base/bif/plugins/Zeek_SMB.smb1_com_logoff_andx.bif.zeek

GLOBAL
Namespace

GLOBAL

Summary

Events

smb1_logoff_andx: event

Generated for SMB/CIFS version 1 requests of type logoff andx.

Detailed Interface

Events

smb1_logoff_andx
Type

event (c: connection, is_orig: bool)

Generated for SMB/CIFS version 1 requests of type logoff andx. This is used by the client to logoff the user connection represented by UID in the SMB Header. The server releases all locks and closes all files currently open by this user, disconnects all tree connects, cancels any outstanding requests for this UID, and invalidates the UID.

For more information, see MS-CIFS:2.2.4.54

Parameters
  • c – The connection.

  • is_orig – Indicates which host sent the logoff message.

See also: smb1_message