64 #define NONE FB_IE_F_NONE
65 #define ER FB_IE_F_ENDIAN | FB_IE_F_REVERSIBLE
73 #ifndef YAF_NEW_FIXBUF
74 static fbInfoElement_t yaf_info_elements[] = {
75 FB_IE_INIT(
"initialTCPFlags",
CERT_PEN, 14, 1, ER),
76 FB_IE_INIT(
"unionTCPFlags",
CERT_PEN, 15, 1, ER),
77 FB_IE_INIT(
"payload",
CERT_PEN, 18, FB_IE_VARLEN, FB_IE_F_REVERSIBLE),
78 FB_IE_INIT(
"reverseFlowDeltaMilliseconds",
CERT_PEN, 21, 4, FB_IE_F_ENDIAN),
79 FB_IE_INIT(
"silkAppLabel",
CERT_PEN, 33, 2, FB_IE_F_ENDIAN),
80 FB_IE_INIT(
"payloadEntropy",
CERT_PEN, 35, 1, FB_IE_F_REVERSIBLE),
81 FB_IE_INIT(
"osName",
CERT_PEN, 36, FB_IE_VARLEN, FB_IE_F_REVERSIBLE),
82 FB_IE_INIT(
"osVersion",
CERT_PEN, 37, FB_IE_VARLEN, FB_IE_F_REVERSIBLE),
83 FB_IE_INIT(
"firstPacketBanner",
CERT_PEN, 38, FB_IE_VARLEN,
85 FB_IE_INIT(
"secondPacketBanner",
CERT_PEN, 39, FB_IE_VARLEN,
87 FB_IE_INIT(
"flowAttributes",
CERT_PEN, 40, 2, ER),
88 FB_IE_INIT(
"osFingerPrint",
CERT_PEN, 107, FB_IE_VARLEN, FB_IE_F_REVERSIBLE),
89 FB_IE_INIT(
"expiredFragmentCount",
CERT_PEN, 100, 4, FB_IE_F_ENDIAN),
90 FB_IE_INIT(
"assembledFragmentCount",
CERT_PEN, 101, 4, FB_IE_F_ENDIAN),
91 FB_IE_INIT(
"meanFlowRate",
CERT_PEN, 102, 4, FB_IE_F_ENDIAN),
92 FB_IE_INIT(
"meanPacketRate",
CERT_PEN, 103, 4, FB_IE_F_ENDIAN),
93 FB_IE_INIT(
"flowTableFlushEventCount",
CERT_PEN, 104, 4, FB_IE_F_ENDIAN),
94 FB_IE_INIT(
"flowTablePeakCount",
CERT_PEN, 105, 4, FB_IE_F_ENDIAN),
95 FB_IE_INIT(
"yafFlowKeyHash",
CERT_PEN, 106, 4, ER),
97 FB_IE_INIT(
"smallPacketCount",
CERT_PEN, 500, 4, ER),
98 FB_IE_INIT(
"nonEmptyPacketCount",
CERT_PEN, 501, 4, ER),
99 FB_IE_INIT(
"dataByteCount",
CERT_PEN, 502, 8, ER),
100 FB_IE_INIT(
"averageInterarrivalTime",
CERT_PEN, 503, 8, ER),
101 FB_IE_INIT(
"standardDeviationInterarrivalTime",
CERT_PEN, 504, 8, ER),
102 FB_IE_INIT(
"firstNonEmptyPacketSize",
CERT_PEN, 505, 2, ER),
103 FB_IE_INIT(
"maxPacketSize",
CERT_PEN, 506, 2, ER),
104 FB_IE_INIT(
"firstEightNonEmptyPacketDirections",
CERT_PEN, 507, 1, ER),
105 FB_IE_INIT(
"standardDeviationPayloadLength",
CERT_PEN, 508, 2, ER),
106 FB_IE_INIT(
"tcpUrgentCount",
CERT_PEN, 509, 4, ER),
107 FB_IE_INIT(
"largePacketCount",
CERT_PEN, 510, 4, ER),
112 static fbInfoElement_t yaf_info_elements[] = {
113 FB_IE_INIT_FULL(
"initialTCPFlags",
CERT_PEN, 14, 1, ER | FB_IE_FLAGS,
114 0, 0, FB_UINT_8, NULL),
115 FB_IE_INIT_FULL(
"unionTCPFlags",
CERT_PEN, 15, 1, ER | FB_IE_FLAGS, 0, 0,
117 FB_IE_INIT_FULL(
"payload",
CERT_PEN, 18, FB_IE_VARLEN, FB_IE_F_REVERSIBLE,
118 0, 0, FB_OCTET_ARRAY, NULL),
119 FB_IE_INIT_FULL(
"reverseFlowDeltaMilliseconds",
CERT_PEN, 21, 4,
120 FB_IE_F_ENDIAN | FB_IE_QUANTITY | FB_UNITS_MILLISECONDS,
121 0, 0, FB_UINT_32, NULL),
122 FB_IE_INIT_FULL(
"silkAppLabel",
CERT_PEN, 33, 2,
123 FB_IE_F_ENDIAN | FB_IE_IDENTIFIER, 0, 0, FB_UINT_16, NULL),
124 FB_IE_INIT_FULL(
"payloadEntropy",
CERT_PEN, 35, 1, ER, 0, 0,
126 FB_IE_INIT_FULL(
"osName",
CERT_PEN, 36, FB_IE_VARLEN, FB_IE_F_REVERSIBLE,
127 0, 0, FB_STRING, NULL),
128 FB_IE_INIT_FULL(
"osVersion",
CERT_PEN, 37, FB_IE_VARLEN, FB_IE_F_REVERSIBLE,
129 0, 0, FB_STRING, NULL),
130 FB_IE_INIT_FULL(
"firstPacketBanner",
CERT_PEN, 38, FB_IE_VARLEN,
131 FB_IE_F_REVERSIBLE, 0, 0, FB_OCTET_ARRAY, NULL),
132 FB_IE_INIT_FULL(
"secondPacketBanner",
CERT_PEN, 39, FB_IE_VARLEN,
133 FB_IE_F_REVERSIBLE, 0, 0, FB_OCTET_ARRAY, NULL),
134 FB_IE_INIT_FULL(
"flowAttributes",
CERT_PEN, 40, 2, ER | FB_IE_FLAGS, 0, 0,
136 FB_IE_INIT_FULL(
"osFingerPrint",
CERT_PEN, 107, FB_IE_VARLEN,
137 FB_IE_F_REVERSIBLE, 0, 0, FB_STRING, NULL),
138 FB_IE_INIT_FULL(
"expiredFragmentCount",
CERT_PEN, 100, 4,
139 FB_IE_F_ENDIAN | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS,
140 0, 0, FB_UINT_32, NULL),
141 FB_IE_INIT_FULL(
"assembledFragmentCount",
CERT_PEN, 101, 4,
142 FB_IE_F_ENDIAN | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS,
143 0, 0, FB_UINT_32, NULL),
144 FB_IE_INIT_FULL(
"meanFlowRate",
CERT_PEN, 102, 4,
145 FB_IE_F_ENDIAN | FB_UNITS_FLOWS, 0, 0, FB_UINT_32, NULL),
146 FB_IE_INIT_FULL(
"meanPacketRate",
CERT_PEN, 103, 4,
147 FB_IE_F_ENDIAN | FB_UNITS_PACKETS, 0, 0, FB_UINT_32, NULL),
148 FB_IE_INIT_FULL(
"flowTableFlushEventCount",
CERT_PEN, 104, 4,
149 FB_IE_F_ENDIAN | FB_UNITS_FLOWS | FB_IE_TOTALCOUNTER,
150 0, 0, FB_UINT_32, NULL),
151 FB_IE_INIT_FULL(
"flowTablePeakCount",
CERT_PEN, 105, 4,
152 FB_IE_F_ENDIAN | FB_UNITS_FLOWS, 0, 0, FB_UINT_32, NULL),
153 FB_IE_INIT_FULL(
"yafFlowKeyHash",
CERT_PEN, 106, 4,
154 FB_IE_F_ENDIAN | FB_IE_IDENTIFIER, 0, 0, FB_UINT_32, NULL),
156 FB_IE_INIT_FULL(
"smallPacketCount",
CERT_PEN, 500, 4,
157 ER | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS, 0, 0,
159 FB_IE_INIT_FULL(
"nonEmptyPacketCount",
CERT_PEN, 501, 4,
160 ER | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS, 0, 0,
162 FB_IE_INIT_FULL(
"dataByteCount",
CERT_PEN, 502, 8,
163 ER | FB_IE_TOTALCOUNTER | FB_UNITS_OCTETS, 0, 0,
165 FB_IE_INIT_FULL(
"averageInterarrivalTime",
CERT_PEN, 503, 8,
166 ER | FB_UNITS_MILLISECONDS, 0, 0, FB_DT_MILSEC, NULL),
167 FB_IE_INIT_FULL(
"standardDeviationInterarrivalTime",
CERT_PEN, 504, 8,
168 ER | FB_UNITS_MILLISECONDS, 0, 0, FB_DT_MILSEC, NULL),
169 FB_IE_INIT_FULL(
"firstNonEmptyPacketSize",
CERT_PEN, 505, 2,
170 ER | FB_IE_QUANTITY | FB_UNITS_OCTETS, 0, 0,
172 FB_IE_INIT_FULL(
"maxPacketSize",
CERT_PEN, 506, 2,
173 ER | FB_IE_QUANTITY | FB_UNITS_OCTETS, 0, 0,
175 FB_IE_INIT_FULL(
"firstEightNonEmptyPacketDirections",
CERT_PEN, 507, 1,
176 ER | FB_IE_FLAGS, 0, 0, FB_UINT_8, NULL),
177 FB_IE_INIT_FULL(
"standardDeviationPayloadLength",
CERT_PEN, 508, 2,
178 ER | FB_UNITS_OCTETS, 0, 0, FB_UINT_16, NULL),
179 FB_IE_INIT_FULL(
"tcpUrgentCount",
CERT_PEN, 509, 4,
180 ER | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS, 0, 0,
182 FB_IE_INIT_FULL(
"largePacketCount",
CERT_PEN, 510, 4,
183 ER | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS, 0, 0,
194 #ifndef YAF_NEW_FIXBUF
196 static fbInfoElement_t yaf_dpi_info_elements[] = {
197 FB_IE_INIT(
"httpServerString",
CERT_PEN, 110, FB_IE_VARLEN, NONE),
198 FB_IE_INIT(
"httpUserAgent",
CERT_PEN, 111, FB_IE_VARLEN, NONE),
199 FB_IE_INIT(
"httpGet",
CERT_PEN, 112, FB_IE_VARLEN, NONE),
200 FB_IE_INIT(
"httpConnection",
CERT_PEN, 113, FB_IE_VARLEN, NONE),
201 FB_IE_INIT(
"httpVersion",
CERT_PEN, 114, FB_IE_VARLEN, NONE),
202 FB_IE_INIT(
"httpReferer",
CERT_PEN, 115, FB_IE_VARLEN, NONE),
203 FB_IE_INIT(
"httpLocation",
CERT_PEN, 116, FB_IE_VARLEN, NONE),
204 FB_IE_INIT(
"httpHost",
CERT_PEN, 117, FB_IE_VARLEN, NONE),
205 FB_IE_INIT(
"httpContentLength",
CERT_PEN, 118, FB_IE_VARLEN, NONE),
206 FB_IE_INIT(
"httpAge",
CERT_PEN, 119, FB_IE_VARLEN, NONE),
207 FB_IE_INIT(
"httpAccept",
CERT_PEN, 120, FB_IE_VARLEN, NONE),
208 FB_IE_INIT(
"httpAcceptLanguage",
CERT_PEN, 121, FB_IE_VARLEN, NONE),
209 FB_IE_INIT(
"httpContentType",
CERT_PEN, 122, FB_IE_VARLEN, NONE),
210 FB_IE_INIT(
"httpResponse",
CERT_PEN, 123, FB_IE_VARLEN, NONE),
211 FB_IE_INIT(
"httpCookie",
CERT_PEN, 220, FB_IE_VARLEN, NONE),
212 FB_IE_INIT(
"httpSetCookie",
CERT_PEN, 221, FB_IE_VARLEN, NONE),
213 FB_IE_INIT(
"httpAuthorization",
CERT_PEN, 252, FB_IE_VARLEN, NONE),
214 FB_IE_INIT(
"httpVia",
CERT_PEN, 253, FB_IE_VARLEN, NONE),
215 FB_IE_INIT(
"httpX-Forwarded-For",
CERT_PEN, 254, FB_IE_VARLEN, NONE),
216 FB_IE_INIT(
"httpRefresh",
CERT_PEN, 256, FB_IE_VARLEN, NONE),
218 FB_IE_INIT(
"httpIMEI",
CERT_PEN, 257, FB_IE_VARLEN, NONE),
219 FB_IE_INIT(
"httpIMSI",
CERT_PEN, 258, FB_IE_VARLEN, NONE),
220 FB_IE_INIT(
"httpMSISDN",
CERT_PEN, 259, FB_IE_VARLEN, NONE),
221 FB_IE_INIT(
"httpSubscriber",
CERT_PEN, 260, FB_IE_VARLEN, NONE),
223 FB_IE_INIT(
"httpExpires",
CERT_PEN, 255, FB_IE_VARLEN, NONE),
224 FB_IE_INIT(
"httpAcceptCharset",
CERT_PEN, 261, FB_IE_VARLEN, NONE),
225 FB_IE_INIT(
"httpAcceptEncoding",
CERT_PEN, 262, FB_IE_VARLEN, NONE),
226 FB_IE_INIT(
"httpAllow",
CERT_PEN, 263, FB_IE_VARLEN, NONE),
227 FB_IE_INIT(
"httpDate",
CERT_PEN, 264, FB_IE_VARLEN, NONE),
228 FB_IE_INIT(
"httpExpect",
CERT_PEN, 265, FB_IE_VARLEN, NONE),
229 FB_IE_INIT(
"httpFrom",
CERT_PEN, 266, FB_IE_VARLEN, NONE),
230 FB_IE_INIT(
"httpProxyAuthentication",
CERT_PEN, 267, FB_IE_VARLEN, NONE),
231 FB_IE_INIT(
"httpUpgrade",
CERT_PEN, 268, FB_IE_VARLEN, NONE),
232 FB_IE_INIT(
"httpWarning",
CERT_PEN, 269, FB_IE_VARLEN, NONE),
233 FB_IE_INIT(
"httpDNT",
CERT_PEN, 270, FB_IE_VARLEN, NONE),
234 FB_IE_INIT(
"httpX-Forwarded-Proto",
CERT_PEN, 271, FB_IE_VARLEN, NONE),
235 FB_IE_INIT(
"httpX-Forwarded-Host",
CERT_PEN, 272, FB_IE_VARLEN, NONE),
236 FB_IE_INIT(
"httpX-Forwarded-Server",
CERT_PEN, 273, FB_IE_VARLEN, NONE),
237 FB_IE_INIT(
"httpX-DeviceID",
CERT_PEN, 274, FB_IE_VARLEN, NONE),
238 FB_IE_INIT(
"httpX-Profile",
CERT_PEN, 275, FB_IE_VARLEN, NONE),
239 FB_IE_INIT(
"httpLastModified",
CERT_PEN, 276, FB_IE_VARLEN, NONE),
240 FB_IE_INIT(
"httpContentEncoding",
CERT_PEN, 277, FB_IE_VARLEN, NONE),
241 FB_IE_INIT(
"httpContentLanguage",
CERT_PEN, 278, FB_IE_VARLEN, NONE),
242 FB_IE_INIT(
"httpContentLocation",
CERT_PEN, 279, FB_IE_VARLEN, NONE),
243 FB_IE_INIT(
"httpX-UA-Compatible",
CERT_PEN, 280, FB_IE_VARLEN, NONE),
245 FB_IE_INIT(
"pop3TextMessage",
CERT_PEN, 124, FB_IE_VARLEN, NONE),
247 FB_IE_INIT(
"ircTextMessage",
CERT_PEN, 125, FB_IE_VARLEN, NONE),
249 FB_IE_INIT(
"tftpFilename",
CERT_PEN, 126, FB_IE_VARLEN, NONE),
250 FB_IE_INIT(
"tftpMode",
CERT_PEN, 127, FB_IE_VARLEN, NONE),
252 FB_IE_INIT(
"slpVersion",
CERT_PEN, 128, 1, FB_IE_F_ENDIAN),
253 FB_IE_INIT(
"slpMessageType",
CERT_PEN, 129, 1, FB_IE_F_ENDIAN),
254 FB_IE_INIT(
"slpString",
CERT_PEN, 130, FB_IE_VARLEN, NONE),
256 FB_IE_INIT(
"ftpReturn",
CERT_PEN, 131, FB_IE_VARLEN, NONE),
257 FB_IE_INIT(
"ftpUser",
CERT_PEN, 132, FB_IE_VARLEN, NONE),
258 FB_IE_INIT(
"ftpPass",
CERT_PEN,133, FB_IE_VARLEN, NONE),
259 FB_IE_INIT(
"ftpType",
CERT_PEN,134, FB_IE_VARLEN, NONE),
260 FB_IE_INIT(
"ftpRespCode",
CERT_PEN,135, FB_IE_VARLEN, NONE),
262 FB_IE_INIT(
"imapCapability",
CERT_PEN, 136, FB_IE_VARLEN, NONE),
263 FB_IE_INIT(
"imapLogin",
CERT_PEN, 137, FB_IE_VARLEN, NONE),
264 FB_IE_INIT(
"imapStartTLS",
CERT_PEN, 138, FB_IE_VARLEN, NONE),
265 FB_IE_INIT(
"imapAuthenticate",
CERT_PEN, 139, FB_IE_VARLEN, NONE),
266 FB_IE_INIT(
"imapCommand",
CERT_PEN, 140, FB_IE_VARLEN, NONE),
267 FB_IE_INIT(
"imapExists",
CERT_PEN, 141, FB_IE_VARLEN, NONE),
268 FB_IE_INIT(
"imapRecent",
CERT_PEN, 142, FB_IE_VARLEN, NONE),
270 FB_IE_INIT(
"rtspURL",
CERT_PEN, 143, FB_IE_VARLEN, NONE),
271 FB_IE_INIT(
"rtspVersion",
CERT_PEN, 144, FB_IE_VARLEN, NONE),
272 FB_IE_INIT(
"rtspReturnCode",
CERT_PEN, 145, FB_IE_VARLEN, NONE),
273 FB_IE_INIT(
"rtspContentLength",
CERT_PEN, 146, FB_IE_VARLEN, NONE),
274 FB_IE_INIT(
"rtspCommand",
CERT_PEN, 147, FB_IE_VARLEN, NONE),
275 FB_IE_INIT(
"rtspContentType",
CERT_PEN, 148, FB_IE_VARLEN, NONE),
276 FB_IE_INIT(
"rtspTransport",
CERT_PEN, 149, FB_IE_VARLEN, NONE),
277 FB_IE_INIT(
"rtspCSeq",
CERT_PEN, 150, FB_IE_VARLEN, NONE),
278 FB_IE_INIT(
"rtspLocation",
CERT_PEN, 151, FB_IE_VARLEN, NONE),
279 FB_IE_INIT(
"rtspPacketsReceived",
CERT_PEN, 152, FB_IE_VARLEN, NONE),
280 FB_IE_INIT(
"rtspUserAgent",
CERT_PEN, 153, FB_IE_VARLEN, NONE),
281 FB_IE_INIT(
"rtspJitter",
CERT_PEN, 154, FB_IE_VARLEN, NONE),
283 FB_IE_INIT(
"sipInvite",
CERT_PEN, 155, FB_IE_VARLEN, NONE),
284 FB_IE_INIT(
"sipCommand",
CERT_PEN, 156, FB_IE_VARLEN, NONE),
285 FB_IE_INIT(
"sipVia",
CERT_PEN, 157, FB_IE_VARLEN, NONE),
286 FB_IE_INIT(
"sipMaxForwards",
CERT_PEN, 158, FB_IE_VARLEN, NONE),
287 FB_IE_INIT(
"sipAddress",
CERT_PEN, 159, FB_IE_VARLEN, NONE),
288 FB_IE_INIT(
"sipContentLength",
CERT_PEN, 160, FB_IE_VARLEN, NONE),
289 FB_IE_INIT(
"sipUserAgent",
CERT_PEN, 161, FB_IE_VARLEN, NONE),
291 FB_IE_INIT(
"smtpHello",
CERT_PEN, 162, FB_IE_VARLEN, NONE),
292 FB_IE_INIT(
"smtpFrom",
CERT_PEN, 163, FB_IE_VARLEN, NONE),
293 FB_IE_INIT(
"smtpTo",
CERT_PEN, 164, FB_IE_VARLEN, NONE),
294 FB_IE_INIT(
"smtpContentType",
CERT_PEN, 165, FB_IE_VARLEN, NONE),
295 FB_IE_INIT(
"smtpSubject",
CERT_PEN, 166, FB_IE_VARLEN, NONE),
296 FB_IE_INIT(
"smtpFilename",
CERT_PEN, 167, FB_IE_VARLEN, NONE),
297 FB_IE_INIT(
"smtpContentDisposition",
CERT_PEN, 168, FB_IE_VARLEN, NONE),
298 FB_IE_INIT(
"smtpResponse",
CERT_PEN, 169, FB_IE_VARLEN, NONE),
299 FB_IE_INIT(
"smtpEnhanced",
CERT_PEN, 170, FB_IE_VARLEN, NONE),
300 FB_IE_INIT(
"smtpSize",
CERT_PEN, 222, FB_IE_VARLEN, NONE),
301 FB_IE_INIT(
"smtpDate",
CERT_PEN, 251, FB_IE_VARLEN, NONE),
303 FB_IE_INIT(
"sshVersion",
CERT_PEN, 171, FB_IE_VARLEN, NONE),
305 FB_IE_INIT(
"nntpResponse",
CERT_PEN, 172, FB_IE_VARLEN, NONE),
306 FB_IE_INIT(
"nntpCommand",
CERT_PEN, 173, FB_IE_VARLEN, NONE),
308 FB_IE_INIT(
"dnsQueryResponse",
CERT_PEN, 174, 1, FB_IE_F_ENDIAN),
309 FB_IE_INIT(
"dnsQRType",
CERT_PEN, 175, 2, FB_IE_F_ENDIAN),
310 FB_IE_INIT(
"dnsAuthoritative",
CERT_PEN, 176, 1, FB_IE_F_ENDIAN),
311 FB_IE_INIT(
"dnsNXDomain",
CERT_PEN, 177, 1, FB_IE_F_ENDIAN),
312 FB_IE_INIT(
"dnsRRSection",
CERT_PEN, 178, 1, FB_IE_F_ENDIAN),
313 FB_IE_INIT(
"dnsQName",
CERT_PEN, 179, FB_IE_VARLEN, NONE),
314 FB_IE_INIT(
"dnsCName",
CERT_PEN, 180, FB_IE_VARLEN, NONE),
315 FB_IE_INIT(
"dnsMXPreference",
CERT_PEN, 181, 2, FB_IE_F_ENDIAN),
316 FB_IE_INIT(
"dnsMXExchange",
CERT_PEN, 182, FB_IE_VARLEN, NONE),
317 FB_IE_INIT(
"dnsNSDName",
CERT_PEN, 183, FB_IE_VARLEN, NONE),
318 FB_IE_INIT(
"dnsPTRDName",
CERT_PEN, 184, FB_IE_VARLEN, NONE),
319 FB_IE_INIT(
"dnsTTL",
CERT_PEN, 199, 4, FB_IE_F_ENDIAN),
320 FB_IE_INIT(
"dnsTXTData",
CERT_PEN, 208, FB_IE_VARLEN, NONE),
321 FB_IE_INIT(
"dnsSOASerial",
CERT_PEN, 209, 4, FB_IE_F_ENDIAN),
322 FB_IE_INIT(
"dnsSOARefresh",
CERT_PEN, 210, 4, FB_IE_F_ENDIAN),
323 FB_IE_INIT(
"dnsSOARetry",
CERT_PEN, 211, 4, FB_IE_F_ENDIAN),
324 FB_IE_INIT(
"dnsSOAExpire",
CERT_PEN, 212, 4, FB_IE_F_ENDIAN),
325 FB_IE_INIT(
"dnsSOAMinimum",
CERT_PEN, 213, 4, FB_IE_F_ENDIAN),
326 FB_IE_INIT(
"dnsSOAMName",
CERT_PEN, 214, FB_IE_VARLEN, NONE),
327 FB_IE_INIT(
"dnsSOARName",
CERT_PEN, 215, FB_IE_VARLEN, NONE),
328 FB_IE_INIT(
"dnsSRVPriority",
CERT_PEN, 216, 2, FB_IE_F_ENDIAN),
329 FB_IE_INIT(
"dnsSRVWeight",
CERT_PEN, 217, 2, FB_IE_F_ENDIAN),
330 FB_IE_INIT(
"dnsSRVPort",
CERT_PEN, 218, 2, FB_IE_F_ENDIAN),
331 FB_IE_INIT(
"dnsSRVTarget",
CERT_PEN, 219, FB_IE_VARLEN, NONE),
332 FB_IE_INIT(
"dnsID",
CERT_PEN, 226, 2, FB_IE_F_ENDIAN),
334 FB_IE_INIT(
"dnsAlgorithm",
CERT_PEN, 227, 1, FB_IE_F_ENDIAN),
335 FB_IE_INIT(
"dnsKeyTag",
CERT_PEN, 228, 2, FB_IE_F_ENDIAN),
336 FB_IE_INIT(
"dnsSigner",
CERT_PEN, 229, FB_IE_VARLEN, NONE),
337 FB_IE_INIT(
"dnsSignature",
CERT_PEN, 230, FB_IE_VARLEN, NONE),
338 FB_IE_INIT(
"dnsDigest",
CERT_PEN, 231, FB_IE_VARLEN, NONE),
339 FB_IE_INIT(
"dnsPublicKey",
CERT_PEN, 232, FB_IE_VARLEN, NONE),
340 FB_IE_INIT(
"dnsSalt",
CERT_PEN, 233, FB_IE_VARLEN, NONE),
341 FB_IE_INIT(
"dnsHashData",
CERT_PEN, 234, FB_IE_VARLEN, NONE),
342 FB_IE_INIT(
"dnsIterations",
CERT_PEN, 235, 2, FB_IE_F_ENDIAN),
343 FB_IE_INIT(
"dnsSignatureExpiration",
CERT_PEN, 236, 4, FB_IE_F_ENDIAN),
344 FB_IE_INIT(
"dnsSignatureInception",
CERT_PEN, 237, 4, FB_IE_F_ENDIAN),
345 FB_IE_INIT(
"dnsDigestType",
CERT_PEN, 238, 1, FB_IE_F_ENDIAN),
346 FB_IE_INIT(
"dnsLabels",
CERT_PEN, 239, 1, FB_IE_F_ENDIAN),
347 FB_IE_INIT(
"dnsTypeCovered",
CERT_PEN, 240, 2, FB_IE_F_ENDIAN),
348 FB_IE_INIT(
"dnsFlags",
CERT_PEN, 241, 2, FB_IE_F_ENDIAN),
350 FB_IE_INIT(
"sslCipher",
CERT_PEN, 185, 4, FB_IE_F_ENDIAN),
351 FB_IE_INIT(
"sslClientVersion",
CERT_PEN, 186, 1, FB_IE_F_ENDIAN),
352 FB_IE_INIT(
"sslServerCipher",
CERT_PEN, 187, 4, FB_IE_F_ENDIAN),
353 FB_IE_INIT(
"sslCompressionMethod",
CERT_PEN, 188, 1, FB_IE_F_ENDIAN),
354 FB_IE_INIT(
"sslCertVersion",
CERT_PEN, 189, 1, FB_IE_F_ENDIAN),
355 FB_IE_INIT(
"sslCertSignature",
CERT_PEN, 190, FB_IE_VARLEN, NONE),
356 FB_IE_INIT(
"sslCertSerialNumber",
CERT_PEN, 244, FB_IE_VARLEN, NONE),
357 FB_IE_INIT(
"sslObjectType",
CERT_PEN, 245, 1, FB_IE_F_ENDIAN),
358 FB_IE_INIT(
"sslObjectValue",
CERT_PEN, 246, FB_IE_VARLEN, NONE),
359 FB_IE_INIT(
"sslCertValidityNotBefore",
CERT_PEN, 247, FB_IE_VARLEN, NONE),
360 FB_IE_INIT(
"sslCertValidityNotAfter",
CERT_PEN, 248, FB_IE_VARLEN, NONE),
361 FB_IE_INIT(
"sslPublicKeyAlgorithm",
CERT_PEN, 249, FB_IE_VARLEN, NONE),
362 FB_IE_INIT(
"sslPublicKeyLength",
CERT_PEN, 250, 2, FB_IE_F_ENDIAN),
364 FB_IE_INIT(
"mysqlUsername",
CERT_PEN, 223, FB_IE_VARLEN, NONE),
365 FB_IE_INIT(
"mysqlCommandCode",
CERT_PEN, 224, 1, FB_IE_F_ENDIAN),
366 FB_IE_INIT(
"mysqlCommandText",
CERT_PEN, 225, FB_IE_VARLEN, NONE),
368 FB_IE_INIT(
"dnp3SourceAddress",
CERT_PEN, 281, 2, FB_IE_F_ENDIAN),
369 FB_IE_INIT(
"dnp3DestinationAddress",
CERT_PEN, 282, 2, FB_IE_F_ENDIAN),
370 FB_IE_INIT(
"dnp3Function",
CERT_PEN, 283, 1, FB_IE_F_ENDIAN),
371 FB_IE_INIT(
"dnp3ObjectData",
CERT_PEN, 284, FB_IE_VARLEN, NONE),
372 FB_IE_INIT(
"modbusData",
CERT_PEN, 285, FB_IE_VARLEN, NONE),
373 FB_IE_INIT(
"ethernetIPData",
CERT_PEN, 286, FB_IE_VARLEN, NONE),
374 FB_IE_INIT(
"rtpPayloadType",
CERT_PEN, 287, 1, ER),
375 FB_IE_INIT(
"sslRecordVersion",
CERT_PEN, 288, 2, FB_IE_F_ENDIAN),
379 static fbInfoElement_t yaf_dhcp_info_elements[] = {
380 FB_IE_INIT(
"dhcpFingerPrint",
CERT_PEN, 242, FB_IE_VARLEN,
382 FB_IE_INIT(
"dhcpVendorCode",
CERT_PEN, 243, FB_IE_VARLEN,
391 static fbInfoElement_t yaf_dpi_info_elements[] = {
392 FB_IE_INIT_FULL(
"httpServerString",
CERT_PEN, 110, FB_IE_VARLEN, NONE,
393 0, 0, FB_STRING, NULL),
394 FB_IE_INIT_FULL(
"httpUserAgent",
CERT_PEN, 111, FB_IE_VARLEN, NONE,
395 0, 0, FB_STRING, NULL),
396 FB_IE_INIT_FULL(
"httpGet",
CERT_PEN, 112, FB_IE_VARLEN, NONE,
397 0, 0, FB_STRING, NULL),
398 FB_IE_INIT_FULL(
"httpConnection",
CERT_PEN, 113, FB_IE_VARLEN, NONE,
399 0, 0, FB_STRING, NULL),
400 FB_IE_INIT_FULL(
"httpVersion",
CERT_PEN, 114, FB_IE_VARLEN, NONE,
401 0, 0, FB_STRING, NULL),
402 FB_IE_INIT_FULL(
"httpReferer",
CERT_PEN, 115, FB_IE_VARLEN, NONE,
403 0, 0, FB_STRING, NULL),
404 FB_IE_INIT_FULL(
"httpLocation",
CERT_PEN, 116, FB_IE_VARLEN, NONE,
405 0, 0, FB_STRING, NULL),
406 FB_IE_INIT_FULL(
"httpHost",
CERT_PEN, 117, FB_IE_VARLEN, NONE,
407 0, 0, FB_STRING, NULL),
408 FB_IE_INIT_FULL(
"httpContentLength",
CERT_PEN, 118, FB_IE_VARLEN, NONE,
409 0, 0, FB_STRING, NULL),
410 FB_IE_INIT_FULL(
"httpAge",
CERT_PEN, 119, FB_IE_VARLEN, NONE,
411 0, 0, FB_STRING, NULL),
412 FB_IE_INIT_FULL(
"httpAccept",
CERT_PEN, 120, FB_IE_VARLEN, NONE,
413 0, 0, FB_STRING, NULL),
414 FB_IE_INIT_FULL(
"httpAcceptLanguage",
CERT_PEN, 121, FB_IE_VARLEN, NONE,
415 0, 0, FB_STRING, NULL),
416 FB_IE_INIT_FULL(
"httpContentType",
CERT_PEN, 122, FB_IE_VARLEN, NONE,
417 0, 0, FB_STRING, NULL),
418 FB_IE_INIT_FULL(
"httpResponse",
CERT_PEN, 123, FB_IE_VARLEN, NONE,
419 0, 0, FB_STRING, NULL),
420 FB_IE_INIT_FULL(
"httpCookie",
CERT_PEN, 220, FB_IE_VARLEN, NONE,
421 0, 0, FB_STRING, NULL),
422 FB_IE_INIT_FULL(
"httpSetCookie",
CERT_PEN, 221, FB_IE_VARLEN, NONE,
423 0, 0, FB_STRING, NULL),
424 FB_IE_INIT_FULL(
"httpAuthorization",
CERT_PEN, 252, FB_IE_VARLEN, NONE,
425 0, 0, FB_STRING, NULL),
426 FB_IE_INIT_FULL(
"httpVia",
CERT_PEN, 253, FB_IE_VARLEN, NONE,
427 0, 0, FB_STRING, NULL),
428 FB_IE_INIT_FULL(
"httpX-Forwarded-For",
CERT_PEN, 254, FB_IE_VARLEN, NONE,
429 0, 0, FB_STRING, NULL),
430 FB_IE_INIT_FULL(
"httpRefresh",
CERT_PEN, 256, FB_IE_VARLEN, NONE,
431 0, 0, FB_STRING, NULL),
433 FB_IE_INIT_FULL(
"httpIMEI",
CERT_PEN, 257, FB_IE_VARLEN, NONE,
434 0, 0, FB_STRING, NULL),
435 FB_IE_INIT_FULL(
"httpIMSI",
CERT_PEN, 258, FB_IE_VARLEN, NONE,
436 0, 0, FB_STRING, NULL),
437 FB_IE_INIT_FULL(
"httpMSISDN",
CERT_PEN, 259, FB_IE_VARLEN, NONE,
438 0, 0, FB_STRING, NULL),
439 FB_IE_INIT_FULL(
"httpSubscriber",
CERT_PEN, 260, FB_IE_VARLEN, NONE,
440 0, 0, FB_STRING, NULL),
442 FB_IE_INIT_FULL(
"httpExpires",
CERT_PEN, 255, FB_IE_VARLEN, NONE,
443 0, 0, FB_STRING, NULL),
444 FB_IE_INIT_FULL(
"httpAcceptCharset",
CERT_PEN, 261, FB_IE_VARLEN, NONE,
445 0, 0, FB_STRING, NULL),
446 FB_IE_INIT_FULL(
"httpAcceptEncoding",
CERT_PEN, 262, FB_IE_VARLEN, NONE,
447 0, 0, FB_STRING, NULL),
448 FB_IE_INIT_FULL(
"httpAllow",
CERT_PEN, 263, FB_IE_VARLEN, NONE,
449 0, 0, FB_STRING, NULL),
450 FB_IE_INIT_FULL(
"httpDate",
CERT_PEN, 264, FB_IE_VARLEN, NONE,
451 0, 0, FB_STRING, NULL),
452 FB_IE_INIT_FULL(
"httpExpect",
CERT_PEN, 265, FB_IE_VARLEN, NONE,
453 0, 0, FB_STRING, NULL),
454 FB_IE_INIT_FULL(
"httpFrom",
CERT_PEN, 266, FB_IE_VARLEN, NONE,
455 0, 0, FB_STRING, NULL),
456 FB_IE_INIT_FULL(
"httpProxyAuthentication",
CERT_PEN, 267, FB_IE_VARLEN,
457 NONE, 0, 0, FB_STRING, NULL),
458 FB_IE_INIT_FULL(
"httpUpgrade",
CERT_PEN, 268, FB_IE_VARLEN, NONE,
459 0, 0, FB_STRING, NULL),
460 FB_IE_INIT_FULL(
"httpWarning",
CERT_PEN, 269, FB_IE_VARLEN, NONE,
461 0, 0, FB_STRING, NULL),
462 FB_IE_INIT_FULL(
"httpDNT",
CERT_PEN, 270, FB_IE_VARLEN, NONE,
463 0, 0, FB_STRING, NULL),
464 FB_IE_INIT_FULL(
"httpX-Forwarded-Proto",
CERT_PEN, 271, FB_IE_VARLEN,
465 NONE, 0, 0, FB_STRING, NULL),
466 FB_IE_INIT_FULL(
"httpX-Forwarded-Host",
CERT_PEN, 272, FB_IE_VARLEN, NONE,
467 0, 0, FB_STRING, NULL),
468 FB_IE_INIT_FULL(
"httpX-Forwarded-Server",
CERT_PEN, 273, FB_IE_VARLEN,
469 NONE, 0, 0, FB_STRING, NULL),
470 FB_IE_INIT_FULL(
"httpX-DeviceID",
CERT_PEN, 274, FB_IE_VARLEN, NONE,
471 0, 0, FB_STRING, NULL),
472 FB_IE_INIT_FULL(
"httpX-Profile",
CERT_PEN, 275, FB_IE_VARLEN, NONE,
473 0, 0, FB_STRING, NULL),
474 FB_IE_INIT_FULL(
"httpLastModified",
CERT_PEN, 276, FB_IE_VARLEN, NONE,
475 0, 0, FB_STRING, NULL),
476 FB_IE_INIT_FULL(
"httpContentEncoding",
CERT_PEN, 277, FB_IE_VARLEN, NONE,
477 0, 0, FB_STRING, NULL),
478 FB_IE_INIT_FULL(
"httpContentLanguage",
CERT_PEN, 278, FB_IE_VARLEN, NONE,
479 0, 0, FB_STRING, NULL),
480 FB_IE_INIT_FULL(
"httpContentLocation",
CERT_PEN, 279, FB_IE_VARLEN, NONE,
481 0, 0, FB_STRING, NULL),
482 FB_IE_INIT_FULL(
"httpX-UA-Compatible",
CERT_PEN, 280, FB_IE_VARLEN, NONE,
483 0, 0, FB_STRING, NULL),
485 FB_IE_INIT_FULL(
"pop3TextMessage",
CERT_PEN, 124, FB_IE_VARLEN, NONE,
486 0, 0, FB_STRING, NULL),
488 FB_IE_INIT_FULL(
"ircTextMessage",
CERT_PEN, 125, FB_IE_VARLEN, NONE,
489 0, 0, FB_STRING, NULL),
491 FB_IE_INIT_FULL(
"tftpFilename",
CERT_PEN, 126, FB_IE_VARLEN, NONE,
492 0, 0, FB_STRING, NULL),
493 FB_IE_INIT_FULL(
"tftpMode",
CERT_PEN, 127, FB_IE_VARLEN, NONE,
494 0, 0, FB_STRING, NULL),
496 FB_IE_INIT_FULL(
"slpVersion",
CERT_PEN, 128, 1, FB_IE_F_ENDIAN,
497 0, 0, FB_UINT_8, NULL),
498 FB_IE_INIT_FULL(
"slpMessageType",
CERT_PEN, 129, 1, FB_IE_F_ENDIAN,
499 0, 0, FB_UINT_8, NULL),
500 FB_IE_INIT_FULL(
"slpString",
CERT_PEN, 130, FB_IE_VARLEN, NONE,
501 0, 0, FB_STRING, NULL),
503 FB_IE_INIT_FULL(
"ftpReturn",
CERT_PEN, 131, FB_IE_VARLEN, NONE,
504 0, 0, FB_STRING, NULL),
505 FB_IE_INIT_FULL(
"ftpUser",
CERT_PEN, 132, FB_IE_VARLEN, NONE,
506 0, 0, FB_STRING, NULL),
507 FB_IE_INIT_FULL(
"ftpPass",
CERT_PEN,133, FB_IE_VARLEN, NONE,
508 0, 0, FB_STRING, NULL),
509 FB_IE_INIT_FULL(
"ftpType",
CERT_PEN,134, FB_IE_VARLEN, NONE,
510 0, 0, FB_STRING, NULL),
511 FB_IE_INIT_FULL(
"ftpRespCode",
CERT_PEN,135, FB_IE_VARLEN, NONE,
512 0, 0, FB_STRING, NULL),
514 FB_IE_INIT_FULL(
"imapCapability",
CERT_PEN, 136, FB_IE_VARLEN, NONE,
515 0, 0, FB_STRING, NULL),
516 FB_IE_INIT_FULL(
"imapLogin",
CERT_PEN, 137, FB_IE_VARLEN, NONE,
517 0, 0, FB_STRING, NULL),
518 FB_IE_INIT_FULL(
"imapStartTLS",
CERT_PEN, 138, FB_IE_VARLEN, NONE,
519 0, 0, FB_STRING, NULL),
520 FB_IE_INIT_FULL(
"imapAuthenticate",
CERT_PEN, 139, FB_IE_VARLEN, NONE,
521 0, 0, FB_STRING, NULL),
522 FB_IE_INIT_FULL(
"imapCommand",
CERT_PEN, 140, FB_IE_VARLEN, NONE,
523 0, 0, FB_STRING, NULL),
524 FB_IE_INIT_FULL(
"imapExists",
CERT_PEN, 141, FB_IE_VARLEN, NONE,
525 0, 0, FB_STRING, NULL),
526 FB_IE_INIT_FULL(
"imapRecent",
CERT_PEN, 142, FB_IE_VARLEN, NONE,
527 0, 0, FB_STRING, NULL),
529 FB_IE_INIT_FULL(
"rtspURL",
CERT_PEN, 143, FB_IE_VARLEN, NONE,
530 0, 0, FB_STRING, NULL),
531 FB_IE_INIT_FULL(
"rtspVersion",
CERT_PEN, 144, FB_IE_VARLEN, NONE,
532 0, 0, FB_STRING, NULL),
533 FB_IE_INIT_FULL(
"rtspReturnCode",
CERT_PEN, 145, FB_IE_VARLEN, NONE,
534 0, 0, FB_STRING, NULL),
535 FB_IE_INIT_FULL(
"rtspContentLength",
CERT_PEN, 146, FB_IE_VARLEN, NONE,
536 0, 0, FB_STRING, NULL),
537 FB_IE_INIT_FULL(
"rtspCommand",
CERT_PEN, 147, FB_IE_VARLEN, NONE,
538 0, 0, FB_STRING, NULL),
539 FB_IE_INIT_FULL(
"rtspContentType",
CERT_PEN, 148, FB_IE_VARLEN, NONE,
540 0, 0, FB_STRING, NULL),
541 FB_IE_INIT_FULL(
"rtspTransport",
CERT_PEN, 149, FB_IE_VARLEN, NONE,
542 0, 0, FB_STRING, NULL),
543 FB_IE_INIT_FULL(
"rtspCSeq",
CERT_PEN, 150, FB_IE_VARLEN, NONE,
544 0, 0, FB_STRING, NULL),
545 FB_IE_INIT_FULL(
"rtspLocation",
CERT_PEN, 151, FB_IE_VARLEN, NONE,
546 0, 0, FB_STRING, NULL),
547 FB_IE_INIT_FULL(
"rtspPacketsReceived",
CERT_PEN, 152, FB_IE_VARLEN, NONE,
548 0, 0, FB_STRING, NULL),
549 FB_IE_INIT_FULL(
"rtspUserAgent",
CERT_PEN, 153, FB_IE_VARLEN, NONE,
550 0, 0, FB_STRING, NULL),
551 FB_IE_INIT_FULL(
"rtspJitter",
CERT_PEN, 154, FB_IE_VARLEN, NONE,
552 0, 0, FB_STRING, NULL),
554 FB_IE_INIT_FULL(
"sipInvite",
CERT_PEN, 155, FB_IE_VARLEN, NONE,
555 0, 0, FB_STRING, NULL),
556 FB_IE_INIT_FULL(
"sipCommand",
CERT_PEN, 156, FB_IE_VARLEN, NONE,
557 0, 0, FB_STRING, NULL),
558 FB_IE_INIT_FULL(
"sipVia",
CERT_PEN, 157, FB_IE_VARLEN, NONE,
559 0, 0, FB_STRING, NULL),
560 FB_IE_INIT_FULL(
"sipMaxForwards",
CERT_PEN, 158, FB_IE_VARLEN, NONE,
561 0, 0, FB_STRING, NULL),
562 FB_IE_INIT_FULL(
"sipAddress",
CERT_PEN, 159, FB_IE_VARLEN, NONE,
563 0, 0, FB_STRING, NULL),
564 FB_IE_INIT_FULL(
"sipContentLength",
CERT_PEN, 160, FB_IE_VARLEN, NONE,
565 0, 0, FB_STRING, NULL),
566 FB_IE_INIT_FULL(
"sipUserAgent",
CERT_PEN, 161, FB_IE_VARLEN, NONE,
567 0, 0, FB_STRING, NULL),
569 FB_IE_INIT_FULL(
"smtpHello",
CERT_PEN, 162, FB_IE_VARLEN, NONE,
570 0, 0, FB_STRING, NULL),
571 FB_IE_INIT_FULL(
"smtpFrom",
CERT_PEN, 163, FB_IE_VARLEN, NONE,
572 0, 0, FB_STRING, NULL),
573 FB_IE_INIT_FULL(
"smtpTo",
CERT_PEN, 164, FB_IE_VARLEN, NONE,
574 0, 0, FB_STRING, NULL),
575 FB_IE_INIT_FULL(
"smtpContentType",
CERT_PEN, 165, FB_IE_VARLEN, NONE,
576 0, 0, FB_STRING, NULL),
577 FB_IE_INIT_FULL(
"smtpSubject",
CERT_PEN, 166, FB_IE_VARLEN, NONE,
578 0, 0, FB_STRING, NULL),
579 FB_IE_INIT_FULL(
"smtpFilename",
CERT_PEN, 167, FB_IE_VARLEN, NONE,
580 0, 0, FB_STRING, NULL),
581 FB_IE_INIT_FULL(
"smtpContentDisposition",
CERT_PEN, 168, FB_IE_VARLEN,
582 NONE, 0, 0, FB_STRING, NULL),
583 FB_IE_INIT_FULL(
"smtpResponse",
CERT_PEN, 169, FB_IE_VARLEN, NONE,
584 0, 0, FB_STRING, NULL),
585 FB_IE_INIT_FULL(
"smtpEnhanced",
CERT_PEN, 170, FB_IE_VARLEN, NONE,
586 0, 0, FB_STRING, NULL),
587 FB_IE_INIT_FULL(
"smtpSize",
CERT_PEN, 222, FB_IE_VARLEN, NONE,
588 0, 0, FB_STRING, NULL),
589 FB_IE_INIT_FULL(
"smtpDate",
CERT_PEN, 251, FB_IE_VARLEN, NONE,
590 0, 0, FB_STRING, NULL),
592 FB_IE_INIT_FULL(
"sshVersion",
CERT_PEN, 171, FB_IE_VARLEN, NONE,
593 0, 0, FB_STRING, NULL),
595 FB_IE_INIT_FULL(
"nntpResponse",
CERT_PEN, 172, FB_IE_VARLEN, NONE,
596 0, 0, FB_STRING, NULL),
597 FB_IE_INIT_FULL(
"nntpCommand",
CERT_PEN, 173, FB_IE_VARLEN, NONE,
598 0, 0, FB_STRING, NULL),
600 FB_IE_INIT_FULL(
"dnsQueryResponse",
CERT_PEN, 174, 1, FB_IE_F_ENDIAN,
601 0, 0, FB_UINT_8, NULL),
602 FB_IE_INIT_FULL(
"dnsQRType",
CERT_PEN, 175, 2, FB_IE_F_ENDIAN,
603 0, 0, FB_UINT_16, NULL),
604 FB_IE_INIT_FULL(
"dnsAuthoritative",
CERT_PEN, 176, 1, FB_IE_F_ENDIAN,
605 0, 0, FB_UINT_8, NULL),
606 FB_IE_INIT_FULL(
"dnsNXDomain",
CERT_PEN, 177, 1, FB_IE_F_ENDIAN,
607 0, 0, FB_UINT_8, NULL),
608 FB_IE_INIT_FULL(
"dnsRRSection",
CERT_PEN, 178, 1, FB_IE_F_ENDIAN,
609 0, 0, FB_UINT_8, NULL),
610 FB_IE_INIT_FULL(
"dnsQName",
CERT_PEN, 179, FB_IE_VARLEN, NONE,
611 0, 0, FB_STRING, NULL),
612 FB_IE_INIT_FULL(
"dnsCName",
CERT_PEN, 180, FB_IE_VARLEN, NONE,
613 0, 0, FB_STRING, NULL),
614 FB_IE_INIT_FULL(
"dnsMXPreference",
CERT_PEN, 181, 2, FB_IE_F_ENDIAN,
615 0, 0, FB_STRING, NULL),
616 FB_IE_INIT_FULL(
"dnsMXExchange",
CERT_PEN, 182, FB_IE_VARLEN, NONE,
617 0, 0, FB_STRING, NULL),
618 FB_IE_INIT_FULL(
"dnsNSDName",
CERT_PEN, 183, FB_IE_VARLEN, NONE,
619 0, 0, FB_STRING, NULL),
620 FB_IE_INIT_FULL(
"dnsPTRDName",
CERT_PEN, 184, FB_IE_VARLEN, NONE,
621 0, 0, FB_STRING, NULL),
622 FB_IE_INIT_FULL(
"dnsTTL",
CERT_PEN, 199, 4, FB_IE_F_ENDIAN,
623 0, 0, FB_UINT_32, NULL),
624 FB_IE_INIT_FULL(
"dnsTXTData",
CERT_PEN, 208, FB_IE_VARLEN, NONE,
625 0, 0, FB_STRING, NULL),
626 FB_IE_INIT_FULL(
"dnsSOASerial",
CERT_PEN, 209, 4, FB_IE_F_ENDIAN,
627 0, 0, FB_UINT_32, NULL),
628 FB_IE_INIT_FULL(
"dnsSOARefresh",
CERT_PEN, 210, 4, FB_IE_F_ENDIAN,
629 0, 0, FB_UINT_32, NULL),
630 FB_IE_INIT_FULL(
"dnsSOARetry",
CERT_PEN, 211, 4, FB_IE_F_ENDIAN,
631 0, 0, FB_UINT_32, NULL),
632 FB_IE_INIT_FULL(
"dnsSOAExpire",
CERT_PEN, 212, 4, FB_IE_F_ENDIAN,
633 0, 0, FB_UINT_32, NULL),
634 FB_IE_INIT_FULL(
"dnsSOAMinimum",
CERT_PEN, 213, 4, FB_IE_F_ENDIAN,
635 0, 0, FB_UINT_32, NULL),
636 FB_IE_INIT_FULL(
"dnsSOAMName",
CERT_PEN, 214, FB_IE_VARLEN, NONE,
637 0, 0, FB_STRING, NULL),
638 FB_IE_INIT_FULL(
"dnsSOARName",
CERT_PEN, 215, FB_IE_VARLEN, NONE,
639 0, 0, FB_STRING, NULL),
640 FB_IE_INIT_FULL(
"dnsSRVPriority",
CERT_PEN, 216, 2, FB_IE_F_ENDIAN,
641 0, 0, FB_UINT_16, NULL),
642 FB_IE_INIT_FULL(
"dnsSRVWeight",
CERT_PEN, 217, 2, FB_IE_F_ENDIAN,
643 0, 0, FB_UINT_16, NULL),
644 FB_IE_INIT_FULL(
"dnsSRVPort",
CERT_PEN, 218, 2, FB_IE_F_ENDIAN,
645 0, 0, FB_UINT_16, NULL),
646 FB_IE_INIT_FULL(
"dnsSRVTarget",
CERT_PEN, 219, FB_IE_VARLEN, NONE,
647 0, 0, FB_STRING, NULL),
648 FB_IE_INIT_FULL(
"dnsID",
CERT_PEN, 226, 2, FB_IE_F_ENDIAN,
649 0, 0, FB_UINT_16, NULL),
651 FB_IE_INIT_FULL(
"dnsAlgorithm",
CERT_PEN, 227, 1, FB_IE_F_ENDIAN,
652 0, 0, FB_UINT_8, NULL),
653 FB_IE_INIT_FULL(
"dnsKeyTag",
CERT_PEN, 228, 2, FB_IE_F_ENDIAN,
654 0, 0, FB_UINT_16, NULL),
655 FB_IE_INIT_FULL(
"dnsSigner",
CERT_PEN, 229, FB_IE_VARLEN, NONE,
656 0, 0, FB_STRING, NULL),
657 FB_IE_INIT_FULL(
"dnsSignature",
CERT_PEN, 230, FB_IE_VARLEN, NONE,
658 0, 0, FB_OCTET_ARRAY, NULL),
659 FB_IE_INIT_FULL(
"dnsDigest",
CERT_PEN, 231, FB_IE_VARLEN, NONE,
660 0, 0, FB_OCTET_ARRAY, NULL),
661 FB_IE_INIT_FULL(
"dnsPublicKey",
CERT_PEN, 232, FB_IE_VARLEN, NONE,
662 0, 0, FB_OCTET_ARRAY, NULL),
663 FB_IE_INIT_FULL(
"dnsSalt",
CERT_PEN, 233, FB_IE_VARLEN, NONE,
664 0, 0, FB_OCTET_ARRAY, NULL),
665 FB_IE_INIT_FULL(
"dnsHashData",
CERT_PEN, 234, FB_IE_VARLEN, NONE,
666 0, 0, FB_OCTET_ARRAY, NULL),
667 FB_IE_INIT_FULL(
"dnsIterations",
CERT_PEN, 235, 2, FB_IE_F_ENDIAN,
668 0, 0, FB_UINT_16, NULL),
669 FB_IE_INIT_FULL(
"dnsSignatureExpiration",
CERT_PEN, 236, 4,
670 FB_IE_F_ENDIAN, 0, 0, FB_UINT_32, NULL),
671 FB_IE_INIT_FULL(
"dnsSignatureInception",
CERT_PEN, 237, 4, FB_IE_F_ENDIAN,
672 0, 0, FB_UINT_32, NULL),
673 FB_IE_INIT_FULL(
"dnsDigestType",
CERT_PEN, 238, 1, FB_IE_F_ENDIAN,
674 0, 0, FB_UINT_8, NULL),
675 FB_IE_INIT_FULL(
"dnsLabels",
CERT_PEN, 239, 1, FB_IE_F_ENDIAN,
676 0, 0, FB_UINT_8, NULL),
677 FB_IE_INIT_FULL(
"dnsTypeCovered",
CERT_PEN, 240, 2, FB_IE_F_ENDIAN,
678 0, 0, FB_UINT_16, NULL),
679 FB_IE_INIT_FULL(
"dnsFlags",
CERT_PEN, 241, 2,
680 FB_IE_F_ENDIAN | FB_IE_FLAGS, 0, 0, FB_UINT_16, NULL),
682 FB_IE_INIT_FULL(
"sslCipher",
CERT_PEN, 185, 4, FB_IE_F_ENDIAN,
683 0, 0, FB_UINT_32, NULL),
684 FB_IE_INIT_FULL(
"sslClientVersion",
CERT_PEN, 186, 1, FB_IE_F_ENDIAN,
685 0, 0, FB_UINT_8, NULL),
686 FB_IE_INIT_FULL(
"sslServerCipher",
CERT_PEN, 187, 4, FB_IE_F_ENDIAN,
687 0, 0, FB_UINT_32, NULL),
688 FB_IE_INIT_FULL(
"sslCompressionMethod",
CERT_PEN, 188, 1, FB_IE_F_ENDIAN,
689 0, 0, FB_UINT_8, NULL),
690 FB_IE_INIT_FULL(
"sslCertVersion",
CERT_PEN, 189, 1, FB_IE_F_ENDIAN,
691 0, 0, FB_UINT_8, NULL),
692 FB_IE_INIT_FULL(
"sslCertSignature",
CERT_PEN, 190, FB_IE_VARLEN, NONE,
693 0, 0, FB_OCTET_ARRAY, NULL),
694 FB_IE_INIT_FULL(
"sslCertSerialNumber",
CERT_PEN, 244, FB_IE_VARLEN, NONE,
695 0, 0, FB_STRING, NULL),
696 FB_IE_INIT_FULL(
"sslObjectType",
CERT_PEN, 245, 1, FB_IE_F_ENDIAN,
697 0, 0, FB_UINT_8, NULL),
698 FB_IE_INIT_FULL(
"sslObjectValue",
CERT_PEN, 246, FB_IE_VARLEN, NONE,
699 0, 0, FB_OCTET_ARRAY, NULL),
700 FB_IE_INIT_FULL(
"sslCertValidityNotBefore",
CERT_PEN, 247, FB_IE_VARLEN,
701 NONE, 0, 0, FB_STRING, NULL),
702 FB_IE_INIT_FULL(
"sslCertValidityNotAfter",
CERT_PEN, 248, FB_IE_VARLEN,
703 NONE, 0, 0, FB_STRING, NULL),
704 FB_IE_INIT_FULL(
"sslPublicKeyAlgorithm",
CERT_PEN, 249, FB_IE_VARLEN,
705 NONE, 0, 0, FB_OCTET_ARRAY, NULL),
706 FB_IE_INIT_FULL(
"sslPublicKeyLength",
CERT_PEN, 250, 2, FB_IE_F_ENDIAN,
707 0, 0, FB_UINT_16, NULL),
709 FB_IE_INIT_FULL(
"mysqlUsername",
CERT_PEN, 223, FB_IE_VARLEN, NONE,
710 0, 0, FB_STRING, NULL),
711 FB_IE_INIT_FULL(
"mysqlCommandCode",
CERT_PEN, 224, 1, FB_IE_F_ENDIAN,
712 0, 0, FB_UINT_8, NULL),
713 FB_IE_INIT_FULL(
"mysqlCommandText",
CERT_PEN, 225, FB_IE_VARLEN, NONE,
714 0, 0, FB_STRING, NULL),
716 FB_IE_INIT_FULL(
"dnp3SourceAddress",
CERT_PEN, 281, 2, FB_IE_F_ENDIAN,
717 0, 0, FB_UINT_16, NULL),
718 FB_IE_INIT_FULL(
"dnp3DestinationAddress",
CERT_PEN, 282, 2,
719 FB_IE_F_ENDIAN, 0, 0, FB_UINT_16, NULL),
720 FB_IE_INIT_FULL(
"dnp3Function",
CERT_PEN, 283, 1, FB_IE_F_ENDIAN,
721 0, 0, FB_UINT_8, NULL),
722 FB_IE_INIT_FULL(
"dnp3ObjectData",
CERT_PEN, 284, FB_IE_VARLEN, NONE,
723 0, 0, FB_OCTET_ARRAY, NULL),
724 FB_IE_INIT_FULL(
"modbusData",
CERT_PEN, 285, FB_IE_VARLEN, NONE,
725 0, 0, FB_OCTET_ARRAY, NULL),
726 FB_IE_INIT_FULL(
"ethernetIPData",
CERT_PEN, 286, FB_IE_VARLEN, NONE,
727 0, 0, FB_OCTET_ARRAY, NULL),
728 FB_IE_INIT_FULL(
"rtpPayloadType",
CERT_PEN, 287, 1, ER,
729 0, 0, FB_UINT_8, NULL),
730 FB_IE_INIT_FULL(
"sslRecordVersion",
CERT_PEN, 288, 2, FB_IE_F_ENDIAN,
731 0, 0, FB_UINT_16, NULL),
735 static fbInfoElement_t yaf_dhcp_info_elements[] = {
736 FB_IE_INIT_FULL(
"dhcpFingerPrint",
CERT_PEN, 242, FB_IE_VARLEN,
737 FB_IE_F_REVERSIBLE, 0, 0, FB_STRING, NULL),
738 FB_IE_INIT_FULL(
"dhcpVendorCode",
CERT_PEN, 243, FB_IE_VARLEN,
739 FB_IE_F_REVERSIBLE, 0, 0, FB_STRING, NULL),
#define CERT_PEN
This is the CERT Private Enterprise Number (PEN) assigned by IANA, used to define our enterprise data...
Definition: yafcore.h:110