base/bif/plugins/Bro_ARP.events.bif.bro

GLOBAL

Namespace:GLOBAL Source File:/scripts/base/bif/plugins/Bro_ARP.events.bif.bro

Summary

Events

arp_reply: event	Generated for ARP replies.
arp_request: event	Generated for ARP requests.
bad_arp: event	Generated for ARP packets that Bro cannot interpret.

Detailed Interface

Events

arp_reply

Type :event (mac_src: string, mac_dst: string, SPA: addr, SHA: string, TPA: addr, THA: string)

Generated for ARP replies.

See Wikipedia for more information about the ARP protocol.

Mac_src :The reply’s source MAC address. Mac_dst :The reply’s destination MAC address. Spa :The sender protocol address. Sha :The sender hardware address. Tpa :The target protocol address. Tha :The target hardware address.

See also: arp_request, bad_arp

arp_request

Type :event (mac_src: string, mac_dst: string, SPA: addr, SHA: string, TPA: addr, THA: string)

Generated for ARP requests.

See Wikipedia for more information about the ARP protocol.

Mac_src :The request’s source MAC address. Mac_dst :The request’s destination MAC address. Spa :The sender protocol address. Sha :The sender hardware address. Tpa :The target protocol address. Tha :The target hardware address.

See also: arp_reply, bad_arp

bad_arp

Type :event (SPA: addr, SHA: string, TPA: addr, THA: string, explanation: string)

Generated for ARP packets that Bro cannot interpret. Examples are packets with non-standard hardware address formats or hardware addresses that do not match the originator of the packet.

Spa :The sender protocol address. Sha :The sender hardware address. Tpa :The target protocol address. Tha :The target hardware address. Explanation :A short description of why the ARP packet is considered “bad”.

See also: arp_reply, arp_request

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.