29 lines
912 B
Plaintext
29 lines
912 B
Plaintext
# @TEST-EXEC: zeek -b -C -r $TRACES/dce-rpc/cs_window7-join_stream092.pcap %INPUT > out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
@load base/protocols/dce-rpc
|
|
|
|
event dce_rpc_request(c: connection, fid: count, ctx_id: count, opnum: count, stub_len: count)
|
|
{
|
|
print "dce_rpc_request ", c$id, fid, ctx_id, opnum, stub_len;
|
|
}
|
|
|
|
event dce_rpc_request_stub(c: connection, fid: count, ctx_id: count, opnum: count, stub: string)
|
|
{
|
|
print "dce_rpc_request_stub", c$id, fid, ctx_id, opnum, |stub|;
|
|
print bytestring_to_hexstr(stub);
|
|
}
|
|
|
|
event dce_rpc_response(c: connection, fid: count, ctx_id: count, opnum: count, stub_len: count)
|
|
{
|
|
print "dce_rpc_response ", c$id, fid, ctx_id, opnum, stub_len;
|
|
}
|
|
|
|
event dce_rpc_response_stub(c: connection, fid: count, ctx_id: count, opnum: count, stub: string)
|
|
{
|
|
print "dce_rpc_response_stub", c$id, fid, ctx_id, opnum, |stub|;
|
|
print bytestring_to_hexstr(stub);
|
|
terminate();
|
|
}
|
|
|