Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

look at new modbus analyzer features in v6.1.0 and take advantage of them if applicable #9

Open
mmguero opened this issue Oct 30, 2023 · 1 comment
Assignees

Comments

@mmguero
Copy link
Contributor

mmguero commented Oct 30, 2023

the zeek v6.1.0 release has some new modbus stuff:

The ModBus analyzer's function support was expanded, with new handling of the
Encapsulation Interface Transport (function 28) And Diagnostics (function 8)
functions. This adds new modbus_encap_interface_transport_{request,response}
and modbus_diagnostics_{request,response} events.

The ModBus file record read and write events now provide the full data from
the request and response messages as part of the event data.

The full PDU length was added to the ModBusHeader record type passed with
all of the ModBus events.

We ought to look at these changes and see if any of them could and/or should be reflected in the various modbus logs being generated by this plugin.

@Kleinspider Kleinspider self-assigned this Oct 30, 2023
@Kleinspider
Copy link
Contributor

Kleinspider commented Nov 7, 2023

Pull Request #10 addresses addition of new modbus_encap_interface_transport_{request,response}
and modbus_diagnostics_{request,response} events

Still need to look into Modbus file record read and write events to see if files can be parsed out similar to what was done in BACnet and S7Comm parsers

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants