base/bif/plugins/Bro_SOCKS.events.bif.bro

GLOBAL

Namespace:GLOBAL Source File:/scripts/base/bif/plugins/Bro_SOCKS.events.bif.bro

Summary

Events

socks_reply: event	Generated when a SOCKS reply is analyzed.
socks_request: event	Generated when a SOCKS request is analyzed.

Detailed Interface

Events

socks_reply

Type:event (c: connection, version: count, reply: count, sa: SOCKS::Address, p: port)

Generated when a SOCKS reply is analyzed.

C:The parent connection of the proxy. Version:The version of SOCKS this message used. Reply:The status reply from the server. Sa:The address that the server sent the traffic to. P:The destination port for the proxied traffic.

socks_request

Type:event (c: connection, version: count, request_type: count, sa: SOCKS::Address, p: port, user: string)

Generated when a SOCKS request is analyzed.

C:The parent connection of the proxy. Version:The version of SOCKS this message used. Request_type:The type of the request. Sa:Address that the tunneled traffic should be sent to. P:The destination port for the proxied traffic. User:Username given for the SOCKS connection. This is not yet implemented for SOCKSv5.