Cisco Cisco Firepower Management Center 4000 Guía Del Desarrollador
4-65
FireSIGHT eStreamer Integration Guide
Chapter 4 Understanding Discovery & Connection Data Structures
Host Discovery and Connection Data Blocks
The following table describes the fields of the BLOB data block.
List Data Block
The List data block is used to encapsulate a list of series 1 data blocks. For example, if a list of TCP
servers is being transmitted, the Server data blocks containing the data are encapsulated in a List data
block. The List data block has a block type of 11 in the series 1 group of blocks.
servers is being transmitted, the Server data blocks containing the data are encapsulated in a List data
block. The List data block has a block type of 11 in the series 1 group of blocks.
The following diagram shows the basic format of a List data block:
The following table describes the fields of the List data block.
Table 4-29
BLOB Data Block Fields
Field
Data Type
Description
BLOB Block Type uint32
Initiates a BLOB data block. This value is always
10
.
BLOB Block
Length
Length
uint32
Number of bytes in the BLOB data block, including eight bytes for
the BLOB block type and length fields, plus the length of the binary
data that follows.
the BLOB block type and length fields, plus the length of the binary
data that follows.
Binary Data
variable
Contains binary data, typically a server banner.
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
List Block Type (11)
List Block Length
Encapsulated Data Blocks...
Table 4-30
List Data Block Fields
Field
Data Type
Description
List Block Type
uint32
Initiates a List data block. This value is always
11
.
List Block Length
uint32
Number of bytes in the list block and encapsulated data. For
example, if there were three sub-server data blocks included in the
list, the value here would include the number of bytes in the
sub-server blocks, plus eight bytes for the list block header.
example, if there were three sub-server data blocks included in the
list, the value here would include the number of bytes in the
sub-server blocks, plus eight bytes for the list block header.
Encapsulated Data
Blocks
Blocks
variable
Encapsulated data blocks up to the maximum number of bytes in the
list block length.
list block length.