Next: , Previous: port-namesbro, Up: Predefined Variables



6.1.25 portmapper.bro

rpc_programs : table[count] of string
A table correlating numeric RPC service IDs to string names of the services, e.g., [1000000] = ``portmapper''.

NFS_services : set[string]

A set of string names of NFS-related RPC services.
Note: This variable is const, so may only be changed via redef.

RPC_okay : set[addr, addr, string]

Indexed by the host providing the service, the host requesting it, and the service; do not log Sun portmapper requests from the specified requestor to the specified provider for the specified service.
Note: This variable is const, so may only be changed via redef.

RPC_okay_nets : set[net]

Hosts in any of the networks in this set may make portmapper requests without being flagged.
Note: This variable is const, so may only be changed via redef.

RPC_okay_services : set[string]

Requests for services in this set will not be flagged.
Note: This variable is const, so may only be changed via redef.

NFS_world_servers : set[addr]

Any host may request NFS services from any of the machines in this set without being flagged..
Note: This variable is const, so may only be changed via redef.

any_RPC_okay : set[addr, string]

Indexed by the service provider and the service (in string form); any host may access these services without being flagged.
Note: This variable is const, so may only be changed via redef.

RPC_dump_okay : set[addr, addr]

Indexed by requesting host and providing host, respectively; dumps of RPC portmaps are allowed between these pairs.
Note: This variable is const, so may only be changed via redef.

RPC_do_not_complain : set[string, bool]

Indexed by the portmapper request and a boolean that's T if the request was answered, F it was attempted but not answered. If there's an entry in the set matching the current request/attempt, then the access won't be logged (unless the connection is hot for some other reason).

suppress_pm_log : set[addr, string]

Indexed by source and portmapper service. If set, we already logged and shouldn't do so again. Fixme: Presumably this can be preloaded with stuff, or we wouldn't need to document it.