Cisco Cisco Firepower Management Center 2000 Developer's Guide
3-15
FireSIGHT System Host Input API Guide
Chapter 3 Using the Host Input Import Tool
Host Input Import Syntax
Protocol Functions
You can use the protocol functions to update protocol information for hosts in the network map.
For more information, see the following sections:
•
•
DeleteProtocol
You can use the
DeleteProtocol
function to remove a protocol from the specified IP or MAC host.
Use this syntax:
DeleteProtocol, ip_address, mac_address, proto, type
AddProtocol
You can use the
AddProtocol
function to add either a network or transport protocol to an existing host
in the network map. You can supply either a protocol ID, a transport protocol name that exists in the
/etc/protocols
file on your Defense Center or a network protocol name from
Note
You cannot add transport protocols to MAC-only hosts.
Use this syntax:
AddProtocol, ip_address, mac_address, proto, type
Table 3-11
DeleteProtocol Fields
Field
Description
Required
Values
ip_address
Indicates the string containing
the IP address or addresses for
the affected host or hosts.
the IP address or addresses for
the affected host or hosts.
Yes (unless MAC
addresses are
provided)
addresses are
provided)
A comma-separated list of IP addresses, CIDR blocks,
and ranges of IP addresses.
and ranges of IP addresses.
mac_address
Indicates the list of MAC
addresses for the affected host or
hosts.
addresses for the affected host or
hosts.
Yes (unless IP
addresses are
provided)
addresses are
provided)
A list of MAC address strings, with or without
separating colons.
separating colons.
proto
Indicates the identification string
or name of the protocol to be
deleted.
or name of the protocol to be
deleted.
Yes
Valid protocol names consisting of alphanumeric
characters or spaces. For transport protocols
(
characters or spaces. For transport protocols
(
“xport”
), protocols listed in the
/etc/protocols
file
are acceptable. For network protocols (“
net
”), see
.
type
Indicates the type of protocol to
be deleted.
be deleted.
Yes
“xport”
or
“net”