spp_dce2.c

snort2.8.4版本

                        _dpd.logMsg("          Other: "STDu64"\n", dce2_stats.smb_openx_req_chained_other);
                }
                _dpd.logMsg("        Open AndX responses: "STDu64"\n", dce2_stats.smb_openx_resp);
                if (dce2_stats.smb_openx_chained > 0)
                {
                    _dpd.logMsg("        Open AndX chained responses\n");
                    if (dce2_stats.smb_openx_resp_chained_ssx > 0)
                        _dpd.logMsg("          Session Setup AndX: "STDu64"\n", dce2_stats.smb_openx_resp_chained_ssx);
                    if (dce2_stats.smb_openx_resp_chained_loffx > 0)
                        _dpd.logMsg("          Logoff AndX: "STDu64"\n", dce2_stats.smb_openx_resp_chained_loffx);
                    if (dce2_stats.smb_openx_resp_chained_tc > 0)
                        _dpd.logMsg("          Tree Connect: "STDu64"\n", dce2_stats.smb_openx_resp_chained_tc);
                    if (dce2_stats.smb_openx_resp_chained_tcx > 0)
                        _dpd.logMsg("          Tree Connect AndX: "STDu64"\n", dce2_stats.smb_openx_resp_chained_tcx);
                    if (dce2_stats.smb_openx_resp_chained_tdis > 0)
                        _dpd.logMsg("          Tree Disconnect: "STDu64"\n", dce2_stats.smb_openx_resp_chained_tdis);
                    if (dce2_stats.smb_openx_resp_chained_open > 0)
                        _dpd.logMsg("          Open: "STDu64"\n", dce2_stats.smb_openx_resp_chained_open);
                    if (dce2_stats.smb_openx_resp_chained_openx > 0)
                        _dpd.logMsg("          Open AndX: "STDu64"\n", dce2_stats.smb_openx_resp_chained_openx);
                    if (dce2_stats.smb_openx_resp_chained_ntcx > 0)
                        _dpd.logMsg("          Nt Create AndX: "STDu64"\n", dce2_stats.smb_openx_resp_chained_ntcx);
                    if (dce2_stats.smb_openx_resp_chained_close > 0)
                        _dpd.logMsg("          Close: "STDu64"\n", dce2_stats.smb_openx_resp_chained_close);
                    if (dce2_stats.smb_openx_resp_chained_write > 0)
                        _dpd.logMsg("          Write: "STDu64"\n", dce2_stats.smb_openx_resp_chained_write);
                    if (dce2_stats.smb_openx_resp_chained_readx > 0)
                        _dpd.logMsg("          Read AndX: "STDu64"\n", dce2_stats.smb_openx_resp_chained_readx);
                    if (dce2_stats.smb_openx_resp_chained_other > 0)
                        _dpd.logMsg("          Other: "STDu64"\n", dce2_stats.smb_openx_resp_chained_other);
                }
            }

            if ((dce2_stats.smb_ntcx_req > 0) || (dce2_stats.smb_ntcx_resp > 0))
            {
                _dpd.logMsg("        Nt Create AndX requests: "STDu64"\n", dce2_stats.smb_ntcx_req);
                if (dce2_stats.smb_ntcx_chained > 0)
                {
                    _dpd.logMsg("        Nt Create AndX chained requests\n");
                    if (dce2_stats.smb_ntcx_req_chained_ssx > 0)
                        _dpd.logMsg("          Session Setup AndX: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_ssx);
                    if (dce2_stats.smb_ntcx_req_chained_loffx > 0)
                        _dpd.logMsg("          Logoff AndX: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_loffx);
                    if (dce2_stats.smb_ntcx_req_chained_tc > 0)
                        _dpd.logMsg("          Tree Connect: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_tc);
                    if (dce2_stats.smb_ntcx_req_chained_tcx > 0)
                        _dpd.logMsg("          Tree Connect AndX: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_tcx);
                    if (dce2_stats.smb_ntcx_req_chained_tdis > 0)
                        _dpd.logMsg("          Tree Disconnect: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_tdis);
                    if (dce2_stats.smb_ntcx_req_chained_open > 0)
                        _dpd.logMsg("          Open: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_open);
                    if (dce2_stats.smb_ntcx_req_chained_openx > 0)
                        _dpd.logMsg("          Open AndX: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_openx);
                    if (dce2_stats.smb_ntcx_req_chained_ntcx > 0)
                        _dpd.logMsg("          Nt Create AndX: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_ntcx);
                    if (dce2_stats.smb_ntcx_req_chained_close > 0)
                        _dpd.logMsg("          Close: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_close);
                    if (dce2_stats.smb_ntcx_req_chained_write > 0)
                        _dpd.logMsg("          Write: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_write);
                    if (dce2_stats.smb_ntcx_req_chained_readx > 0)
                        _dpd.logMsg("          Read AndX: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_readx);
                    if (dce2_stats.smb_ntcx_req_chained_other > 0)
                        _dpd.logMsg("          Other: "STDu64"\n", dce2_stats.smb_ntcx_req_chained_other);
                }
                _dpd.logMsg("        Nt Create AndX responses: "STDu64"\n", dce2_stats.smb_ntcx_resp);
                if (dce2_stats.smb_ntcx_chained > 0)
                {
                    _dpd.logMsg("        Nt Create AndX chained responses\n");
                    if (dce2_stats.smb_ntcx_resp_chained_ssx > 0)
                        _dpd.logMsg("          Session Setup AndX: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_ssx);
                    if (dce2_stats.smb_ntcx_resp_chained_loffx > 0)
                        _dpd.logMsg("          Logoff AndX: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_loffx);
                    if (dce2_stats.smb_ntcx_resp_chained_tc > 0)
                        _dpd.logMsg("          Tree Connect: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_tc);
                    if (dce2_stats.smb_ntcx_resp_chained_tcx > 0)
                        _dpd.logMsg("          Tree Connect AndX: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_tcx);
                    if (dce2_stats.smb_ntcx_resp_chained_tdis > 0)
                        _dpd.logMsg("          Tree Disconnect: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_tdis);
                    if (dce2_stats.smb_ntcx_resp_chained_open > 0)
                        _dpd.logMsg("          Open: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_open);
                    if (dce2_stats.smb_ntcx_resp_chained_openx > 0)
                        _dpd.logMsg("          Open AndX: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_openx);
                    if (dce2_stats.smb_ntcx_resp_chained_ntcx > 0)
                        _dpd.logMsg("          Nt Create AndX: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_ntcx);
                    if (dce2_stats.smb_ntcx_resp_chained_close > 0)
                        _dpd.logMsg("          Close: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_close);
                    if (dce2_stats.smb_ntcx_resp_chained_write > 0)
                        _dpd.logMsg("          Write: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_write);
                    if (dce2_stats.smb_ntcx_resp_chained_readx > 0)
                        _dpd.logMsg("          Read AndX: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_readx);
                    if (dce2_stats.smb_ntcx_resp_chained_other > 0)
                        _dpd.logMsg("          Other: "STDu64"\n", dce2_stats.smb_ntcx_resp_chained_other);
                }
            }

            if ((dce2_stats.smb_close_req > 0) || (dce2_stats.smb_close_resp > 0))
            {
                _dpd.logMsg("        Close requests: "STDu64"\n", dce2_stats.smb_close_req);
                _dpd.logMsg("        Close responses: "STDu64"\n", dce2_stats.smb_close_resp);
            }

            if ((dce2_stats.smb_trans_req > 0) || (dce2_stats.smb_trans_resp > 0))
            {
                _dpd.logMsg("        Transact requests: "STDu64"\n", dce2_stats.smb_trans_req);
                if (dce2_stats.smb_trans_sec_req > 0)
                    _dpd.logMsg("        Transact Secondary requests: "STDu64"\n", dce2_stats.smb_trans_sec_req);
                _dpd.logMsg("        Transact responses: "STDu64"\n", dce2_stats.smb_trans_resp);
            }

            if ((dce2_stats.smb_write_req > 0) || (dce2_stats.smb_write_resp > 0))
            {
                _dpd.logMsg("        Write requests: "STDu64"\n", dce2_stats.smb_write_req);
                _dpd.logMsg("        Write responses: "STDu64"\n", dce2_stats.smb_write_resp);
            }

            if ((dce2_stats.smb_writebr_req > 0) || (dce2_stats.smb_writebr_resp > 0))
            {
                _dpd.logMsg("        Write Block Raw requests: "STDu64"\n", dce2_stats.smb_writebr_req);
                _dpd.logMsg("        Write Block Raw responses: "STDu64"\n", dce2_stats.smb_writebr_resp);
            }

            if ((dce2_stats.smb_writex_req > 0) || (dce2_stats.smb_writex_resp > 0))
            {
                _dpd.logMsg("        Write AndX requests: "STDu64"\n", dce2_stats.smb_writex_req);
                if (dce2_stats.smb_writex_chained > 0)
                {
                    _dpd.logMsg("        Write AndX chained requests\n");
                    if (dce2_stats.smb_writex_req_chained_ssx > 0)
                        _dpd.logMsg("          Session Setup AndX: "STDu64"\n", dce2_stats.smb_writex_req_chained_ssx);
                    if (dce2_stats.smb_writex_req_chained_loffx > 0)
                        _dpd.logMsg("          Logoff AndX: "STDu64"\n", dce2_stats.smb_writex_req_chained_loffx);
                    if (dce2_stats.smb_writex_req_chained_tc > 0)
                        _dpd.logMsg("          Tree Connect: "STDu64"\n", dce2_stats.smb_writex_req_chained_tc);
                    if (dce2_stats.smb_writex_req_chained_tcx > 0)
                        _dpd.logMsg("          Tree Connect AndX: "STDu64"\n", dce2_stats.smb_writex_req_chained_tcx);
                    if (dce2_stats.smb_writex_req_chained_openx > 0)
                        _dpd.logMsg("          Open AndX: "STDu64"\n", dce2_stats.smb_writex_req_chained_openx);
                    if (dce2_stats.smb_writex_req_chained_writex > 0)
                        _dpd.logMsg("          Nt Create AndX: "STDu64"\n", dce2_stats.smb_writex_req_chained_writex);
                    if (dce2_stats.smb_writex_req_chained_close > 0)
                        _dpd.logMsg("          Close: "STDu64"\n", dce2_stats.smb_writex_req_chained_close);
                    if (dce2_stats.smb_writex_req_chained_write > 0)
                        _dpd.logMsg("          Write: "STDu64"\n", dce2_stats.smb_writex_req_chained_write);
                    if (dce2_stats.smb_writex_req_chained_writex > 0)
                        _dpd.logMsg("          Write AndX: "STDu64"\n", dce2_stats.smb_writex_req_chained_writex);
                    if (dce2_stats.smb_writex_req_chained_read > 0)
                        _dpd.logMsg("          Read: "STDu64"\n", dce2_stats.smb_writex_req_chained_read);
                    if (dce2_stats.smb_writex_req_chained_readx > 0)
                        _dpd.logMsg("          Read AndX: "STDu64"\n", dce2_stats.smb_writex_req_chained_readx);
                    if (dce2_stats.smb_writex_req_chained_other > 0)
                        _dpd.logMsg("          Other: "STDu64"\n", dce2_stats.smb_writex_req_chained_other);
                }
                _dpd.logMsg("        Write AndX responses: "STDu64"\n", dce2_stats.smb_writex_resp);
                if (dce2_stats.smb_writex_chained > 0)
                {
                    _dpd.logMsg("        Write AndX chained responses\n");
                    if (dce2_stats.smb_writex_resp_chained_ssx > 0)
                        _dpd.logMsg("          Session Setup AndX: "STDu64"\n", dce2_stats.smb_writex_resp_chained_ssx);
                    if (dce2_stats.smb_writex_resp_chained_loffx > 0)
                        _dpd.logMsg("          Logoff AndX: "STDu64"\n", dce2_stats.smb_writex_resp_chained_loffx);
                    if (dce2_stats.smb_writex_resp_chained_tc > 0)
                        _dpd.logMsg("          Tree Connect: "STDu64"\n", dce2_stats.smb_writex_resp_chained_tc);
                    if (dce2_stats.smb_writex_resp_chained_tcx > 0)
                        _dpd.logMsg("          Tree Connect AndX: "STDu64"\n", dce2_stats.smb_writex_resp_chained_tcx);
                    if (dce2_stats.smb_writex_resp_chained_openx > 0)
                        _dpd.logMsg("          Open AndX: "STDu64"\n", dce2_stats.smb_writex_resp_chained_openx);
                    if (dce2_stats.smb_writex_resp_chained_writex > 0)
                        _dpd.logMsg("          Nt Create AndX: "STDu64"\n", dce2_stats.smb_writex_resp_chained_writex);
                    if (dce2_stats.smb_writex_resp_chained_close > 0)
                        _dpd.logMsg("          Close: "STDu64"\n", dce2_stats.smb_writex_resp_chained_close);
                    if (dce2_stats.smb_writex_resp_chained_write > 0)
                        _dpd.logMsg("          Write: "STDu64"\n", dce2_stats.smb_writex_resp_chained_write);
                    if (dce2_stats.smb_writex_resp_chained_writex > 0)
                        _dpd.logMsg("          Write AndX: "STDu64"\n", dce2_stats.smb_writex_resp_chained_writex);
                    if (dce2_stats.smb_writex_resp_chained_read > 0)
                        _dpd.logMsg("          Read: "STDu64"\n", dce2_stats.smb_writex_resp_chained_read);
                    if (dce2_stats.smb_writex_resp_chained_readx > 0)
                        _dpd.logMsg("          Read AndX: "STDu64"\n", dce2_stats.smb_writex_resp_chained_readx);
                    if (dce2_stats.smb_writex_resp_chained_other > 0)
                        _dpd.logMsg("          Other: "STDu64"\n", dce2_stats.smb_writex_resp_chained_other);
                }
            }

            if ((dce2_stats.smb_writeclose_req > 0) || (dce2_stats.smb_writeclose_resp > 0))
            {
                _dpd.logMsg("        Write and Close requests: "STDu64"\n", dce2_stats.smb_writeclose_req);
                _dpd.logMsg("        Write and Close responses: "STDu64"\n", dce2_stats.smb_writeclose_resp);
            }

            if (dce2_stats.smb_writecomplete_resp > 0)
                _dpd.logMsg("        Write Complete responses: "STDu64"\n", dce2_stats.smb_writecomplete_resp);

            if ((dce2_stats.smb_read_req > 0) || (dce2_stats.smb_read_resp > 0))
            {
                _dpd.logMsg("        Read requests: "STDu64"\n", dce2_stats.smb_read_req);
                _dpd.logMsg("        Read responses: "STDu64"\n", dce2_stats.smb_read_resp);
            }

            if ((dce2_stats.smb_readbr_req > 0) || (dce2_stats.smb_readbr_resp > 0))
            {
                _dpd.logMsg("        Read Block Raw requests: "STDu64"\n", dce2_stats.smb_readbr_req);
                _dpd.logMsg("        Read Block Raw responses: "STDu64"\n", dce2_stats.smb_readbr_resp);
            }

            if ((dce2_stats.smb_readx_req > 0) || (dce2_stats.smb_readx_resp > 0))
            {
                _dpd.logMsg("        Read AndX requests: "STDu64"\n", dce2_stats.smb_readx_req);
                if (dce2_stats.smb_readx_chained > 0)
                {
                    _dpd.logMsg("        Read AndX chained requests\n");
                    if (dce2_stats.smb_readx_req_chained_ssx > 0)
                        _dpd.logMsg("          Session Setup AndX: "STDu64"\n", dce2_stats.smb_readx_req_chained_ssx);
                    if (dce2_stats.smb_readx_req_chained_loffx > 0)
                        _dpd.logMsg("          Logoff AndX: "STDu64"\n", dce2_stats.smb_readx_req_chained_loffx);
                    if (dce2_stats.smb_readx_req_chained_tc > 0)
                        _dpd.logMsg("          Tree Connect: "STDu64"\n", dce2_stats.smb_readx_req_chained_tc);
                    if (dce2_stats.smb_readx_req_chained_tcx > 0)
                        _dpd.logMsg("          Tree Connect AndX: "STDu64"\n", dce2_stats.smb_readx_req_chained_tcx);
                    if (dce2_stats.smb_readx_req_chained_tdis > 0)
                        _dpd.logMsg("          Tree Disconnect: "STDu64"\n", dce2_stats.smb_readx_req_chained_tdis);
                    if (dce2_stats.smb_readx_req_chained_openx > 0)
                        _dpd.logMsg("          Open AndX: "STDu64"\n", dce2_stats.smb_readx_req_chained_openx);
                    if (dce2_stats.smb_readx_req_chained_readx > 0)
                        _dpd.logMsg("          Nt Create AndX: "STDu64"\n", dce2_stats.smb_readx_req_chained_readx);
                    if (dce2_stats.smb_readx_req_chained_close > 0)
                        _dpd.logMsg("          Close: "STDu64"\n", dce2_stats.smb_readx_req_chained_close);
                    if (dce2_stats.smb_readx_req_chained_write > 0)
                        _dpd.logMsg("          Write: "STDu64"\n", dce2_stats.smb_readx_req_chained_write);
                    if (dce2_stats.smb_readx_req_chained_readx > 0)
                        _dpd.logMsg("          Read AndX: "STDu64"\n", dce2_stats.smb_readx_req_chained_readx);
                    if (dce2_stats.smb_readx_req_chained_other > 0)
                        _dpd.logMsg("          Other: "STDu64"\n", dce2_stats.smb_readx_req_chained_other);
                }
                _dpd.logMsg("        Read AndX responses: "STDu64"\n", dce2_stats.smb_readx_resp);
                if (dce2_stats.smb_readx_chained > 0)
                {
                    _dpd.logMsg("        Read AndX chained responses\n");
                    if (dce2_stats.smb_readx_resp_chained_ssx > 0)
                        _dpd.logMsg("          Session Setup AndX: "STDu64"\n", dce2_stats.smb_readx_resp_chained_ssx);
                    if (dce2_stats.smb_readx_resp_chained_loffx > 0)
                        _dpd.logMsg("          Logoff AndX: "STDu64"\n", dce2_stats.smb_readx_resp_chained_loffx);
                    if (dce2_stats.smb_readx_resp_chained_tc > 0)
                        _dpd.logMsg("          Tree Connect: "STDu64"\n", dce2_stats.smb_readx_resp_chained_tc);
                    if (dce2_stats.smb_readx_resp_chained_tcx > 0)
                        _dpd.logMsg("          Tree Connect AndX: "STDu64"\n", dce2_stats.smb_readx_resp_chained_tcx);
                    if (dce2_stats.smb_readx_resp_chained_tdis > 0)
                        _dpd.logMsg("          Tree Disconnect: "STDu64"\n", dce2_stats.smb_readx_resp_chained_tdis);
                    if (dce2_stats.smb_readx_resp_chained_openx > 0)
                        _dpd.logMsg("          Open AndX: "STDu64"\n", dce2_stats.smb_readx_resp_chained_openx);
                    if (dce2_stats.smb_readx_resp_chained_readx > 0)
                        _dpd.logMsg("          Nt Create AndX: "STDu64"\n", dce2_stats.smb_readx_resp_chained_readx);
                    if (dce2_stats.smb_readx_resp_chained_close > 0)
                        _dpd.logMsg("          Close: "STDu64"\n", dce2_stats.smb_readx_resp_chained_close);
                    if (dce2_stats.smb_readx_resp_chained_write > 0)
                        _dpd.logMsg("          Write: "STDu64"\n", dce2_stats.smb_readx_resp_chained_write);
                    if (dce2_stats.smb_readx_resp_chained_readx > 0)
                        _dpd.logMsg("          Read AndX: "STDu64"\n", dce2_stats.smb_readx_resp_chained_readx);
                    if (dce2_stats.smb_readx_resp_chained_other > 0)
                        _dpd.logMsg("          Other: "STDu64"\n", dce2_stats.smb_readx_resp_chained_other);
                }
            }

            if ((dce2_stats.smb_rename_req > 0) || (dce2_stats.smb_rename_resp > 0))
            {
                _dpd.logMsg("        Rename requests: "STDu64"\n", dce2_stats.smb_rename_req);
                _dpd.logMsg("        Rename responses: "STDu64"\n", dce2_stats.smb_rename_resp);
            }

            if ((dce2_stats.smb_other_req > 0) || (dce2_stats.smb_other_resp > 0))