Cisco Cisco Firepower Management Center 2000 Entwickleranleitung

Version 5.3

Sourcefire 3D System eStreamer Integration Guide

255

Understanding Discovery & Connection Data Structures

Host Discovery and Connection Data Blocks

Chapter 4

Full Sub-Server Data Block

The Full Sub-Server data block conveys information about a sub-server associated 

with a server detected on a host, and includes information about the sub-server 

such as its vendor and version and any related Sourcefire-VDB and third-party 

vulnerabilities for the sub-server on the host. A sub-server is a loadable module of 

a server that has its own associated vulnerabilities. A Full Host Server data block 

includes a Full Sub-Server data block for each sub-server detected on the host. 

The Full Sub-Server data block has a block type of 51 in the series 1 group of 

blocks.

An asterisk (*) next to a series 1 data block name in the following 

diagram indicates that multiple instances of the data block may occur.

Attribute Type

uint32

Type of affected attribute. Possible values are:
•

0

 — attribute with text as value; this uses 

string data

1

 — attribute with value in range; this uses 

integer data

2

 — attribute with a list of possible values, 

this uses integer data

3

 — attribute with a URL as value; this uses 

string data

4

 — attribute with binary BLOB as value; this 

uses string data

Attribute 

Integer Value

uint32

Integer value for the attribute, if applicable. 

String Block 

Type

uint32

Initiates a String data block containing the 

attribute name. This value is always 0.

String Block 

Length

uint32

Number of bytes in the String data block, 

including the string block type and length 

fields, plus the number of bytes in the attribute 

name.

Attribute Value

string

Value of the attribute.

Attribute Value Data Block Fields (Continued)