DCE_RPC PType enums inaccurate

Description

The PType enum for DCE_RPC (https://github.com/bro/bro/blob/master/src/analyzer/protocol/dce-rpc/types.bif) seems to be based off of the RPC PDU Type table listed here: http://pubs.opengroup.org/onlinepubs/9629399/chap12.htm

Unfortunately, that table skips type 16 (AUTH3), so SHUTDOWN, CO_CANCEL, and ORPHANED all receive the wrong value. Additionally, there appears to be an additional value of RTS per this source: https://github.com/boundary/wireshark/blob/master/epan/dissectors/packet-dcerpc.h#L108

I am unaware of any errors caused by this issue. However, correcting the PType is necessary to extend the functionality of DCE_RPC.

Environment

None

Activity

Show:
David Gainey
September 26, 2017, 12:24 AM

Another enum that needs to be expanded with the same values: https://github.com/bro/bro/blob/master/src/analyzer/protocol/dce-rpc/dce_rpc-protocol.pac

Fixed

Assignee

Unassigned

Reporter

David Gainey

Labels

External issue ID

None

Components

Fix versions

Affects versions

Priority

Normal