Cisco Cisco Firepower Management Center 2000 Entwickleranleitung
Version 5.3
Sourcefire 3D System eStreamer Integration Guide
208
Understanding Discovery & Connection Data Structures
Metadata for Discovery Events
Chapter 4
New Transport Protocol Message
A New Transport Protocol event message has a standard discovery event header
(as documented in
on page 198) and a one-byte
field for the transport protocol number (using values described in the
Client Application Messages
New Client Application, Client Application Update, and Client Application Timeout
events have the same format and contain a standard discovery event header (as
on page 198) followed by a Client
page 334). The discovery event header has a different record type, event type,
and event subtype, depending on the event transmitted.
IMPORTANT!
The Client Application data block differs depending on the system
version that created the message. For information on the legacy version of the
Client Application data block, see
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Discovery Event Header
Transport Protocol
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Discovery Event Header
Client Application Data Block