:tocdepth: 3

base/bif/plugins/Bro_DHCP.events.bif.bro
========================================
.. bro:namespace:: GLOBAL


:Namespace: GLOBAL
:Source File: :download:`/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro`

Summary
~~~~~~~
Events
######
========================================== ===================================================================================
:bro:id:`dhcp_ack`: :bro:type:`event`      Generated for DHCP messages of type *DHCPACK* (Server to client with configuration
                                           parameters, including committed network address).
:bro:id:`dhcp_decline`: :bro:type:`event`  Generated for DHCP messages of type *DHCPDECLINE* (Client to server indicating
                                           network address is already in use).
:bro:id:`dhcp_discover`: :bro:type:`event` Generated for DHCP messages of type *DHCPDISCOVER* (client broadcast to locate
                                           available servers).
:bro:id:`dhcp_inform`: :bro:type:`event`   Generated for DHCP messages of type *DHCPINFORM* (Client to server, asking only for
                                           local configuration parameters; client already has externally configured network
                                           address).
:bro:id:`dhcp_nak`: :bro:type:`event`      Generated for DHCP messages of type *DHCPNAK* (Server to client indicating client's
                                           notion of network address is incorrect (e.g., client has moved to new subnet) or
                                           client's lease has expired).
:bro:id:`dhcp_offer`: :bro:type:`event`    Generated for DHCP messages of type *DHCPOFFER* (server to client in response to
                                           DHCPDISCOVER with offer of configuration parameters).
:bro:id:`dhcp_release`: :bro:type:`event`  Generated for DHCP messages of type *DHCPRELEASE* (Client to server relinquishing
                                           network address and cancelling remaining lease).
:bro:id:`dhcp_request`: :bro:type:`event`  Generated for DHCP messages of type *DHCPREQUEST* (Client message to servers either
                                           (a) requesting offered parameters from one server and implicitly declining offers
                                           from all others, (b) confirming correctness of previously allocated address after,
                                           e.g., system reboot, or (c) extending the lease on a particular network address.)
========================================== ===================================================================================


Detailed Interface
~~~~~~~~~~~~~~~~~~
Events
######
.. bro:id:: dhcp_ack

   :Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dhcp_msg`, mask: :bro:type:`addr`, router: :bro:type:`dhcp_router_list`, lease: :bro:type:`interval`, serv_addr: :bro:type:`addr`, host_name: :bro:type:`string`)

   Generated for DHCP messages of type *DHCPACK* (Server to client with configuration
   parameters, including committed network address).
   

   :c: The connection record describing the underlying UDP flow.
   

   :msg: The parsed type-independent part of the DHCP message.
   

   :mask: The subnet mask specified by the message.
   

   :router: The list of routers specified by the message.
   

   :lease: The least interval specified by the message.
   

   :serv_addr: The server address specified by the message.
   

   :host_name: The value of the host name option, if specified by the client.
   
   .. bro:see:: dhcp_discover dhcp_offer dhcp_request dhcp_decline dhcp_nak
                dhcp_release dhcp_inform
   

.. bro:id:: dhcp_decline

   :Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dhcp_msg`, host_name: :bro:type:`string`)

   Generated for DHCP messages of type *DHCPDECLINE* (Client to server indicating
   network address is already in use).
   

   :c: The connection record describing the underlying UDP flow.
   

   :msg: The parsed type-independent part of the DHCP message.
   

   :host_name: The value of the host name option, if specified by the client.
   
   .. bro:see:: dhcp_discover dhcp_offer dhcp_request dhcp_ack dhcp_nak
                dhcp_release dhcp_inform
   
   .. note:: Bro does not support broadcast packets (as used by the DHCP
      protocol). It treats broadcast addresses just like any other and
      associates packets into transport-level flows in the same way as usual.
   

.. bro:id:: dhcp_discover

   :Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dhcp_msg`, req_addr: :bro:type:`addr`, host_name: :bro:type:`string`)

   Generated for DHCP messages of type *DHCPDISCOVER* (client broadcast to locate
   available servers).
   

   :c: The connection record describing the underlying UDP flow.
   

   :msg: The parsed type-independent part of the DHCP message.
   

   :req_addr: The specific address requested by the client.
   

   :host_name: The value of the host name option, if specified by the client.
   
   .. bro:see:: dhcp_discover dhcp_offer dhcp_request dhcp_decline dhcp_ack dhcp_nak
                dhcp_release dhcp_inform
   
   .. note:: Bro does not support broadcast packets (as used by the DHCP
      protocol). It treats broadcast addresses just like any other and
      associates packets into transport-level flows in the same way as usual.
   

.. bro:id:: dhcp_inform

   :Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dhcp_msg`, host_name: :bro:type:`string`)

   Generated for DHCP messages of type *DHCPINFORM* (Client to server, asking only for
   local configuration parameters; client already has externally configured network
   address).
   

   :c: The connection record describing the underlying UDP flow.
   

   :msg: The parsed type-independent part of the DHCP message.
   

   :host_name: The value of the host name option, if specified by the client.
   
   .. bro:see:: dhcp_discover dhcp_offer dhcp_request dhcp_decline dhcp_ack dhcp_nak
                dhcp_release
   
   .. note:: Bro does not support broadcast packets (as used by the DHCP
      protocol). It treats broadcast addresses just like any other and
      associates packets into transport-level flows in the same way as usual.
   

.. bro:id:: dhcp_nak

   :Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dhcp_msg`, host_name: :bro:type:`string`)

   Generated for DHCP messages of type *DHCPNAK* (Server to client indicating client's
   notion of network address is incorrect (e.g., client has moved to new subnet) or
   client's lease has expired).
   

   :c: The connection record describing the underlying UDP flow.
   

   :msg: The parsed type-independent part of the DHCP message.
   

   :host_name: The value of the host name option, if specified by the client.
   
   .. bro:see:: dhcp_discover dhcp_offer dhcp_request dhcp_decline dhcp_ack dhcp_release
                dhcp_inform
   
   .. note:: Bro does not support broadcast packets (as used by the DHCP
      protocol). It treats broadcast addresses just like any other and
      associates packets into transport-level flows in the same way as usual.
   

.. bro:id:: dhcp_offer

   :Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dhcp_msg`, mask: :bro:type:`addr`, router: :bro:type:`dhcp_router_list`, lease: :bro:type:`interval`, serv_addr: :bro:type:`addr`, host_name: :bro:type:`string`)

   Generated for DHCP messages of type *DHCPOFFER* (server to client in response to
   DHCPDISCOVER with offer of configuration parameters).
   

   :c: The connection record describing the underlying UDP flow.
   

   :msg: The parsed type-independent part of the DHCP message.
   

   :mask: The subnet mask specified by the message.
   

   :router: The list of routers specified by the message.
   

   :lease: The least interval specified by the message.
   

   :serv_addr: The server address specified by the message.
   

   :host_name: The value of the host name option, if specified by the client.
   
   .. bro:see:: dhcp_discover dhcp_request dhcp_decline dhcp_ack dhcp_nak
                dhcp_release dhcp_inform
   
   .. note:: Bro does not support broadcast packets (as used by the DHCP
      protocol). It treats broadcast addresses just like any other and
      associates packets into transport-level flows in the same way as usual.
   

.. bro:id:: dhcp_release

   :Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dhcp_msg`, host_name: :bro:type:`string`)

   Generated for DHCP messages of type *DHCPRELEASE* (Client to server relinquishing
   network address and cancelling remaining lease).
   

   :c: The connection record describing the underlying UDP flow.
   

   :msg: The parsed type-independent part of the DHCP message.
   

   :host_name: The value of the host name option, if specified by the client.
   
   .. bro:see:: dhcp_discover dhcp_offer dhcp_request dhcp_decline dhcp_ack dhcp_nak
                dhcp_inform
   

.. bro:id:: dhcp_request

   :Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dhcp_msg`, req_addr: :bro:type:`addr`, serv_addr: :bro:type:`addr`, host_name: :bro:type:`string`)

   Generated for DHCP messages of type *DHCPREQUEST* (Client message to servers either
   (a) requesting offered parameters from one server and implicitly declining offers
   from all others, (b) confirming correctness of previously allocated address after,
   e.g., system reboot, or (c) extending the lease on a particular network address.)
   

   :c: The connection record describing the underlying UDP flow.
   

   :msg: The parsed type-independent part of the DHCP message.
   

   :req_addr: The client address specified by the message.
   

   :serv_addr: The server address specified by the message.
   

   :host_name: The value of the host name option, if specified by the client.
   
   .. bro:see:: dhcp_discover dhcp_offer dhcp_decline dhcp_ack dhcp_nak
                dhcp_release dhcp_inform
   
   .. note:: Bro does not support broadcast packets (as used by the DHCP
      protocol). It treats broadcast addresses just like any other and
      associates packets into transport-level flows in the same way as usual.
   


