dcerpc

Documentation

Index

• Variables

Variables

var Decoder = &decoder.StreamDecoder{
	Type:        types.Type_NC_DCERPC,
	Name:        serviceDCERPC,
	Description: "DCE/RPC is the remote procedure call system used by Windows for DCOM and Active Directory services",
	PostInit: func(d *decoder.StreamDecoder) error {
		var err error
		dcerpcLog, _, err = logging.InitZapLogger(
			decoderconfig.Instance.Out,
			"dcerpc",
			decoderconfig.Instance.Debug,
		)
		return err
	},
	CanDecode: func(client, server []byte) bool {
		return isDCERPC(client) || isDCERPC(server)
	},
	DeInit: func(sd *decoder.StreamDecoder) error {
		return dcerpcLog.Sync()
	},
	Factory: &dcerpcReader{},
	Typ:     core.TCP,
}

Decoder for protocol analysis and writing audit records to disk.