Cisco Cisco Firepower Management Center 4000 Guía Del Desarrollador

Descargar
Página de 536
 
B-164
FireSIGHT eStreamer Integration Guide
 
Appendix B      Understanding Legacy Data Structures 
  Legacy Host Data Structures
The following table describes the fields of the host profile data block returned by version 5.1.x
Client App Data
VLAN ID, cont.
VLAN Type
VLAN Priority
Generic List Block 
Type (31)
List of Client
Applications
Generic List Block Type (31), cont.
Generic List Block 
Length
Generic List Block Length, cont.
Client Application 
Data Blocks
NetBIOS 
Name
String Block Type (0)
String Block Length
NetBIOS String Data...
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Table B-34
Host Profile Data Block 5.1.x Fields 
Field
Data Type
Description
Host Profile 
Block Type
uint32
Initiates the Host Profile data block for 5.1.x. This value is always 
132
.
Host Profile 
Block Length
uint32
Number of bytes in the Host Profile data block, including eight bytes 
for the host profile block type and length fields, plus the number of 
bytes included in the host profile data that follows.
IP Address
uint8[4]
IP address of the host described in the profile, in IP address octets.
Hops
uint8
Number of hops from the host to the device.
Primary/ 
Secondary
uint8
Indicates whether the host is in the primary or secondary network of 
the device that detected it:
  •
0
 - host is in the primary network.
  •
1
 - host is in the secondary network.
Generic List 
Block Type
uint32
Initiates a Generic List data block comprising Operating System 
Fingerprint data blocks conveying fingerprint data identified using a 
server fingerprint. This value is always 
31
.
Generic List 
Block Length
uint32
Number of bytes in the Generic List data block, including the list 
header and all encapsulated Operating System Fingerprint data 
blocks.
Operating 
System 
Fingerprint 
(Server 
Fingerprint) Data 
Blocks *
variable
Operating System Fingerprint data blocks containing information 
about the operating system on a host identified using a server 
fingerprint. See 
 for a description of this data block.