Руководство Разработчика для Cisco Cisco Firepower Management Center 4000

Скачать
Страница из 536
 
4-148
FireSIGHT eStreamer Integration Guide
 
Chapter 4      Understanding Discovery & Connection Data Structures 
  Host Discovery and Connection Data Blocks
The following table describes the fields of the host profile data block returned by 5.2+.
Client App Data
VLAN ID, cont.
VLAN Type
VLAN Priority
Generic List Block 
Type (31)
List of Client
Applications
Generic List Block Type (31), cont.
Generic List Block 
Length
Generic List Block Length, cont.
Client Application 
Data Blocks
NetBIOS 
Name
String Block Type (0)
String Block Length
NetBIOS String Data...
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Table 4-81
Host Profile Data Block 5.2+ Fields 
Field
Data Type
Description
Host Profile 
Block Type
uint32
Initiates the Host Profile data block for 5.2+. This value is always 
139
.
Host Profile 
Block Length
uint32
Number of bytes in the Host Profile data block, including eight bytes 
for the host profile block type and length fields, plus the number of 
bytes included in the host profile data that follows.
IP Address
uint8(16)
IP Address of the host. This can be IPv4 or IPv6.
Hops
uint8
Number of hops from the host to the device.
Primary/ 
Secondary
uint8
Indicates whether the host is in the primary or secondary network of 
the device that detected it:
  •
0
 — host is in the primary network.
  •
1
 — host is in the secondary network.
Generic List 
Block Type
uint32
Initiates a Generic List data block comprising Operating System 
Fingerprint data blocks conveying fingerprint data identified using a 
server fingerprint. This value is always 
31
.
Generic List 
Block Length
uint32
Number of bytes in the Generic List data block, including the list 
header and all encapsulated Operating System Fingerprint data 
blocks.
Operating 
System 
Fingerprint 
(Server 
Fingerprint) Data 
Blocks *
variable
Operating System Fingerprint data blocks containing information 
about the operating system on a host identified using a server 
fingerprint. See 
 for a description of this data block.