Cisco Cisco Firepower Management Center 4000 Developer's Guide
Version 5.3
Sourcefire 3D System eStreamer Integration Guide
123
Understanding Intrusion and Correlation Data Structures
Understanding Series 2 Data Blocks
Chapter 3
The
BLOB Data Block Fields
table describes the fields of the BLOB data block.
List Data Block
The eStreamer service uses the List data block to encapsulate a list of data
blocks. For example, eStreamer can use the List data block to send a list of TCP
servers, each of which is itself a data block. The List data block has a block type of
2 in the series 2 group of blocks.
The following diagram shows the basic format of a List data block:
The following diagram shows the basic format of a List data block:
BLOB Data Block Fields
F
IELD
D
ATA
T
YPE
D
ESCRIPTION
Data Block
Type
uint32
Initiates a BLOB data block. This value is always
1.
Data Block
Length
uint32
Number of bytes in the BLOB data block,
including eight bytes for the BLOB block type and
length fields, plus the length of the binary data
that follows.
Binary Data
variable
Contains binary data such as a server banner.
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Block Type (2)
Block Length
Encapsulated Data Blocks...