base/protocols/radius/main.bro

RADIUS

Implements base functionality for RADIUS analysis. Generates the radius.log file.

Namespace:RADIUS
Imports:base/protocols/radius/consts.bro, base/utils/addrs.bro
Source File:/scripts/base/protocols/radius/main.bro

Summary

Options

RADIUS::expiration_interval: interval &redef The amount of time we wait for an authentication response before expiring it.

Types

RADIUS::Info: record  

Redefinitions

Log::ID: enum  
connection: record  

Events

RADIUS::log_radius: event Event that can be handled to access the RADIUS record as it is sent on to the loggin framework.

Functions

RADIUS::expire: function Logs an authentication attempt if we didn’t see a response in time.

Detailed Interface

Options

RADIUS::expiration_interval
Type:interval
Attributes:&redef
Default:10.0 secs

The amount of time we wait for an authentication response before expiring it.

Types

RADIUS::Info
Type:

record

ts: time &log

Timestamp for when the event happened.

uid: string &log

Unique ID for the connection.

id: conn_id &log

The connection’s 4-tuple of endpoint addresses/ports.

username: string &log &optional

The username, if present.

mac: string &log &optional

MAC address, if present.

remote_ip: addr &log &optional

Remote IP address, if present.

connect_info: string &log &optional

Connect info, if present.

result: string &log &optional

Successful or failed authentication.

logged: bool &optional

Whether this has already been logged and can be ignored.

Events

RADIUS::log_radius
Type:event (rec: RADIUS::Info)

Event that can be handled to access the RADIUS record as it is sent on to the loggin framework.

Functions

RADIUS::expire
Type:function (t: table [count] of RADIUS::Info, idx: count) : interval

Logs an authentication attempt if we didn’t see a response in time.

T:A table of Info records.
Idx:The index of the connection$radius table corresponding to the radius authentication about to expire.
Returns:0secs, which when this function is used as an &expire_func, indicates to remove the element at idx immediately.
Copyright 2013, The Bro Project. Last updated on July 19, 2016. Created using Sphinx 1.4.4.