{"id":225,"date":"2015-01-30T16:36:56","date_gmt":"2015-01-30T16:36:56","guid":{"rendered":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/?page_id=225"},"modified":"2017-12-08T10:54:13","modified_gmt":"2017-12-08T10:54:13","slug":"the-openbsm-module","status":"publish","type":"page","link":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/?page_id=225","title":{"rendered":"The openbsm module"},"content":{"rendered":"

The openbsm<\/code> module is a dissection module<\/a>: its purpose is to take an Orchids event, parse its last field (which should be a binary string, of type bstr<\/code>) and return a refined Orchids events, with additional fields. Typically, the openbsm<\/code> module is meant to dissect raw data coming from the udp<\/code><\/a> module, parsing it as an OpenBSM<\/a> record.<\/p>\n

Configuration options<\/h3>\n

None.<\/p>\n

Fields<\/h3>\n

OpenBSM records consist of a header, a list of tokens, and a trailer. Each contains one or several fields. The Orchids events returned by the openbsm<\/code> module are a complete list of fields appearing in an OpenBSM record.<\/p>\n

OPENBSM_OTHER_FILE32<\/code> header<\/strong><\/p>\n

Although OpenBSM defines 5 kinds of headers, the first four really are variants of each other. We start with OpenBSM records that have an OPENBSM_OTHER_FILE32<\/code> header (all constants are defined in $OCONF\/rules\/openbsm.h<\/code>; the constant OPENBSM_OTHER_FILE32<\/code> is called AUT_OTHER_FILE32<\/code> in the OpenBSM specification). These merely specify a file name:<\/p>\n\n\n\n\n\n\n\n
Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
.openbsm.kind<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nheader kind (=OPENBSM_OTHER_FILE32<\/code> here)<\/td>\n<\/tr>\n
.openbsm.time<\/code><\/td>\ntimeval<\/code><\/td>\n\u2713<\/td>\ntime<\/td>\n<\/tr>\n
.openbsm.file<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\nfile name<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

OPENBSM_HEADER{32,64}(_EX)?<\/code> headers<\/strong><\/p>\n

The usual OpenBSM records have a .openbsm.kind<\/code> field taken among OPENBSM_HEADER32<\/code>, OPENBSM_HEADER32_EX<\/code>, OPENBSM_HEADER64<\/code>, or OPENBSM_HEADER64_EX<\/code>. (Those correspond to AUT_HEADER32<\/code>, AUT_HEADER32_EX<\/code>, AUT_HEADER64<\/code>, and AUT_HEADER64_EX<\/code> respectively in the OpenBSM specification.)<\/p>\n

The OPENBSM_HEADER{32,64}_EX<\/code> headers have an extra IP address field .openbsm.ip<\/code>. This is always returned as an ipv6<\/code> value, even when the IP address is an IPv4 address. (Every IPv4 address embeds as an IPv6 address.)<\/p>\n

The contents of the header will then be found under the following Orchids fields:<\/p>\n\n\n\n\n\n\n\n\n\n\n
Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
.openbsm.kind<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nheader kind
\n(anything but OPENBSM_OTHER_FILE32<\/code> here)<\/td>\n<\/tr>\n
.openbsm.version<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nversion<\/td>\n<\/tr>\n
.openbsm.type<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\ntype<\/td>\n<\/tr>\n
.openbsm.modifier<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nmodifier<\/td>\n<\/tr>\n
.openbsm.time<\/code><\/td>\ntimeval<\/code><\/td>\n\u2713<\/td>\ntime<\/td>\n<\/tr>\n
.openbsm.ip<\/code><\/td>\nipv6<\/code><\/td>\n<\/td>\nIP address
\n(if .openbsm.kind<\/code> is of the form OPENBSM_HEADER{32,64}_EX<\/code>)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Additional fields are provided, depending on the tokens present in the OpenBSM record. They are listed by token sort now.<\/p>\n

    \n
  • AUT_ARG32<\/code>, AUT_ARG64<\/code><\/code> tokens<\/em>:
    \nThere are at most 128 of these. Each one has a name and a value. There is no field starting how many arguments are present.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.argname1<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\nargument name 1<\/td>\n<\/tr>\n
    .openbsm.arg1<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nargument value 1<\/td>\n<\/tr>\n
    .openbsm.argname2<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\nargument name 2<\/td>\n<\/tr>\n
    .openbsm.arg2<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nargument value 2<\/td>\n<\/tr>\n
    <\/td>\n…<\/td>\n<\/td>\n<\/tr>\n
    .openbsm.argname128<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\nargument name 128<\/td>\n<\/tr>\n
    .openbsm.arg128<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nargument value 128<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_DATA<\/code> tokens<\/em>:
    \nArrays of 1, 2, 4 or 8-byte numbers, with formatting instructions. Since Orchids does not have arrays, and AUT_DATA<\/code> tokens are meant to be printed anyway, such tokens are rendered as strings. E.g., a AUT_DATA<\/code> token with two 1-byte entries (say, 7 and 11), specified to be printed in hex, would yield the Orchids string \"0x7 0xb\"<\/code>.<\/p>\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.data<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\nraw data, printed as a string<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_ATTR32<\/code>, AUT_ATTR64<\/code> tokens<\/em>:
    \nSpecifies file attributes.<\/p>\n\n\n\n\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.file_access_mode<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nfile access mode<\/td>\n<\/tr>\n
    .openbsm.owner_uid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nowner user id<\/td>\n<\/tr>\n
    .openbsm.owner_gid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nowner group id<\/td>\n<\/tr>\n
    .openbsm.fsid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nfile system id<\/td>\n<\/tr>\n
    .openbsm.nid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nnode id<\/td>\n<\/tr>\n
    .openbsm.dev<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\ndevice id<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_EXIT<\/code> token:<\/em>
    \n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.exit_status<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nexit status<\/td>\n<\/tr>\n
    .openbsm.exit_value<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nexit return value<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_EXEC_ARGS<\/code> token:<\/em>
    \nArguments passed to execve()<\/code> and related syscalls.
    \nThere are at most 128 of these. The .openbsm.execarg_num<\/code> field states how much there are.<\/p>\n\n\n\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .bsm.execarg_num<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nnumber of arguments to execve()<\/code><\/td>\n<\/tr>\n
    .openbsm.execarg1<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nexec argument value 1<\/td>\n<\/tr>\n
    .openbsm.execarg2<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nexec argument value 2<\/td>\n<\/tr>\n
    <\/td>\n…<\/td>\n<\/td>\n<\/tr>\n
    .openbsm.execarg128<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nexec argument value 128<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_EXEC_ENV<\/code> token:<\/em>
    \nEnvironment variables passed to execve()<\/code> and related syscalls.
    \nThere are at most 128 of these. The .openbsm.execarg_num<\/code> field states how much there are.<\/p>\n\n\n\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .bsm.execarg_num<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nnumber of arguments to execve()<\/code><\/td>\n<\/tr>\n
    .openbsm.arg1<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\nexec environment variable 1<\/td>\n<\/tr>\n
    .openbsm.arg2<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\nexec environment variable 2<\/td>\n<\/tr>\n
    <\/td>\n…<\/td>\n<\/td>\n<\/tr>\n
    .openbsm.arg128<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\nexec environment variable 128<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_NEWGROUPS<\/code> token:<\/em>
    \nNew groups created.\u00a0 There are at most 16 of these. The .openbsm.newgroups_num<\/code> field states how much there are.<\/p>\n\n\n\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .bsm.newgroups_num<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nnumber of new groups<\/td>\n<\/tr>\n
    .openbsm.newgroup1<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nnew group number 1<\/td>\n<\/tr>\n
    .openbsm.newgroup2<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nnew group number 2<\/td>\n<\/tr>\n
    <\/td>\n…<\/td>\n<\/td>\n<\/tr>\n
    .openbsm.newgroup16<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nnew group number 16<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_IN_ADDR<\/code> token:<\/em>
    \nIPv4 address.<\/p>\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.inaddr<\/code><\/td>\nipv4<\/code><\/td>\n<\/td>\nIPv4 address<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_IN_ADDR_EX<\/code> token:<\/em>
    \nIPv4 or IPv6 address.<\/p>\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.inaddr6<\/code><\/td>\nipv6<\/code><\/td>\n<\/td>\nIPv6 address, or IPv4 address encoded as IPv6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_IP<\/code> token:<\/em>
    \nInternet Protocol (IP) header contents.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.ip_version<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nversion<\/td>\n<\/tr>\n
    .openbsm.ip_tos<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\ntype of service<\/td>\n<\/tr>\n
    .openbsm.ip_len<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nlength<\/td>\n<\/tr>\n
    .openbsm.ip_id<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nidentifier<\/td>\n<\/tr>\n
    .openbsm.ip_offset<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\noffset<\/td>\n<\/tr>\n
    .openbsm.ip_ttl<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\ntime to live<\/td>\n<\/tr>\n
    .openbsm.ip_protocol<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nprotocol<\/td>\n<\/tr>\n
    .openbsm.ip_checksum<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nchecksum<\/td>\n<\/tr>\n
    .openbsm.ip_source<\/code><\/td>\nipv4<\/code><\/td>\n<\/td>\nsource address<\/td>\n<\/tr>\n
    .openbsm.ip_dest<\/code><\/td>\nipv4<\/code><\/td>\n<\/td>\ndestination address<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_IPC<\/code> token:<\/em>
    \nInter-process communication info.<\/p>\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.ipc_type<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nobject type<\/td>\n<\/tr>\n
    .openbsm.ipc_id<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nobject identifier<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_IPC_PERM<\/code> token:<\/em>
    \nInter-process communication permission info.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.ipcperm_uid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nowner user id<\/td>\n<\/tr>\n
    .openbsm.ipcperm_gid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nowner group id<\/td>\n<\/tr>\n
    .openbsm.ipcperm_puid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\ncreator user id<\/td>\n<\/tr>\n
    .openbsm.ipcperm_pgid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\ncreator group id<\/td>\n<\/tr>\n
    .openbsm.ipcperm_mode<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\naccess mode<\/td>\n<\/tr>\n
    .openbsm.ipcperm_seq<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nslot sequence number<\/td>\n<\/tr>\n
    .openbsm.ipcperm_key<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nkey<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_IPORT<\/code> token:<\/em>
    \nIP port.<\/p>\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.iport<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nIP port<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_OPAQUE<\/code> token:<\/em>
    \nOpaque data. There is no way to do anything sensible with such data, I’m afraid, except pass it on.<\/p>\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.opaque<\/code><\/td>\nbstr<\/code><\/td>\n<\/td>\nopaque data<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_PATH<\/code> token:<\/em>
    \nSpecifies a file or directory name passed as an argument to a command or system call.<\/p>\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.path<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\nfile or directory name<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_PROCESS{32,64}(_EX)?<\/code> tokens:<\/em>
    \nA process and its various user and group ids.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.proc_auid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\naudit id<\/td>\n<\/tr>\n
    .openbsm.proc_euid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\neffective user id<\/td>\n<\/tr>\n
    .openbsm.proc_egid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\neffective group id<\/td>\n<\/tr>\n
    .openbsm.proc_ruid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nreal user id<\/td>\n<\/tr>\n
    .openbsm.proc_rgid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nreal group id<\/td>\n<\/tr>\n
    .openbsm.proc_pid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nprocess id<\/td>\n<\/tr>\n
    .openbsm.proc_sid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nsession id<\/td>\n<\/tr>\n
    .openbsm.proc_port<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nport id<\/td>\n<\/tr>\n
    .openbsm.proc_addr<\/code><\/td>\nipv6<\/code><\/td>\n<\/td>\nmachine id, as an IPv6 (or IPv4, encoded as IPv6) address<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_SUBJECT{32,64}(_EX)?<\/code> tokens:<\/em>
    \nA subject, with all its various user and group ids.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.subj_auid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\naudit id<\/td>\n<\/tr>\n
    .openbsm.subj_euid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\neffective user id<\/td>\n<\/tr>\n
    .openbsm.subj_egid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\neffective group id<\/td>\n<\/tr>\n
    .openbsm.subj_ruid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nreal user id<\/td>\n<\/tr>\n
    .openbsm.subj_rgid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nreal group id<\/td>\n<\/tr>\n
    .openbsm.subj_pid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nprocess id<\/td>\n<\/tr>\n
    .openbsm.subj_sid<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nsession id<\/td>\n<\/tr>\n
    .openbsm.subj_port<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nport id<\/td>\n<\/tr>\n
    .openbsm.subj_addr<\/code><\/td>\nipv6<\/code><\/td>\n<\/td>\nmachine id, as an IPv6 (or IPv4, encoded as IPv6) address<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_RETURN{32,64}<\/code> tokens:<\/em>
    \nReturn codes.<\/p>\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.return_status<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nreturn status<\/td>\n<\/tr>\n
    .openbsm.return_value<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nreturn value<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_SEQ<\/code> token:<\/em>
    \nSequence number.<\/p>\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.seqno<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nsequence number<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_SOCKINET{32,128}<\/code> tokens:<\/em>
    \nInternet socket (IPv4, resp. IPv6). The .openbsm.sock_family field is shared with the AUT_SOCKUNIX<\/code> token.<\/code><\/code><\/p>\n\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.sock_family<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nsocket family<\/td>\n<\/tr>\n
    .openbsm.sock_port<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nsocket local port<\/td>\n<\/tr>\n
    .openbsm.sock_addr<\/code><\/td>\nipv6<\/code><\/td>\n<\/td>\nsocket address<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_SOCKUNIX<\/code> token:<\/em>
    \nUnix (local) socket. The .openbsm.sock_family<\/code> field is shared with the AUT_SOCKINT{32,128}<\/code> tokens.<\/p>\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.sock_family<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nsocket family<\/td>\n<\/tr>\n
    .openbsm.sock_path<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\nname of the socket, as a local file<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_SOCKET<\/code>, AUT_SOCKET_EX<\/code> tokens:<\/em>
    \nSocket. The .openbsm.socket_domain<\/code> is only present for AUT_SOCKET_EX<\/code> tokens.<\/p>\n\n\n\n\n\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.socket_domain<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\ndomain (optional)<\/td>\n<\/tr>\n
    .openbsm.socket_type<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\ntype<\/td>\n<\/tr>\n
    .openbsm.socket_lport<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nlocal port<\/td>\n<\/tr>\n
    .openbsm.socket_laddr<\/code><\/td>\nipv6<\/code><\/td>\n<\/td>\nIPv6 (or IPv4 encoded as IPv6) local address<\/td>\n<\/tr>\n
    .openbsm.socket_rport<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nremote port<\/td>\n<\/tr>\n
    .openbsm.socket_raddr<\/code><\/td>\nipv6<\/code><\/td>\n<\/td>\nIPv6 (or IPv4 encoded as IPv6) remote address<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_TEXT<\/code> token:<\/em>
    \nText message.<\/p>\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.text<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\ntext string<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  • AUT_ZONENAME<\/code> token:<\/em>
    \nZone name.<\/p>\n\n\n\n\n\n
    Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
    .openbsm.zonename<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\nzone name<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n<\/ul>\n

     <\/p>\n","protected":false},"excerpt":{"rendered":"

    The openbsm module is a dissection module: its purpose is to take an Orchids event, parse its last field (which should be a binary string, of type bstr) and return a refined Orchids events, with additional fields. Typically, the openbsm module is meant to dissect raw data coming from the udp module, parsing it as … Continue reading The openbsm module<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"footnotes":""},"class_list":["post-225","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/pages\/225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=225"}],"version-history":[{"count":21,"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/pages\/225\/revisions"}],"predecessor-version":[{"id":730,"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/pages\/225\/revisions\/730"}],"wp:attachment":[{"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}