DHCP messages of type DHCPACK (Server to client with configuration parameters, including committed network address).

C:The connection record describing the underlying UDP flow. Msg:The parsed type-independent part of the DHCP message. Mask:The subnet mask specified by the message. Router:The list of routers specified by the message. Lease:The least interval specified by the message. Serv_addr:The server address specified by the message. Host_name:Optional host name value. May differ from the host name requested from the client.

See also: dhcp_message, dhcp_discover, dhcp_offer, dhcp_request, dhcp_decline, dhcp_nak, dhcp_release, dhcp_inform

Note

This event has been deprecated, and will be removed in the next version. Use dhcp_message instead.

dhcp_decline

Type:event (c: connection, msg: dhcp_msg, host_name: string) Attributes:&deprecated

Generated for DHCP messages of type DHCPDECLINE (Client to server indicating network address is already in use).

C:The connection record describing the underlying UDP flow. Msg:The parsed type-independent part of the DHCP message. Host_name:Optional host name value.

See also: dhcp_message, dhcp_discover, dhcp_offer, dhcp_request, dhcp_ack, dhcp_nak, dhcp_release, dhcp_inform

Note

This event has been deprecated, and will be removed in the next version. Use dhcp_message instead.

Note

Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.

dhcp_discover

Type:event (c: connection, msg: dhcp_msg, req_addr: addr, host_name: string) Attributes:&deprecated

Generated for DHCP messages of type DHCPDISCOVER (client broadcast to locate available servers).

C:The connection record describing the underlying UDP flow. Msg:The parsed type-independent part of the DHCP message. Req_addr:The specific address requested by the client. Host_name:The value of the host name option, if specified by the client.

See also: dhcp_message, dhcp_discover, dhcp_offer, dhcp_request, dhcp_decline, dhcp_ack, dhcp_nak, dhcp_release, dhcp_inform

Note

This event has been deprecated, and will be removed in the next version. Use dhcp_message instead.

Note

Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.

dhcp_inform

Type:event (c: connection, msg: dhcp_msg, host_name: string) Attributes:&deprecated

Generated for DHCP messages of type DHCPINFORM (Client to server, asking only for local configuration parameters; client already has externally configured network address).

C:The connection record describing the underlying UDP flow. Msg:The parsed type-independent part of the DHCP message. Host_name:The value of the host name option, if specified by the client.

See also: dhcp_message, dhcp_discover, dhcp_offer, dhcp_request, dhcp_decline, dhcp_ack, dhcp_nak, dhcp_release

Note

This event has been deprecated, and will be removed in the next version. Use dhcp_message instead.

Note

Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.

dhcp_nak

Type:event (c: connection, msg: dhcp_msg, host_name: string) Attributes:&deprecated

Generated for DHCP messages of type DHCPNAK (Server to client indicating client’s notion of network address is incorrect (e.g., client has moved to new subnet) or client’s lease has expired).

C:The connection record describing the underlying UDP flow. Msg:The parsed type-independent part of the DHCP message. Host_name:Optional host name value.

See also: dhcp_message, dhcp_discover, dhcp_offer, dhcp_request, dhcp_decline, dhcp_ack, dhcp_release, dhcp_inform

Note

This event has been deprecated, and will be removed in the next version. Use dhcp_message instead.

Note

Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.

dhcp_offer

Type:event (c: connection, msg: dhcp_msg, mask: addr, router: dhcp_router_list, lease: interval, serv_addr: addr, host_name: string) Attributes:&deprecated

Generated for DHCP messages of type DHCPOFFER (server to client in response to DHCPDISCOVER with offer of configuration parameters).

C:The connection record describing the underlying UDP flow. Msg:The parsed type-independent part of the DHCP message. Mask:The subnet mask specified by the message. Router:The list of routers specified by the message. Lease:The least interval specified by the message. Serv_addr:The server address specified by the message. Host_name:Optional host name value. May differ from the host name requested from the client.

See also: dhcp_message, dhcp_discover, dhcp_request, dhcp_decline, dhcp_ack, dhcp_nak, dhcp_release, dhcp_inform

Note

This event has been deprecated, and will be removed in the next version. Use dhcp_message instead.

Note

Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.

dhcp_release

Type:event (c: connection, msg: dhcp_msg, host_name: string) Attributes:&deprecated

Generated for DHCP messages of type DHCPRELEASE (Client to server relinquishing network address and cancelling remaining lease).

C:The connection record describing the underlying UDP flow. Msg:The parsed type-independent part of the DHCP message. Host_name:The value of the host name option, if specified by the client.

See also: dhcp_message, dhcp_discover, dhcp_offer, dhcp_request, dhcp_decline, dhcp_ack, dhcp_nak, dhcp_inform

Note

This event has been deprecated, and will be removed in the next version. Use dhcp_message instead.

dhcp_request

Type:event (c: connection, msg: dhcp_msg, req_addr: addr, serv_addr: addr, host_name: string) Attributes:&deprecated

Generated for DHCP messages of type DHCPREQUEST (Client message to servers either (a) requesting offered parameters from one server and implicitly declining offers from all others, (b) confirming correctness of previously allocated address after, e.g., system reboot, or (c) extending the lease on a particular network address.)

C:The connection record describing the underlying UDP flow. Msg:The parsed type-independent part of the DHCP message. Req_addr:The client address specified by the message. Serv_addr:The server address specified by the message. Host_name:The value of the host name option, if specified by the client.

See also: dhcp_message, dhcp_discover, dhcp_offer, dhcp_decline, dhcp_ack, dhcp_nak, dhcp_release, dhcp_inform

Note

This event has been deprecated, and will be removed in the next version. Use dhcp_message instead.

Note

Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.