Cisco Cisco Firepower Management Center 4000 Entwickleranleitung
2-7
FireSIGHT eStreamer Integration Guide
Chapter 2 Understanding the eStreamer Application Protocol
Null Message Format
eStreamer Message Header
All eStreamer messages start with the message header illustrated in the graphic below. The following
table explains the fields.
table explains the fields.
Null Message Format
Both the client application and the eStreamer service send null messages. The null message has a type
of 0 and contains no data after the message header.
of 0 and contains no data after the message header.
The client sends a null message to the eStreamer server to indicate readiness to accept more data. The
eStreamer service sends null messages to the client to keep the connection alive when no data is being
transmitted. The message length value for null messages is always set to
eStreamer service sends null messages to the client to keep the connection alive when no data is being
transmitted. The message length value for null messages is always set to
0
.
2051
Streaming
Information
Information
The eStreamer service uses this message type in extended
requests to advertise the list of services available to the
client. For information, see
requests to advertise the list of services available to the
client. For information, see
4002
Message Bundle
The eStreamer service uses this message type to package
messages that it streams to clients. For information, see
messages that it streams to clients. For information, see
Table 2-2
eStreamer Message Types (continued)
Message Type
Name
Description
Byte
0
1
2
3
Bit
0 1 2 3 4
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Header Version
Message Type
Message Length
Table 2-3
Standard eStreamer Message Header Fields
Field
Data Type
Description
Header Version
uint16
Indicates the version of the header used on the message. For the
current version of eStreamer, this value is always 1.
current version of eStreamer, this value is always 1.
Message Type
uint16
Indicates the type of message transmitted. For the list of current
values, see
values, see
Message Length
uint32
Indicates the length of the content that follows, and excludes the
bytes in the message header itself. A message with a header and no
data has a message length of zero.
bytes in the message header itself. A message with a header and no
data has a message length of zero.