Help-Site Computer Manuals
  Algorithms & Data Structures   Programming Languages   Revision Control
  Cameras   Computers   Displays   Keyboards & Mice   Motherboards   Networking   Printers & Scanners   Storage
  Windows   Linux & Unix   Mac

Remote Data Exchange Protocol Client

Net::RDEP - Remote Data Exchange Protocol Client


Net::RDEP - Remote Data Exchange Protocol Client


  use Net::RDEP;

  $rdep = Net::RDEP->new(Username => 'rdepuser', Type => 'subscription');




  $rdep->alertSeverities('high', 'medium');


  $idiom_xml = $rdep->get();



Remote Data Exchange Protocol (RDEP) is a protocol designed by Cisco Systems in order to exchange Intrusion Detection System events, configuration, log, and control messages. This protocol is supported at least the Cisco IDS version 4.0.

This implementation only supports the collection of events.

The events are retrieved in a format, also developed by Cisco, referred to as Intrusion Detection Interaction and Operations Messages (IDIOM), which is an XML document. A simple module for handling these documents is included with this distribution (XML::Idiom).

RDEP supports two methods for retrieving events: an event query and an event subscription. Both methods use SSL to query the RDEP server and retrieve the events. The event query method will retrieve all the events in a given time range. No connection is maintained in anyway. The event subscription, however, does maintain a connection and will support multiple ``gets'' to continue to retrieve events as they are available.

See for more information in RDEP or IDIOM.


new( [Parameter => value,] )
This is the constructor for a new Net::RDEP object. Parameters to the RDEP object can be specified here or later.

If the Type is set to 'query', this method will perform the event query with the already set parameters. Otherwise, an event subscription will be established.

If the Type is set to 'query', the get() method simply calls open() and performs an event query. If an event subscription is already established, get() will return the next maxNbrOfEvents from the server. If a subscription has not been established, then it will be established first.

An event subscription should be closed when no longer being used. The serer will time out the subscription if this doesn't happen.

An event subscription maintains a subscription ID. This is set automatically, but can be retrieved. If this value is corrupted during a session, the session will become invalid.


These method names and case are, in general, as specified in the RDEP specification from Cisco.

Calling the method with arguments will cause that RDEP parameter to be set with those arguments. Calling the method without arguments returns the current value of the parameter. Calling the method with arguments repeatedly will cause the parameter to be reset to the latest set of arguments. If a parameter supports more than one parameter, specify them all in the same call.

Set this parameter to 'subscription' to establish an event subscription and to 'query' for an event query.

Specify the start time of the events to be retrieved. If not specified, collection will be started by the oldest events.

Events retrieved will have a creation time less than or equal to the stopTime. If not specified, collection will end with the newest events. Note - this only applies to event queries.

Set the type of events to retrieve. Valid event types are: evError, evAlert, evLogTransaction, evStatus, evShunRqst.

Set the alert severities of events to retrieve. Valid alert severities are: informational, low, medium, and high. Multiple alert severities may be specified:

        $rdep->alertSeverities( 'medium', 'high');

Default is ALL alert severities.

Set the error severity of events to retrieve. Valid error severities are: warning, error, and fatal. Multiple error severities may be specified.

        $rdep->errorSeverities( 'fatal', 'error');

Default is ALL error severities.

Alarm traits are a set of 16 attribute bits. Each bit has a user-defined value classifing an evAlert into up to 16 different categories. Specify these either as single digits or ranges:

        $rdep->mustHaveAlarmTraits(3, '5-10');

The mustHaveAlarmTraits parameters restricts retrieval of events to only those with the given attribute bit set.

The mustNotHaveAlarmTraits parameters restricts retrieval of events to only those without the given attribute bit set.

The maximum number of seconds the server will block before returning. When this pararmeter is not specified, the request will not timeout.

The maximum number of events to retrieve in the query. Some servers impose an upper-limit on the number of events that can be retrieved in a query. When this parameter is not specified, the server will return all events, up to a server imposed limit, that match the subscription's query criteria

Acknowledge that the events retrieved in the previous get() were received.

When performing an event subscription, it is possible that events could be lost between polls if the poll happens so infrequently that the server is forced to drop events. In this case, the missedEvents parameter will be ``defined''.

In the case of an error during parameter setting, server connection, or event retrieval, this parameter is ``defined''.

If the 'error' parameter is defined, an explanation of the error will be stored here.


This example shows a simple way to perform an event query:

        #!/usr/local/bin/perl -w

        use Net::RDEP;

        my $rdep = Net::RDEP->new(

                Username => 'rdepuser',

                Password => 'rdeppass',

                Server   => 'rdephost',

                Type     => 'query' );

        my $idiom_xml = $rdep->get();

        if(defined($rdep->error)) {

                print "ERROR: " . $rdep->errorString;


        print $idiom_xml;

In this example, an event subscription is performed:

        #!/usr/local/bin/perl -w

        use Net::RDEP;

        my $rdep = Net::RDEP->new(

                Username => 'rdepuser',

                Password => 'rdeppass',

                Server   => 'rdephost' );

        while (my $idiom_xml = $rdep->get()) {

                if(defined($rdep->error)) {

                        print "ERROR: " . $rdep->errorString;


                print $idiom_xml;



Printing out the IDIOM XML document is probably not all that useful. There are a few methods of handling the IDIOM document built into the XML::Idiom module that can be used. For example:

        my $idiom = XML::Idiom->new();


        if (defined($idiom->isError())) {

                if($idiom->errorType eq 'errNotFound') {

                        # connection failed, reconnect



        } else {

                my $number_of_events = $idiom->getNumberOfEvents();

                print "RCVD $number_of_events number of events\n";

                while(my $e = $idiom->getNextEvent()) {





XML::Idiom, MIME::Base64


Joe Minieri, <


Copyright (C) 2004 by Joe Minieri and OpenService (

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.1 or, at your option, any later version of Perl 5 you may have available.