DCE_RPC PType enums inaccurate

Description

The PType enum for DCE_RPC (https://github.com/bro/bro/blob/master/src/analyzer/protocol/dce-rpc/types.bif) seems to be based off of the RPC PDU Type table listed here: http://pubs.opengroup.org/onlinepubs/9629399/chap12.htm

Unfortunately, that table skips type 16 (AUTH3), so SHUTDOWN, CO_CANCEL, and ORPHANED all receive the wrong value. Additionally, there appears to be an additional value of RTS per this source: https://github.com/boundary/wireshark/blob/master/epan/dissectors/packet-dcerpc.h#L108

I am unaware of any errors caused by this issue. However, correcting the PType is necessary to extend the functionality of DCE_RPC.

Environment

None

Assignee

Unassigned

Reporter

David Gainey

Labels

External issue ID

None

Components

Fix versions

Affects versions

Priority

Normal
Configure