mirror of
https://github.com/zeek/zeek.git
synced 2025-10-10 02:28:21 +00:00
Pluginizing the DNP3 analyzer, plus a basic script logging requests
and replies. Almost ready, but now 1 test fails again ... [Note I broke git history by copying over the files into a new branch.]
This commit is contained in:
Robin Sommer
parent
1b40412818
commit
306d4fa6f9
65 changed files with 4772 additions and 0 deletions
|
|
@ -39,6 +39,7 @@
|
|||
@load base/frameworks/tunnels
|
||||
|
||||
@load base/protocols/conn
|
||||
@load base/protocols/dnp3
|
||||
@load base/protocols/dns
|
||||
@load base/protocols/ftp
|
||||
@load base/protocols/http
|
||||
|
|
|
|||
3
scripts/base/protocols/dnp3/__load__.bro
Normal file
3
scripts/base/protocols/dnp3/__load__.bro
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
@load ./main
|
||||
|
||||
@load-sigs ./dpd.sig
|
||||
49
scripts/base/protocols/dnp3/consts.bro
Normal file
49
scripts/base/protocols/dnp3/consts.bro
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
|
||||
module DNP3;
|
||||
|
||||
export {
|
||||
## Standard defined Modbus function codes.
|
||||
const function_codes = {
|
||||
# Requests.
|
||||
[0x00] = "CONFIRM",
|
||||
[0x01] = "READ",
|
||||
[0x02] = "WRITE",
|
||||
[0x03] = "SELECT",
|
||||
[0x04] = "OPERATE",
|
||||
[0x05] = "DIRECT_OPERATE",
|
||||
[0x06] = "DIRECT_OPERATE_NR",
|
||||
[0x07] = "IMMED_FREEZE",
|
||||
[0x08] = "IMMED_FREEZE_NR",
|
||||
[0x09] = "FREEZE_CLEAR",
|
||||
[0x0a] = "FREEZE_CLEAR_NR",
|
||||
[0x0b] = "FREEZE_AT_TIME",
|
||||
[0x0c] = "FREEZE_AT_TIME_NR",
|
||||
[0x0d] = "COLD_RESTART",
|
||||
[0x0e] = "WARM_RESTART",
|
||||
[0x0f] = "INITIALIZE_DATA",
|
||||
[0x10] = "INITIALIZE_APPL",
|
||||
[0x11] = "START_APPL",
|
||||
[0x12] = "STOP_APPL",
|
||||
[0x13] = "SAVE_CONFIG",
|
||||
[0x14] = "ENABLE_UNSOLICITED",
|
||||
[0x15] = "DISABLE_UNSOLICITED",
|
||||
[0x16] = "ASSIGN_CLASS",
|
||||
[0x17] = "DELAY_MEASURE",
|
||||
[0x18] = "RECORD_CURRENT_TIME",
|
||||
[0x19] = "OPEN_FILE",
|
||||
[0x1a] = "CLOSE_FILE",
|
||||
[0x1b] = "DELETE_FILE",
|
||||
[0x1c] = "GET_FILE_INFO",
|
||||
[0x1d] = "AUTHENTICATE_FILE",
|
||||
[0x1e] = "ABORT_FILE",
|
||||
[0x1f] = "ACTIVATE_CONFIG",
|
||||
[0x20] = "AUTHENTICATE_REQ",
|
||||
[0x21] = "AUTHENTICATE_ERR",
|
||||
|
||||
# Responses.
|
||||
[0x81] = "RESPONSE",
|
||||
[0x82] = "UNSOLICITED_RESPONSE",
|
||||
[0x83] = "AUTHENTICATE_RESP",
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); } &redef;
|
||||
}
|
||||
|
||||
15
scripts/base/protocols/dnp3/dpd.sig
Normal file
15
scripts/base/protocols/dnp3/dpd.sig
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
|
||||
signature dpd_dnp3_client {
|
||||
ip-proto == tcp
|
||||
# dnp3 packets always starts with 0x05 0x64 .
|
||||
payload /\x05\0x64/
|
||||
tcp-state originator
|
||||
}
|
||||
|
||||
signature dpd_dnp3_server {
|
||||
ip-proto == tcp
|
||||
# dnp3 packets always starts with 0x05 0x64 .
|
||||
payload /\x05\x64/
|
||||
tcp-state responder
|
||||
enable "dnp3"
|
||||
}
|
||||
73
scripts/base/protocols/dnp3/main.bro
Normal file
73
scripts/base/protocols/dnp3/main.bro
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
##! A very basic DNP3 analysis script that just logs requests and replies.
|
||||
|
||||
module DNP3;
|
||||
|
||||
@load ./consts
|
||||
|
||||
export {
|
||||
redef enum Log::ID += { LOG };
|
||||
|
||||
type Info: record {
|
||||
## Time of the request.
|
||||
ts: time &log;
|
||||
## Unique identifier for the connnection.
|
||||
uid: string &log;
|
||||
## Identifier for the connection.
|
||||
id: conn_id &log;
|
||||
## The name of the function message in the request.
|
||||
fc_request: string &log &optional;
|
||||
## The name of the function message in the reply.
|
||||
fc_reply: string &log &optional;
|
||||
## The response's "internal indication number".
|
||||
iin: count &log &optional;
|
||||
};
|
||||
|
||||
## Event that can be handled to access the DNP3 record as it is sent on
|
||||
## to the logging framework.
|
||||
global log_dnp3: event(rec: Info);
|
||||
}
|
||||
|
||||
redef record connection += {
|
||||
dnp3: Info &optional;
|
||||
};
|
||||
|
||||
const ports = { 502/tcp };
|
||||
redef likely_server_ports += { ports };
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(DNP3::LOG, [$columns=Info, $ev=log_dnp3]);
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_DNP3, ports);
|
||||
}
|
||||
|
||||
event dnp3_application_request_header(c: connection, is_orig: bool, fc: count)
|
||||
{
|
||||
if ( ! c?$dnp3 )
|
||||
c$dnp3 = [$ts=network_time(), $uid=c$uid, $id=c$id];
|
||||
|
||||
c$dnp3$ts = network_time();
|
||||
c$dnp3$fc_request = function_codes[fc];
|
||||
}
|
||||
|
||||
event dnp3_application_response_header(c: connection, is_orig: bool, fc: count, iin: count)
|
||||
{
|
||||
if ( ! c?$dnp3 )
|
||||
c$dnp3 = [$ts=network_time(), $uid=c$uid, $id=c$id];
|
||||
|
||||
c$dnp3$ts = network_time();
|
||||
c$dnp3$fc_reply = function_codes[fc];
|
||||
c$dnp3$iin = iin;
|
||||
|
||||
Log::write(LOG, c$dnp3);
|
||||
|
||||
delete c$dnp3;
|
||||
}
|
||||
|
||||
event connection_state_remove(c: connection) &priority=-5
|
||||
{
|
||||
if ( ! c?$dnp3 )
|
||||
return;
|
||||
|
||||
Log::write(LOG, c$dnp3);
|
||||
delete c$dnp3;
|
||||
}
|
||||
|
|
@ -6,6 +6,7 @@ add_subdirectory(bittorrent)
|
|||
add_subdirectory(conn-size)
|
||||
add_subdirectory(dce-rpc)
|
||||
add_subdirectory(dhcp)
|
||||
add_subdirectory(dnp3)
|
||||
add_subdirectory(dns)
|
||||
add_subdirectory(file)
|
||||
add_subdirectory(finger)
|
||||
|
|
|
|||
10
src/analyzer/protocol/dnp3/CMakeLists.txt
Normal file
10
src/analyzer/protocol/dnp3/CMakeLists.txt
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
|
||||
include(BroPlugin)
|
||||
|
||||
include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DIR})
|
||||
|
||||
bro_plugin_begin(Bro DNP3)
|
||||
bro_plugin_cc(DNP3.cc Plugin.cc)
|
||||
bro_plugin_bif(events.bif)
|
||||
bro_plugin_pac(dnp3.pac dnp3-analyzer.pac dnp3-protocol.pac dnp3-objects.pac)
|
||||
bro_plugin_end()
|
||||
375
src/analyzer/protocol/dnp3/DNP3.cc
Normal file
375
src/analyzer/protocol/dnp3/DNP3.cc
Normal file
|
|
@ -0,0 +1,375 @@
|
|||
//
|
||||
// DNP3 was initially used over serial links; it defined its own application
|
||||
// layer, transport layer, and data link layer. This hierarchy cannot be
|
||||
// mapped to the TCP/IP stack directly. As a result, all three DNP3 layers
|
||||
// are packed together as a single application layer payload over the TCP
|
||||
// layer. Each DNP3 packet in the application layer may look like this DNP3
|
||||
// Packet:
|
||||
//
|
||||
// DNP3 Link Layer | DNP3 Transport Layer | DNP3 Application Layer
|
||||
//
|
||||
// (This hierarchy can be viewed in the Wireshark visually.)
|
||||
//
|
||||
// === Background on DNP3
|
||||
//
|
||||
// 1. Basic structure of DNP3 Protocol over serial links. This information
|
||||
// can be found in detail in
|
||||
//
|
||||
// DNP3 Specification Volume 2, Part 1 Basic, Application Layer
|
||||
// DNP3 Specification Volume 4, Data Link Layer
|
||||
//
|
||||
// Traditionally, the DNP3 Application Layer in serial links contains a
|
||||
// "DNP3 Application Layer Fragment". The data that is parsed by the end
|
||||
// device and then executed. As the "DNP3 Application Layer Fragment" can
|
||||
// be long (>255 bytes), it may be trunkcated and carried in different
|
||||
// DNP3 Application Layer of more than one DNP3 packets.
|
||||
//
|
||||
// So we may find a long DNP3 Application Layer Fragment to be transmitted in the following format
|
||||
//
|
||||
// DNP3 Packet #1 : DNP3 Link Layer | DNP3 Transport Layer | DNP3 Application Layer #1
|
||||
// DNP3 Packet #2 : DNP3 Link Layer | DNP3 Transport Layer | DNP3 Application Layer #2
|
||||
// ....
|
||||
// DNP3 Packet #n : DNP3 Link Layer | DNP3 Transport Layer | DNP3 Application Layer #n
|
||||
//
|
||||
// So to get the whole DNP3 application layer fragment, we concatenate
|
||||
// each DNP3 Application Layer Data into a logic DNP3 Application Layer
|
||||
// Fragment:
|
||||
//
|
||||
// DNP3 Application Layer #1 + DNP3 Application Layer #2 + ... + DNP3 Application Layer #n
|
||||
//
|
||||
// 2. Packing DNP3 Network Packet into TCP/IP stack
|
||||
//
|
||||
// We will call the original DNP3 Link Layer, Transport Layer and Application
|
||||
// Layer used in serial link as Pseudo Link Layer, Pseudo Transport Layer and
|
||||
// Pseudo Application Layer.
|
||||
//
|
||||
// For a long DNP3 application layer fragment, we may find it tramistted
|
||||
// over IP network in the following format:
|
||||
//
|
||||
// Network Packet #1 : TCP Header | DNP3 Pseudo Link Layer | DNP3 Pseudo Transport Layer | DNP3 Pseudo Application Layer #1
|
||||
// Network Packet #2 : TCP Header | DNP3 Pseudo Link Layer | DNP3 Pseudo Transport Layer | DNP3 Pseudo Application Layer #2
|
||||
// ....
|
||||
// Network Packet #n : TCP Header | DNP3 Pseudo Link Layer | DNP3 Pseudo Transport Layer | DNP3 Pseudo Application Layer #n
|
||||
//
|
||||
// === Challenges of Writing DNP3 Analyzer on Binpac ===
|
||||
//
|
||||
// The detailed structure of the DNP3 Link Layer is:
|
||||
//
|
||||
// 0x05 0x64 Len Ctrl Dest_LSB Dest_MSB Src_LSB Src_MSB CRC_LSB CRC_MSB
|
||||
//
|
||||
// Each field is a byte; LSB: least significant byte; MSB: most significatn byte.
|
||||
//
|
||||
// "Len" indicates the length of the byte stream right after this field
|
||||
// (excluding CRC fields) in the current DNP3 packet.
|
||||
//
|
||||
// Since "Len" is of size one byte, the largest length it can represent is
|
||||
// 255 bytes. The larget DNP3 Application Layer size is "255 - 5 + size of
|
||||
// all CRC fields". "minus 5" is coming from the 5 bytes after "Len" field in
|
||||
// the DNP3 Link Layer, i.e. Ctrl Dest_LSB Dest_MSB Src_LSB Src_MSB Hence,
|
||||
// the largest size of a DNP3 Packet (DNP3 Data Link Layer : DNP3 Transport
|
||||
// Layer : DNP3 Application Layer) can only be 292 bytes.
|
||||
//
|
||||
// The "Len" field indicates the length of of a single chunk of DNP3 Psuedo
|
||||
// Application Layer data instead of the whole DNP3 Application Layer
|
||||
// Fragment. However, we can not know the whole length of the DNP3
|
||||
// Application Layer Fragment (which Binpac would normally need) until all
|
||||
// chunks of Pseudo Application Layer Data are received.
|
||||
//
|
||||
// We hence exploit the internal flow_buffer class used in Binpac to buffer
|
||||
// the application layer data until all chunk are received. The trick that I
|
||||
// used require in-depth understanding on how Binpac parse the application
|
||||
// layer data and perform incremental parsing. The codes that exploits
|
||||
// flow_buffer class to buffer the application layer data is included in
|
||||
// DNP3_ProcessData class.
|
||||
//
|
||||
// The binpac analyzer parses the DNP3 Application Layer Fragment. However,
|
||||
// we manually add the original Pseudo Link Layer data as an additional
|
||||
// header before the DNP3 Application Fragment. This helps to know how many
|
||||
// bytes are in the current chunk of DNP3 application layer data (not the
|
||||
// whole Application Layer Fragment).
|
||||
//
|
||||
// Graphically, the procedure is:
|
||||
//
|
||||
// DNP3 Packet : DNP3 Pseudo Data Link Layer : DNP3 Pseudo Transport Layer : DNP3 Pseudo Application Layer
|
||||
// || ||
|
||||
// || (length field) || (original paylad byte stream)
|
||||
// \/ \/
|
||||
// DNP3 Additional Header : Reassembled DNP3 Pseudo Application Layer Data
|
||||
// ||
|
||||
// \/
|
||||
// Binpac DNP3 Analyzer
|
||||
|
||||
#include "DNP3.h"
|
||||
#include "analyzer/protocol/tcp/TCP_Reassembler.h"
|
||||
#include "events.bif.h"
|
||||
|
||||
using namespace analyzer::dnp3;
|
||||
|
||||
const unsigned int PSEUDO_LENGTH_INDEX = 2; // index of len field of DNP3 Pseudo Link Layer
|
||||
const unsigned int PSEUDO_CONTROL_FIELD_INDEX = 3; // index of ctrl field of DNP3 Pseudo Link Layer
|
||||
const unsigned int PSEUDO_TRANSPORT_INDEX = 10; // index of DNP3 Pseudo Transport Layer
|
||||
const unsigned int PSEUDO_APP_LAYER_INDEX = 11; // index of first DNP3 app-layer byte.
|
||||
const unsigned int PSEUDO_TRANSPORT_LEN = 1; // length of DNP3 Transport Layer
|
||||
const unsigned int PSEUDO_LINK_LAYER_LEN = 8; // length of DNP3 Pseudo Link Layer
|
||||
|
||||
bool DNP3_Analyzer::crc_table_initialized = false;
|
||||
unsigned int DNP3_Analyzer::crc_table[256];
|
||||
|
||||
DNP3_Analyzer::DNP3_Analyzer(Connection* c) : TCP_ApplicationAnalyzer("DNP3", c)
|
||||
{
|
||||
interp = new binpac::DNP3::DNP3_Conn(this);
|
||||
|
||||
ClearEndpointState(true);
|
||||
ClearEndpointState(false);
|
||||
|
||||
if ( ! crc_table_initialized )
|
||||
PrecomputeCRCTable();
|
||||
}
|
||||
|
||||
DNP3_Analyzer::~DNP3_Analyzer()
|
||||
{
|
||||
delete interp;
|
||||
}
|
||||
|
||||
void DNP3_Analyzer::Done()
|
||||
{
|
||||
TCP_ApplicationAnalyzer::Done();
|
||||
|
||||
interp->FlowEOF(true);
|
||||
interp->FlowEOF(false);
|
||||
}
|
||||
|
||||
void DNP3_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
|
||||
{
|
||||
TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
|
||||
|
||||
try
|
||||
{
|
||||
if ( ! ProcessData(len, data, orig) )
|
||||
SetSkip(1);
|
||||
}
|
||||
|
||||
catch ( const binpac::Exception& e )
|
||||
{
|
||||
SetSkip(1);
|
||||
throw;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
void DNP3_Analyzer::Undelivered(int seq, int len, bool orig)
|
||||
{
|
||||
TCP_ApplicationAnalyzer::Undelivered(seq, len, orig);
|
||||
interp->NewGap(orig, len);
|
||||
}
|
||||
|
||||
void DNP3_Analyzer::EndpointEOF(tcp::TCP_Reassembler* endp)
|
||||
{
|
||||
TCP_ApplicationAnalyzer::EndpointEOF(endp);
|
||||
interp->FlowEOF(endp->IsOrig());
|
||||
}
|
||||
|
||||
bool DNP3_Analyzer::ProcessData(int len, const u_char* data, bool orig)
|
||||
{
|
||||
Endpoint* endp = orig ? &orig_state : &resp_state;
|
||||
|
||||
while ( len )
|
||||
{
|
||||
if ( endp->in_hdr )
|
||||
{
|
||||
// We're parsing the DNP3 header and link layer, get that in full.
|
||||
if ( ! AddToBuffer(endp, PSEUDO_APP_LAYER_INDEX, &data, &len) )
|
||||
return true;
|
||||
|
||||
// The first two bytes must always be 0x0564.
|
||||
if( endp->buffer[0] != 0x05 || endp->buffer[1] != 0x64 )
|
||||
{
|
||||
Weird("dnp3_header_lacks_magic");
|
||||
return false;
|
||||
}
|
||||
|
||||
// Make sure header checksum is correct.
|
||||
if ( ! CheckCRC(PSEUDO_LINK_LAYER_LEN, endp->buffer, endp->buffer + PSEUDO_LINK_LAYER_LEN, "header") )
|
||||
{
|
||||
ProtocolViolation("broken_checksum");
|
||||
return false;
|
||||
}
|
||||
|
||||
// If the checksum works out, we're pretty certainly DNP3.
|
||||
ProtocolConfirmation();
|
||||
|
||||
// Double check the direction in case the first
|
||||
// received packet is a response.
|
||||
u_char ctrl = endp->buffer[PSEUDO_CONTROL_FIELD_INDEX];
|
||||
|
||||
if ( orig != (bool)(ctrl & 0x80) )
|
||||
Weird("dnp3_unexpected_flow_direction");
|
||||
|
||||
// Update state.
|
||||
endp->pkt_length = endp->buffer[PSEUDO_LENGTH_INDEX];
|
||||
endp->tpflags = endp->buffer[PSEUDO_TRANSPORT_INDEX];
|
||||
endp->in_hdr = false; // Now parsing application layer.
|
||||
|
||||
// For the first packet, we submit the header to
|
||||
// BinPAC.
|
||||
if ( ++endp->pkt_cnt == 1 )
|
||||
interp->NewData(orig, endp->buffer, endp->buffer + PSEUDO_LINK_LAYER_LEN);
|
||||
|
||||
}
|
||||
|
||||
if ( ! endp->in_hdr )
|
||||
{
|
||||
assert(endp->pkt_length);
|
||||
|
||||
// We're parsing the DNP3 application layer, get that
|
||||
// in full now as well. We calculate the number of
|
||||
// raw bytes the application layer consists of from
|
||||
// the packet length by determining how much 16-byte
|
||||
// chunks fit in there, and then add 2 bytes CRC for
|
||||
// each.
|
||||
int n = PSEUDO_APP_LAYER_INDEX + (endp->pkt_length - 5) + ((endp->pkt_length - 5) / 16) * 2 + 2 - 1;
|
||||
|
||||
if ( ! AddToBuffer(endp, n, &data, &len) )
|
||||
return true;
|
||||
|
||||
// Parse the the application layer data.
|
||||
if ( ! ParseAppLayer(endp) )
|
||||
return false;
|
||||
|
||||
// Done with this packet, prepare for next.
|
||||
endp->buffer_len = 0;
|
||||
endp->in_hdr = true;
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool DNP3_Analyzer::AddToBuffer(Endpoint* endp, int target_len, const u_char** data, int* len)
|
||||
{
|
||||
if ( ! target_len )
|
||||
return true;
|
||||
|
||||
int to_copy = min(*len, target_len - endp->buffer_len);
|
||||
|
||||
memcpy(endp->buffer + endp->buffer_len, *data, to_copy);
|
||||
*data += to_copy;
|
||||
*len -= to_copy;
|
||||
endp->buffer_len += to_copy;
|
||||
|
||||
return endp->buffer_len == target_len;
|
||||
}
|
||||
|
||||
bool DNP3_Analyzer::ParseAppLayer(Endpoint* endp)
|
||||
{
|
||||
bool orig = (endp == &orig_state);
|
||||
binpac::DNP3::DNP3_Flow* flow = orig ? interp->upflow() : interp->downflow();
|
||||
|
||||
u_char* data = endp->buffer + PSEUDO_TRANSPORT_INDEX; // The transport layer byte counts as app-layer it seems.
|
||||
int len = endp->pkt_length - 5;
|
||||
|
||||
//// DNP3 Packet : DNP3 Pseudo Link Layer | DNP3 Pseudo Transport Layer | DNP3 Pseudo Application Layer
|
||||
//// DNP3 Serial Transport Layer data is always 1 byte.
|
||||
//// Get FIN FIR seq field in transport header
|
||||
//// FIR indicate whether the following DNP3 Serial Application Layer is first chunk of bytes or not
|
||||
//// FIN indicate whether the following DNP3 Serial Application Layer is last chunk of bytes or not
|
||||
|
||||
//// Get FIR and FIN field from the DNP3 Pseudo Transport Layer
|
||||
|
||||
int is_first = (endp->tpflags & 0x40) >> 6; // Initial chunk of data in this packet.
|
||||
int is_last = (endp->tpflags & 0x80) >> 7; // Last chunk of data in this packet.
|
||||
|
||||
int transport = PSEUDO_TRANSPORT_LEN;
|
||||
|
||||
int i = 0;
|
||||
while ( len > 0 )
|
||||
{
|
||||
int n = min(len, 16);
|
||||
|
||||
// Make sure chunk has a correct checksum.
|
||||
if ( ! CheckCRC(n, data, data + n, "app_chunk") )
|
||||
return false;
|
||||
|
||||
// Pass on to BinPAC.
|
||||
assert(data + n < endp->buffer + endp->buffer_len);
|
||||
flow->flow_buffer()->BufferData(data + transport, data + n);
|
||||
transport = 0;
|
||||
|
||||
data += n + 2;
|
||||
len -= n;
|
||||
}
|
||||
|
||||
if ( is_first )
|
||||
endp->encountered_first_chunk = true;
|
||||
|
||||
if ( ! is_first && ! endp->encountered_first_chunk )
|
||||
{
|
||||
// We lost the first chunk.
|
||||
Weird("dnp3_first_application_layer_chunk_missing");
|
||||
return false;
|
||||
}
|
||||
|
||||
if ( is_last )
|
||||
{
|
||||
flow->flow_buffer()->FinishBuffer();
|
||||
flow->FlowEOF();
|
||||
ClearEndpointState(orig);
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
void DNP3_Analyzer::ClearEndpointState(bool orig)
|
||||
{
|
||||
Endpoint* endp = orig ? &orig_state : &resp_state;
|
||||
binpac::DNP3::DNP3_Flow* flow = orig ? interp->upflow() : interp->downflow();
|
||||
|
||||
endp->in_hdr = true;
|
||||
endp->encountered_first_chunk = false;
|
||||
endp->buffer_len = 0;
|
||||
endp->pkt_length = 0;
|
||||
endp->tpflags = 0;
|
||||
endp->pkt_cnt = 0;
|
||||
}
|
||||
|
||||
bool DNP3_Analyzer::CheckCRC(int len, const u_char* data, const u_char* crc16, const char* where)
|
||||
{
|
||||
unsigned int crc = CalcCRC(len, data);
|
||||
|
||||
if ( crc16[0] == (crc & 0xff) && crc16[1] == (crc & 0xff00) >> 8 )
|
||||
return true;
|
||||
|
||||
Weird(fmt("dnp3_corrupt_%s_checksum", where));
|
||||
return false;
|
||||
}
|
||||
|
||||
void DNP3_Analyzer::PrecomputeCRCTable()
|
||||
{
|
||||
for( unsigned int i = 0; i < 256; i++)
|
||||
{
|
||||
unsigned int crc = i;
|
||||
|
||||
for ( unsigned int j = 0; j < 8; ++j )
|
||||
{
|
||||
if ( crc & 0x0001 )
|
||||
crc = (crc >> 1) ^ 0xA6BC; // Generating polynomial.
|
||||
else
|
||||
crc >>= 1;
|
||||
}
|
||||
|
||||
crc_table[i] = crc;
|
||||
}
|
||||
}
|
||||
|
||||
unsigned int DNP3_Analyzer::CalcCRC(int len, const u_char* data)
|
||||
{
|
||||
unsigned int crc = 0x0000;
|
||||
|
||||
for ( int i = 0; i < len; i++ )
|
||||
{
|
||||
unsigned int index = (crc ^ data[i]) & 0xFF;
|
||||
crc = crc_table[index] ^ (crc >> 8);
|
||||
}
|
||||
|
||||
return ~crc & 0xFFFF;
|
||||
}
|
||||
56
src/analyzer/protocol/dnp3/DNP3.h
Normal file
56
src/analyzer/protocol/dnp3/DNP3.h
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
#ifndef ANALYZER_PROTOCOL_DNP3_DNP3_H
|
||||
#define ANALYZER_PROTOCOL_DNP3_DNP3_H
|
||||
|
||||
#include "analyzer/protocol/tcp/TCP.h"
|
||||
#include "dnp3_pac.h"
|
||||
|
||||
namespace analyzer { namespace dnp3 {
|
||||
|
||||
class DNP3_Analyzer : public tcp::TCP_ApplicationAnalyzer {
|
||||
public:
|
||||
DNP3_Analyzer(Connection* conn);
|
||||
virtual ~DNP3_Analyzer();
|
||||
|
||||
virtual void Done();
|
||||
virtual void DeliverStream(int len, const u_char* data, bool orig);
|
||||
virtual void Undelivered(int seq, int len, bool orig);
|
||||
virtual void EndpointEOF(tcp::TCP_Reassembler* endp);
|
||||
|
||||
static Analyzer* InstantiateAnalyzer(Connection* conn)
|
||||
{ return new DNP3_Analyzer(conn); }
|
||||
|
||||
private:
|
||||
static const int MAX_BUFFER_SIZE = 300;
|
||||
|
||||
struct Endpoint
|
||||
{
|
||||
u_char buffer[MAX_BUFFER_SIZE];
|
||||
int buffer_len;
|
||||
bool in_hdr;
|
||||
int tpflags;
|
||||
int pkt_length;
|
||||
int pkt_cnt;
|
||||
bool encountered_first_chunk;
|
||||
};
|
||||
|
||||
bool ProcessData(int len, const u_char* data, bool orig);
|
||||
void ClearEndpointState(bool orig);
|
||||
bool AddToBuffer(Endpoint* endp, int target_len, const u_char** data, int* len);
|
||||
bool ParseAppLayer(Endpoint* endp);
|
||||
bool CheckCRC(int len, const u_char* data, const u_char* crc16, const char* where);
|
||||
unsigned int CalcCRC(int len, const u_char* data);
|
||||
|
||||
binpac::DNP3::DNP3_Conn* interp;
|
||||
|
||||
Endpoint orig_state;
|
||||
Endpoint resp_state;
|
||||
|
||||
static void PrecomputeCRCTable();
|
||||
|
||||
static bool crc_table_initialized;
|
||||
static unsigned int crc_table[256];
|
||||
};
|
||||
|
||||
} } // namespace analyzer::*
|
||||
|
||||
#endif
|
||||
10
src/analyzer/protocol/dnp3/Plugin.cc
Normal file
10
src/analyzer/protocol/dnp3/Plugin.cc
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
|
||||
#include "plugin/Plugin.h"
|
||||
|
||||
#include "DNP3.h"
|
||||
|
||||
BRO_PLUGIN_BEGIN(Bro, DNP3)
|
||||
BRO_PLUGIN_DESCRIPTION("DNP3 analyzer");
|
||||
BRO_PLUGIN_ANALYZER("DNP3", dnp3::DNP3_Analyzer);
|
||||
BRO_PLUGIN_BIF_FILE(events);
|
||||
BRO_PLUGIN_END
|
||||
969
src/analyzer/protocol/dnp3/dnp3-analyzer.pac
Normal file
969
src/analyzer/protocol/dnp3/dnp3-analyzer.pac
Normal file
|
|
@ -0,0 +1,969 @@
|
|||
|
||||
connection DNP3_Conn(bro_analyzer: BroAnalyzer) {
|
||||
upflow = DNP3_Flow(true);
|
||||
downflow = DNP3_Flow(false);
|
||||
};
|
||||
|
||||
flow DNP3_Flow(is_orig: bool) {
|
||||
flowunit = DNP3_PDU(is_orig) withcontext (connection, this);
|
||||
|
||||
function get_dnp3_header_block(start: uint16, len: uint16, ctrl: uint8, dest_addr: uint16, src_addr: uint16): bool
|
||||
%{
|
||||
if ( ::dnp3_header_block )
|
||||
{
|
||||
BifEvent::generate_dnp3_header_block(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), start, len, ctrl, dest_addr, src_addr);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
function get_dnp3_application_request_header(fc: uint8): bool
|
||||
%{
|
||||
if ( ::dnp3_application_request_header )
|
||||
{
|
||||
BifEvent::generate_dnp3_application_request_header(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(),
|
||||
fc
|
||||
);
|
||||
}
|
||||
return true;
|
||||
%}
|
||||
|
||||
function get_dnp3_application_response_header(fc: uint8, iin: uint16): bool
|
||||
%{
|
||||
if ( ::dnp3_application_response_header )
|
||||
{
|
||||
BifEvent::generate_dnp3_application_response_header(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(),
|
||||
fc,
|
||||
iin
|
||||
);
|
||||
}
|
||||
return true;
|
||||
%}
|
||||
|
||||
function get_dnp3_object_header(obj_type: uint16, qua_field: uint8, number: uint32, rf_low: uint32, rf_high: uint32 ): bool
|
||||
%{
|
||||
if ( ::dnp3_object_header )
|
||||
{
|
||||
BifEvent::generate_dnp3_object_header(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), obj_type, qua_field, number, rf_low, rf_high);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
function get_dnp3_object_prefix(prefix_value: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_object_prefix )
|
||||
{
|
||||
BifEvent::generate_dnp3_object_prefix(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), prefix_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
function get_dnp3_response_data_object(data_value: uint8): bool
|
||||
%{
|
||||
if ( ::dnp3_response_data_object )
|
||||
{
|
||||
BifEvent::generate_dnp3_response_data_object(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), data_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
#g0
|
||||
function get_dnp3_attribute_common(data_type_code: uint8, leng: uint8, attribute_obj: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_attribute_common )
|
||||
{
|
||||
BifEvent::generate_dnp3_attribute_common(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), data_type_code, leng, bytestring_to_val(attribute_obj) );
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
#g12v1
|
||||
function get_dnp3_crob(control_code: uint8, count8: uint8, on_time: uint32, off_time: uint32, status_code: uint8): bool
|
||||
%{
|
||||
if ( ::dnp3_crob )
|
||||
{
|
||||
BifEvent::generate_dnp3_crob(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), control_code, count8, on_time, off_time, status_code);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
#g12v2
|
||||
function get_dnp3_pcb(control_code: uint8, count8: uint8, on_time: uint32, off_time: uint32, status_code: uint8): bool
|
||||
%{
|
||||
if ( ::dnp3_pcb )
|
||||
{
|
||||
BifEvent::generate_dnp3_pcb(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), control_code, count8, on_time, off_time, status_code);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g20v1
|
||||
function get_dnp3_counter_32wFlag(flag: uint8, count_value: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_counter_32wFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_counter_32wFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, count_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g20v2
|
||||
function get_dnp3_counter_16wFlag(flag: uint8, count_value: uint16): bool
|
||||
%{
|
||||
if ( ::dnp3_counter_16wFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_counter_16wFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, count_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g20v5
|
||||
function get_dnp3_counter_32woFlag(count_value: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_counter_32woFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_counter_32woFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), count_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g20v6
|
||||
function get_dnp3_counter_16woFlag(count_value: uint16): bool
|
||||
%{
|
||||
if ( ::dnp3_counter_16woFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_counter_16woFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), count_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g21v1
|
||||
function get_dnp3_frozen_counter_32wFlag(flag: uint8, count_value: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_counter_32wFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_counter_32wFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, count_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g21v2
|
||||
function get_dnp3_frozen_counter_16wFlag(flag: uint8, count_value: uint16): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_counter_16wFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_counter_16wFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, count_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g21v5
|
||||
function get_dnp3_frozen_counter_32wFlagTime(flag: uint8, count_value: uint32, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_counter_32wFlagTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_counter_32wFlagTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, count_value, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g21v6
|
||||
function get_dnp3_frozen_counter_16wFlagTime(flag: uint8, count_value: uint16, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_counter_16wFlagTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_counter_16wFlagTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, count_value, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g21v9
|
||||
function get_dnp3_frozen_counter_32woFlag(count_value: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_counter_32woFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_counter_32woFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), count_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g21v10
|
||||
function get_dnp3_frozen_counter_16woFlag(count_value: uint16): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_counter_16woFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_counter_16woFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), count_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g30v1
|
||||
function get_dnp3_analog_input_32wFlag(flag: uint8, value: int32): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_32wFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_32wFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g30v2
|
||||
function get_dnp3_analog_input_16wFlag(flag: uint8, value: int16): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_16wFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_16wFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g30v3
|
||||
function get_dnp3_analog_input_32woFlag(value: int32): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_32woFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_32woFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
#g30v4
|
||||
function get_dnp3_analog_input_16woFlag(value: int16): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_16woFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_16woFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g30v5
|
||||
function get_dnp3_analog_input_SPwFlag(flag: uint8, value: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_SPwFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_SPwFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g30v6
|
||||
function get_dnp3_analog_input_DPwFlag(flag: uint8, value_low: uint32, value_high: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_DPwFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_DPwFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value_low, value_high);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g31v1
|
||||
function get_dnp3_frozen_analog_input_32wFlag(flag: uint8, frozen_value: int32): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_32wFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_32wFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g31v2
|
||||
function get_dnp3_frozen_analog_input_16wFlag(flag: uint8, frozen_value: int16): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_16wFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_16wFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g31v3
|
||||
function get_dnp3_frozen_analog_input_32wTime(flag: uint8, frozen_value: int32, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_32wTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_32wTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g31v4
|
||||
function get_dnp3_frozen_analog_input_16wTime(flag: uint8, frozen_value: int16, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_16wTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_16wTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g31v5
|
||||
function get_dnp3_frozen_analog_input_32woFlag(frozen_value: int32): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_32woFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_32woFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), frozen_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g31v6
|
||||
function get_dnp3_frozen_analog_input_16woFlag(frozen_value: int16): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_16woFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_16woFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), frozen_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g31v7
|
||||
function get_dnp3_frozen_analog_input_SPwFlag(flag: uint8, frozen_value: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_SPwFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_SPwFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g31v8
|
||||
function get_dnp3_frozen_analog_input_DPwFlag(flag: uint8, frozen_value_low: uint32, frozen_value_high: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_DPwFlag )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_DPwFlag(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value_low, frozen_value_high);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g32v1
|
||||
function get_dnp3_analog_input_event_32woTime(flag: uint8, value: int32): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_event_32woTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_event_32woTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g32v2
|
||||
function get_dnp3_analog_input_event_16woTime(flag: uint8, value: int16): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_event_16woTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_event_16woTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g32v3
|
||||
function get_dnp3_analog_input_event_32wTime(flag: uint8, value: int32, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_event_32wTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_event_32wTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g32v4
|
||||
function get_dnp3_analog_input_event_16wTime(flag: uint8, value: int16, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_event_16wTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_event_16wTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g32v5
|
||||
function get_dnp3_analog_input_event_SPwoTime(flag: uint8, value: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_event_SPwoTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_event_SPwoTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g32v6
|
||||
function get_dnp3_analog_input_event_DPwoTime(flag: uint8, value_low: uint32, value_high: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_event_DPwoTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_event_DPwoTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value_low, value_high);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g32v7
|
||||
function get_dnp3_analog_input_event_SPwTime(flag: uint8, value: uint32, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_event_SPwTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_event_SPwTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g32v8
|
||||
function get_dnp3_analog_input_event_DPwTime(flag: uint8, value_low: uint32, value_high: uint32, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_analog_input_event_DPwTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_analog_input_event_DPwTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, value_low, value_high, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g33v1
|
||||
function get_dnp3_frozen_analog_input_event_32woTime(flag: uint8, frozen_value: int32): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_event_32woTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_event_32woTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g33v2
|
||||
function get_dnp3_frozen_analog_input_event_16woTime(flag: uint8, frozen_value: int16): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_event_16woTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_event_16woTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g33v3
|
||||
function get_dnp3_frozen_analog_input_event_32wTime(flag: uint8, frozen_value: int32, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_event_32wTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_event_32wTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g33v4
|
||||
function get_dnp3_frozen_analog_input_event_16wTime(flag: uint8, frozen_value: int16, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_event_16wTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_event_16wTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g33v5
|
||||
function get_dnp3_frozen_analog_input_event_SPwoTime(flag: uint8, frozen_value: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_event_SPwoTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_event_SPwoTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g33v6
|
||||
function get_dnp3_frozen_analog_input_event_DPwoTime(flag: uint8, frozen_value_low: uint32, frozen_value_high: uint32): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_event_DPwoTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_event_DPwoTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value_low, frozen_value_high);
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g33v7
|
||||
function get_dnp3_frozen_analog_input_event_SPwTime(flag: uint8, frozen_value: uint32, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_event_SPwTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_event_SPwTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g33v8
|
||||
function get_dnp3_frozen_analog_input_event_DPwTime(flag: uint8, frozen_value_low: uint32, frozen_value_high: uint32, time48: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_frozen_analog_input_event_DPwTime )
|
||||
{
|
||||
BifEvent::generate_dnp3_frozen_analog_input_event_DPwTime(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), flag, frozen_value_low, frozen_value_high, bytestring_to_val(time48));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
# g70v5
|
||||
function get_dnp3_file_transport(file_handle: uint32, block_num: uint32, file_data: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_file_transport )
|
||||
{
|
||||
BifEvent::generate_dnp3_file_transport(
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), file_handle, block_num, bytestring_to_val(file_data));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
#### for debug use or unknown data types used in "case"
|
||||
function get_dnp3_debug_byte(debug: const_bytestring): bool
|
||||
%{
|
||||
if ( ::dnp3_debug_byte )
|
||||
{
|
||||
BifEvent::generate_dnp3_debug_byte (
|
||||
connection()->bro_analyzer(),
|
||||
connection()->bro_analyzer()->Conn(),
|
||||
is_orig(), bytestring_to_val(debug));
|
||||
}
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
};
|
||||
|
||||
refine typeattr Header_Block += &let {
|
||||
get_header: bool = $context.flow.get_dnp3_header_block(start, len, ctrl, dest_addr, src_addr);
|
||||
};
|
||||
|
||||
refine typeattr DNP3_Application_Request_Header += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_application_request_header(function_code);
|
||||
};
|
||||
|
||||
refine typeattr DNP3_Application_Response_Header += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_application_response_header(function_code, internal_indications);
|
||||
};
|
||||
|
||||
refine typeattr Object_Header += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_object_header(object_type_field, qualifier_field, number_of_item, rf_value_low, rf_value_high);
|
||||
};
|
||||
|
||||
refine typeattr Prefix_Type += &let {
|
||||
prefix_called: bool = $context.flow.get_dnp3_object_prefix(prefix_value);
|
||||
};
|
||||
|
||||
refine typeattr Response_Data_Object += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_response_data_object(data_value);
|
||||
};
|
||||
|
||||
# g0
|
||||
refine typeattr AttributeCommon += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_attribute_common(data_type_code, leng, attribute_obj);
|
||||
};
|
||||
|
||||
# g12v1
|
||||
refine typeattr CROB += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_crob(control_code, count, on_time, off_time, status_code);
|
||||
};
|
||||
|
||||
# g12v2
|
||||
refine typeattr PCB += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_pcb(control_code, count, on_time, off_time, status_code);
|
||||
};
|
||||
|
||||
# g20v1
|
||||
refine typeattr Counter32wFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_counter_32wFlag(flag, count_value);
|
||||
};
|
||||
|
||||
# g20v2
|
||||
refine typeattr Counter16wFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_counter_16wFlag(flag, count_value);
|
||||
};
|
||||
|
||||
# g20v5
|
||||
refine typeattr Counter32woFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_counter_32woFlag(count_value);
|
||||
};
|
||||
|
||||
# g20v6
|
||||
refine typeattr Counter16woFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_counter_16woFlag(count_value);
|
||||
};
|
||||
|
||||
# g21v1
|
||||
refine typeattr FrozenCounter32wFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_counter_32wFlag(flag, count_value);
|
||||
};
|
||||
|
||||
# g21v2
|
||||
refine typeattr FrozenCounter16wFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_counter_16wFlag(flag, count_value);
|
||||
};
|
||||
# g21v5
|
||||
refine typeattr FrozenCounter32wFlagTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_counter_32wFlagTime(flag, count_value, time48);
|
||||
};
|
||||
|
||||
# g21v6
|
||||
refine typeattr FrozenCounter16wFlagTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_counter_16wFlagTime(flag, count_value, time48);
|
||||
};
|
||||
|
||||
# g21v9
|
||||
refine typeattr FrozenCounter32woFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_counter_32woFlag(count_value);
|
||||
};
|
||||
|
||||
# g21v10
|
||||
refine typeattr FrozenCounter16woFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_counter_16woFlag(count_value);
|
||||
};
|
||||
|
||||
# g30v1
|
||||
refine typeattr AnalogInput32wFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_32wFlag(flag, value);
|
||||
};
|
||||
|
||||
# g30v2
|
||||
refine typeattr AnalogInput16wFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_16wFlag(flag, value);
|
||||
};
|
||||
|
||||
# g30v3
|
||||
refine typeattr AnalogInput32woFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_32woFlag(value);
|
||||
};
|
||||
|
||||
# g30v4
|
||||
refine typeattr AnalogInput16woFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_16woFlag(value);
|
||||
};
|
||||
|
||||
# g30v5
|
||||
refine typeattr AnalogInputSPwFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_SPwFlag(flag, value);
|
||||
};
|
||||
|
||||
# g30v6
|
||||
refine typeattr AnalogInputDPwFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_DPwFlag(flag, value_low, value_high);
|
||||
};
|
||||
|
||||
# g31v1
|
||||
refine typeattr FrozenAnalogInput32wFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_32wFlag(flag, frozen_value);
|
||||
};
|
||||
|
||||
# g31v2
|
||||
refine typeattr FrozenAnalogInput16wFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_16wFlag(flag, frozen_value);
|
||||
};
|
||||
|
||||
# g31v3
|
||||
refine typeattr FrozenAnalogInput32wTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_32wTime(flag, frozen_value, time48);
|
||||
};
|
||||
|
||||
# g31v4
|
||||
refine typeattr FrozenAnalogInput16wTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_16wTime(flag, frozen_value, time48);
|
||||
};
|
||||
|
||||
# g31v5
|
||||
refine typeattr FrozenAnalogInput32woFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_32woFlag(frozen_value);
|
||||
};
|
||||
|
||||
# g31v6
|
||||
refine typeattr FrozenAnalogInput16woFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_16woFlag(frozen_value);
|
||||
};
|
||||
|
||||
# g31v7
|
||||
refine typeattr FrozenAnalogInputSPwFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_SPwFlag(flag, frozen_value);
|
||||
};
|
||||
|
||||
# g31v8
|
||||
refine typeattr FrozenAnalogInputDPwFlag += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_DPwFlag(flag, frozen_value_low, frozen_value_high);
|
||||
};
|
||||
|
||||
# g32v1
|
||||
refine typeattr AnalogInput32woTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_event_32woTime(flag, value);
|
||||
};
|
||||
|
||||
# g32v2
|
||||
refine typeattr AnalogInput16woTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_event_16woTime(flag, value);
|
||||
};
|
||||
|
||||
# g32v3
|
||||
refine typeattr AnalogInput32wTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_event_32wTime(flag, value, time48);
|
||||
};
|
||||
|
||||
# g32v4
|
||||
refine typeattr AnalogInput16wTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_event_16wTime(flag, value, time48);
|
||||
};
|
||||
|
||||
# g32v5
|
||||
refine typeattr AnalogInputSPwoTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_event_SPwoTime(flag, value);
|
||||
};
|
||||
|
||||
# g32v6
|
||||
refine typeattr AnalogInputDPwoTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_event_DPwoTime(flag, value_low, value_high);
|
||||
};
|
||||
|
||||
# g32v7
|
||||
refine typeattr AnalogInputSPwTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_event_SPwTime(flag, value, time48);
|
||||
};
|
||||
|
||||
# g32v8
|
||||
refine typeattr AnalogInputDPwTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_analog_input_event_DPwTime(flag, value_low, value_high, time48);
|
||||
};
|
||||
|
||||
# g33v1
|
||||
refine typeattr FrozenAnaInputEve32woTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_event_32woTime(flag, f_value);
|
||||
};
|
||||
|
||||
# g33v2
|
||||
refine typeattr FrozenAnaInputEve16woTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_event_16woTime(flag, f_value);
|
||||
};
|
||||
|
||||
# g33v3
|
||||
refine typeattr FrozenAnaInputEve32wTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_event_32wTime(flag, f_value, time48);
|
||||
};
|
||||
|
||||
# g33v4
|
||||
refine typeattr FrozenAnaInputEve16wTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_event_16wTime(flag, f_value, time48);
|
||||
};
|
||||
|
||||
# g33v5
|
||||
refine typeattr FrozenAnaInputEveSPwoTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_event_SPwoTime(flag, f_value);
|
||||
};
|
||||
|
||||
# g33v6
|
||||
refine typeattr FrozenAnaInputEveDPwoTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_event_DPwoTime(flag, f_value_low, f_value_high);
|
||||
};
|
||||
|
||||
# g33v7
|
||||
refine typeattr FrozenAnaInputEveSPwTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_event_SPwTime(flag, f_value, time48);
|
||||
};
|
||||
|
||||
# g33v8
|
||||
refine typeattr FrozenAnaInputEveDPwTime += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_frozen_analog_input_event_DPwTime(flag, f_value_low, f_value_high, time48);
|
||||
};
|
||||
|
||||
# g70v5
|
||||
refine typeattr File_Transport += &let {
|
||||
result: bool = $context.flow.get_dnp3_file_transport(file_handle, block_num, file_data);
|
||||
};
|
||||
|
||||
refine typeattr Debug_Byte += &let {
|
||||
process_request: bool = $context.flow.get_dnp3_debug_byte(debug);
|
||||
};
|
||||
|
||||
1451
src/analyzer/protocol/dnp3/dnp3-objects.pac
Normal file
1451
src/analyzer/protocol/dnp3/dnp3-objects.pac
Normal file
File diff suppressed because it is too large
Load diff
257
src/analyzer/protocol/dnp3/dnp3-protocol.pac
Normal file
257
src/analyzer/protocol/dnp3/dnp3-protocol.pac
Normal file
|
|
@ -0,0 +1,257 @@
|
|||
#
|
||||
# This is Binpac code for DNP3 analyzer by Hui Lin.
|
||||
#
|
||||
|
||||
type DNP3_PDU(is_orig: bool) = case is_orig of {
|
||||
true -> request: DNP3_Request;
|
||||
false -> response: DNP3_Response;
|
||||
} &byteorder = bigendian;
|
||||
|
||||
type Header_Block = record {
|
||||
start: uint16 &check(start == 0x0564);
|
||||
len: uint8;
|
||||
ctrl: uint8;
|
||||
dest_addr: uint16;
|
||||
src_addr: uint16;
|
||||
} &byteorder = littleendian;
|
||||
|
||||
type DNP3_Request = record {
|
||||
addin_header: Header_Block; ## added by Hui Lin in Bro code
|
||||
app_header: DNP3_Application_Request_Header;
|
||||
data: case ( app_header.function_code ) of {
|
||||
CONFIRM -> none_coonfirm: empty;
|
||||
READ -> read_requests: Request_Objects(app_header.function_code)[];
|
||||
WRITE -> write_requests: Request_Objects(app_header.function_code)[];
|
||||
SELECT -> select_requests: Request_Objects(app_header.function_code)[];
|
||||
OPERATE -> operate_requests: Request_Objects(app_header.function_code)[];
|
||||
DIRECT_OPERATE -> direct_operate_requests: Request_Objects(app_header.function_code)[];
|
||||
DIRECT_OPERATE_NR -> direct_operate_nr_requests: Request_Objects(app_header.function_code)[];
|
||||
IMMED_FREEZE -> immed_freeze_requests: Request_Objects(app_header.function_code)[];
|
||||
IMMED_FREEZE_NR -> immed_freeze_nr_requests: Request_Objects(app_header.function_code)[];
|
||||
FREEZE_CLEAR -> freeze_clear_requests: Request_Objects(app_header.function_code)[];
|
||||
FREEZE_CLEAR_NR -> freeze_clear_nr_requests: Request_Objects(app_header.function_code)[];
|
||||
FREEZE_AT_TIME -> freeze_time_requests: Request_Objects(app_header.function_code)[];
|
||||
FREEZE_AT_TIME_NR -> freeze_time_nr_requests: Request_Objects(app_header.function_code)[];
|
||||
COLD_RESTART -> cold_restart: empty;
|
||||
WARM_RESTART -> warm_restart: empty;
|
||||
INITIALIZE_DATA -> initilize_data: empty &check(0); # obsolete
|
||||
INITIALIZE_APPL -> initilize_appl: Request_Objects(app_header.function_code)[];
|
||||
START_APPL -> start_appl: Request_Objects(app_header.function_code)[];
|
||||
STOP_APPL -> stop_appl: Request_Objects(app_header.function_code)[];
|
||||
SAVE_CONFIG -> save_config: empty &check(0); # depracated
|
||||
ENABLE_UNSOLICITED -> enable_unsolicited: Request_Objects(app_header.function_code)[];
|
||||
DISABLE_UNSOLICITED -> disable_unsolicited: Request_Objects(app_header.function_code)[];
|
||||
ASSIGN_CLASS -> assign_class: Request_Objects(app_header.function_code)[];
|
||||
DELAY_MEASURE -> delay_measure: empty;
|
||||
RECORD_CURRENT_TIME -> record_cur_time: empty;
|
||||
OPEN_FILE -> open_file: Request_Objects(app_header.function_code)[];
|
||||
CLOSE_FILE -> close_file: Request_Objects(app_header.function_code)[];
|
||||
DELETE_FILE -> delete_file: Request_Objects(app_header.function_code)[];
|
||||
ABORT_FILE -> abort_file: Request_Objects(app_header.function_code)[];
|
||||
GET_FILE_INFO -> get_file_info: Request_Objects(app_header.function_code)[];
|
||||
AUTHENTICATE_FILE -> auth_file: Request_Objects(app_header.function_code)[];
|
||||
ACTIVATE_CONFIG -> active_config: Request_Objects(app_header.function_code)[];
|
||||
AUTHENTICATE_REQ -> auth_req: Request_Objects(app_header.function_code)[];
|
||||
AUTHENTICATE_ERR -> auth_err: Request_Objects(app_header.function_code)[];
|
||||
default -> unknown: bytestring &restofdata;
|
||||
};
|
||||
} &byteorder = bigendian
|
||||
&length= 9 + addin_header.len - 5 - 1;
|
||||
|
||||
type Debug_Byte = record {
|
||||
debug: bytestring &restofdata;
|
||||
};
|
||||
|
||||
type DNP3_Response = record {
|
||||
addin_header: Header_Block;
|
||||
app_header: DNP3_Application_Response_Header;
|
||||
data: case ( app_header.function_code ) of {
|
||||
RESPONSE -> response_objects: Response_Objects(app_header.function_code)[];
|
||||
UNSOLICITED_RESPONSE -> unsolicited_response_objects: Response_Objects(app_header.function_code)[];
|
||||
AUTHENTICATE_RESP -> auth_response: Response_Objects(app_header.function_code)[];
|
||||
default -> unknown: Debug_Byte;
|
||||
};
|
||||
} &byteorder = bigendian
|
||||
&length= 9 + addin_header.len - 5 - 1'
|
||||
|
||||
type DNP3_Application_Request_Header = record {
|
||||
empty: bytestring &length = 0; # Work-around BinPAC problem.
|
||||
application_control : uint8;
|
||||
function_code : uint8 ;
|
||||
} &length = 2;
|
||||
|
||||
type DNP3_Application_Response_Header = record {
|
||||
empty: bytestring &length = 0; # Work-around BinPAC problem.
|
||||
application_control : uint8;
|
||||
function_code : uint8;
|
||||
internal_indications : uint16;
|
||||
} &length = 4;
|
||||
|
||||
type Request_Objects(function_code: uint8) = record {
|
||||
object_header: Object_Header(function_code);
|
||||
data: case (object_header.object_type_field) of {
|
||||
0x0c03 -> bocmd_PM: Request_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) + 1 ];
|
||||
0x3202 -> time_interval_ojbects: Request_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ object_header.number_of_item]
|
||||
&check( object_header.qualifer_field == 0x0f && object_header.number_of_item == 0x01);
|
||||
default -> ojbects: Request_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ object_header.number_of_item];
|
||||
};
|
||||
# dump_data is always empty; I intend to use it for checking some conditions;
|
||||
# However, in the current binpac implementation, &check is not implemented
|
||||
dump_data: case (function_code) of {
|
||||
OPEN_FILE -> open_file_dump: empty &check(object_header.object_type_field == 0x4603);
|
||||
CLOSE_FILE -> close_file_dump: empty &check(object_header.object_type_field == 0x4604);
|
||||
DELETE_FILE -> delete_file_dump: empty &check(object_header.object_type_field == 0x4603);
|
||||
ABORT_FILE -> abort_file_dump: empty &check(object_header.object_type_field == 0x4604);
|
||||
GET_FILE_INFO -> get_file_info: empty &check(object_header.object_type_field == 0x4607);
|
||||
AUTHENTICATE_FILE -> auth_file: empty &check(object_header.object_type_field == 0x4602);
|
||||
ACTIVATE_CONFIG -> active_config: empty &check(object_header.object_type_field == 0x4608 || (object_header.object_type_field & 0xFF00) == 0x6E00);
|
||||
default -> default_dump: empty;
|
||||
};
|
||||
};
|
||||
|
||||
type Response_Objects(function_code: uint8) = record {
|
||||
object_header: Object_Header(function_code);
|
||||
data: case (object_header.object_type_field) of {
|
||||
0x0101 -> biwoflag: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) ];
|
||||
0x0301 -> diwoflag: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) ];
|
||||
0x0a01 -> bowoflag: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) ];
|
||||
0x0c03 -> bocmd_PM: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) ];
|
||||
default -> ojbects: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ object_header.number_of_item];
|
||||
};
|
||||
};
|
||||
|
||||
type Object_Header(function_code: uint8) = record {
|
||||
object_type_field: uint16 ;
|
||||
qualifier_field: uint8 ;
|
||||
range_field: case ( qualifier_field & 0x0f ) of {
|
||||
0 -> range_field_0: Range_Field_0 &check(range_field_0.stop_index >= range_field_0.start_index);
|
||||
1 -> range_field_1: Range_Field_1 &check(range_field_1.stop_index >= range_field_1.start_index);
|
||||
2 -> range_field_2: Range_Field_2 &check(range_field_2.stop_index >= range_field_2.start_index);
|
||||
3 -> range_field_3: Range_Field_3;
|
||||
4 -> range_field_4: Range_Field_4;
|
||||
5 -> range_field_5: Range_Field_5;
|
||||
6 -> range_field_6: empty;
|
||||
7 -> range_field_7: uint8;
|
||||
8 -> range_field_8: uint16;
|
||||
9 -> range_field_9: uint32;
|
||||
0x0b -> range_field_b: uint8;
|
||||
default -> unknown: bytestring &restofdata &check(0);
|
||||
};
|
||||
# dump_data is always empty; used to check dependency bw object_type_field and qualifier_field
|
||||
dump_data: case ( object_type_field & 0xff00 ) of {
|
||||
0x3C00 -> dump_3c: empty &check( (object_type_field == 0x3C01 || object_type_field == 0x3C02 || object_type_field == 0x3C03 || object_type_field == 0x3C04) && ( qualifier_field == 0x06 ) );
|
||||
default -> dump_def: empty;
|
||||
};
|
||||
}
|
||||
&let{
|
||||
number_of_item: int = case (qualifier_field & 0x0f) of {
|
||||
0 -> (range_field_0.stop_index - range_field_0.start_index + 1);
|
||||
1 -> (range_field_1.stop_index - range_field_1.start_index + 1);
|
||||
2 -> (range_field_2.stop_index - range_field_2.start_index + 1);
|
||||
7 -> range_field_7;
|
||||
8 -> ( range_field_8 & 0x0ff )* 0x100 + ( range_field_8 / 0x100 ) ;
|
||||
9 -> ( range_field_9 & 0x000000ff )* 0x1000000 + (range_field_9 & 0x0000ff00) * 0x100 + (range_field_9 & 0x00ff0000) / 0x100 + (range_field_9 & 0xff000000) / 0x1000000 ;
|
||||
0x0b -> range_field_b;
|
||||
default -> 0;
|
||||
};
|
||||
rf_value_low: int = case (qualifier_field & 0x0f) of {
|
||||
0 -> 0 + range_field_0.start_index;
|
||||
1 -> range_field_1.start_index;
|
||||
2 -> range_field_2.start_index;
|
||||
3 -> range_field_3.start_addr;
|
||||
4 -> range_field_4.start_addr;
|
||||
5 -> range_field_5.start_addr;
|
||||
6 -> 0xffff;
|
||||
7 -> range_field_7;
|
||||
8 -> range_field_8;
|
||||
9 -> range_field_9;
|
||||
0x0b -> range_field_b;
|
||||
default -> 0 ;
|
||||
};
|
||||
rf_value_high: int = case (qualifier_field & 0x0f) of {
|
||||
0 -> 0 + range_field_0.stop_index;
|
||||
1 -> range_field_1.stop_index;
|
||||
2 -> range_field_2.stop_index;
|
||||
3 -> range_field_3.stop_addr;
|
||||
4 -> range_field_4.stop_addr;
|
||||
5 -> range_field_5.stop_addr;
|
||||
6 -> 0xffff;
|
||||
default -> 0 ;
|
||||
};
|
||||
};
|
||||
|
||||
type Range_Field_0 = record {
|
||||
start_index: uint8;
|
||||
stop_index: uint8;
|
||||
};
|
||||
|
||||
type Range_Field_1 = record {
|
||||
start_index: uint16;
|
||||
stop_index: uint16;
|
||||
}
|
||||
&byteorder = littleendian;
|
||||
|
||||
type Range_Field_2 = record {
|
||||
start_index: uint32;
|
||||
stop_index: uint32;
|
||||
}
|
||||
&byteorder = littleendian;
|
||||
|
||||
type Range_Field_3 = record {
|
||||
start_addr: uint8;
|
||||
stop_addr: uint8;
|
||||
};
|
||||
|
||||
type Range_Field_4 = record {
|
||||
start_addr: uint16;
|
||||
stop_addr: uint16;
|
||||
};
|
||||
|
||||
type Range_Field_5 = record {
|
||||
start_addr: uint32;
|
||||
stop_addr: uint32;
|
||||
};
|
||||
|
||||
enum function_codes_value {
|
||||
CONFIRM = 0x00,
|
||||
READ = 0x01,
|
||||
WRITE = 0x02,
|
||||
SELECT = 0x03,
|
||||
OPERATE = 0x04,
|
||||
DIRECT_OPERATE = 0x05,
|
||||
DIRECT_OPERATE_NR = 0x06,
|
||||
IMMED_FREEZE = 0x07,
|
||||
IMMED_FREEZE_NR = 0x08,
|
||||
FREEZE_CLEAR = 0x09,
|
||||
FREEZE_CLEAR_NR = 0x0a,
|
||||
FREEZE_AT_TIME = 0x0b,
|
||||
FREEZE_AT_TIME_NR = 0x0c,
|
||||
COLD_RESTART = 0x0d,
|
||||
WARM_RESTART = 0x0e,
|
||||
INITIALIZE_DATA = 0x0f,
|
||||
INITIALIZE_APPL = 0x10,
|
||||
START_APPL = 0x11,
|
||||
STOP_APPL = 0x12,
|
||||
SAVE_CONFIG = 0x13,
|
||||
ENABLE_UNSOLICITED = 0x14,
|
||||
DISABLE_UNSOLICITED = 0x15,
|
||||
ASSIGN_CLASS = 0x16,
|
||||
DELAY_MEASURE = 0x17,
|
||||
RECORD_CURRENT_TIME = 0x18,
|
||||
OPEN_FILE = 0x19,
|
||||
CLOSE_FILE = 0x1a,
|
||||
DELETE_FILE = 0x1b,
|
||||
GET_FILE_INFO = 0x1c,
|
||||
AUTHENTICATE_FILE = 0x1d,
|
||||
ABORT_FILE = 0x1e,
|
||||
ACTIVATE_CONFIG = 0x1f,
|
||||
AUTHENTICATE_REQ = 0x20,
|
||||
AUTHENTICATE_ERR = 0x21,
|
||||
# reserved
|
||||
RESPONSE = 0x81,
|
||||
UNSOLICITED_RESPONSE = 0x82,
|
||||
AUTHENTICATE_RESP = 0x83,
|
||||
# reserved
|
||||
};
|
||||
|
||||
%include dnp3-objects.pac
|
||||
16
src/analyzer/protocol/dnp3/dnp3.pac
Normal file
16
src/analyzer/protocol/dnp3/dnp3.pac
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
|
||||
%include binpac.pac
|
||||
%include bro.pac
|
||||
|
||||
%extern{
|
||||
#include "events.bif.h"
|
||||
%}
|
||||
|
||||
analyzer DNP3 withcontext {
|
||||
connection: DNP3_Conn;
|
||||
flow: DNP3_Flow;
|
||||
};
|
||||
|
||||
%include dnp3-protocol.pac
|
||||
%include dnp3-analyzer.pac
|
||||
|
||||
241
src/analyzer/protocol/dnp3/events.bif
Normal file
241
src/analyzer/protocol/dnp3/events.bif
Normal file
|
|
@ -0,0 +1,241 @@
|
|||
|
||||
### event handler that is used to analyze network packets based on DNP3 protocol
|
||||
### starts with dnp3_
|
||||
### In src/DNP3.cc, we include detailed descriptions on how DNP3 Pseudo Link Layer,
|
||||
### DNP3 Pseudo Transport Layer, DNP3 Pseudo Application Layer are packed into application
|
||||
### layer payload over TCP
|
||||
### The event handlers defined for binpac DNP3 analyzer are used to analyze fields
|
||||
### of the DNP3 Pseudo Application Layer.
|
||||
### we have tried our best to name the event handler by the field names that is described
|
||||
### in DNP3 Specification Volum 2, Part 1 Basic, Application Layer, DNP3 Specification
|
||||
### Volum 4, Data Link Layer, DNP3 Specification Volum 6, Part 1 Basic, DNP3 OBJECT LIBRARY,
|
||||
### DNP3 Specification Volum 6, Part 2 Objects, DNP3 OBJECT LIBRARY
|
||||
|
||||
event dnp3_debug_bufferBytes%(c: connection , is_orig: bool, buffer_bytes: count%);
|
||||
|
||||
|
||||
## Generated for the request header in Pseudo Application Layer.
|
||||
## The request header contains two fields:
|
||||
## fc: function code.
|
||||
event dnp3_application_request_header%(c: connection, is_orig: bool, fc: count%);
|
||||
|
||||
## Generated for the response header in Pseudo Application Layer.
|
||||
## The response header contains three fields:
|
||||
## app_control: application control field.
|
||||
## fc: function code.
|
||||
## iin: internal indication number
|
||||
event dnp3_application_response_header%(c: connection, is_orig: bool, fc: count, iin: count%);
|
||||
|
||||
## Generated for the object header found in both DNP3 requests and responses
|
||||
## obj_type: type of object, which is classified based on an 8-bit group number and an 8-bit variation number
|
||||
## qua_field: qualifier field
|
||||
## rf_low, rf_high: the structure of the range field depends on the qualified field. In some cases, range field
|
||||
## contain only one logic part, e.g., number of objects, so only rf_low contains the useful values; in some
|
||||
## cases, range field contain two logic parts, e.g., start index and stop index, so rf_low contains the start
|
||||
## index while rf_high contains the stop index
|
||||
event dnp3_object_header%(c: connection, is_orig: bool, obj_type: count, qua_field: count, number: count, rf_low: count, rf_high: count%);
|
||||
|
||||
## Generated for the prefix before each object.
|
||||
## the structure and the meaning of the prefix are defined by the qualifier field
|
||||
event dnp3_object_prefix%(c: connection, is_orig: bool, prefix_value: count%);
|
||||
|
||||
## Generated for the additional header that is added by the DNP3.cc;
|
||||
## the reason to add this header is found in DNP3.cc
|
||||
## start: the first two bytes of the DNP3 Pseudo Link Layer; its value is fixed as 0x0564
|
||||
## len: the "length" field in the DNP3 Pseudo Link Layer
|
||||
## ctrl: the "control" field in the DNP3 Pseudo Link Layer
|
||||
## dest_addr: the "destination" field in the DNP3 Pseudo Link Layer
|
||||
## src_addr: the "source" field in the DNP3 Pseudo Link Layer
|
||||
event dnp3_header_block%(c: connection, is_orig: bool, start: count, len: count, ctrl: count, dest_addr: count, src_addr: count%);
|
||||
|
||||
## Generated for "Response_Data_Object"
|
||||
## the "Response_Data_Object" contains two parts: object prefix and objects data.
|
||||
## In most cases, objects data are defined by new record types. But in a few
|
||||
## cases, objects data are directly basic types, such as int16, or int8; thus we use
|
||||
## a additional data_value to record the values of those object data.
|
||||
event dnp3_response_data_object%(c: connection, is_orig: bool, data_value: count%);
|
||||
|
||||
## Different from most binpac scripts, which consists only two pac files: *-analyzer.pac
|
||||
## and *-protocol.pac. I use a separate pac files, i.e., dnp3-objects.pac to contain
|
||||
## different types of object data.
|
||||
## The following event handlers are all generated for the different object data types.
|
||||
|
||||
event dnp3_attribute_common%(c: connection, is_orig: bool, data_type_code: count, leng: count, attribute_obj: string%);
|
||||
|
||||
## Generated for the object with the group number 12 and variation number 1
|
||||
## CROB: control relay output block
|
||||
event dnp3_crob%(c: connection, is_orig: bool, control_code: count, count8: count, on_time: count, off_time: count, status_code: count%);
|
||||
|
||||
## Generated for the object with the group number 12 and variation number 2
|
||||
## PCB: Pattern Control Block
|
||||
event dnp3_pcb%(c: connection, is_orig: bool, control_code: count, count8: count, on_time: count, off_time: count, status_code: count%);
|
||||
|
||||
## Generated for the object with the group number 20 and variation number 1
|
||||
## counter 32 bit with flag
|
||||
event dnp3_counter_32wFlag%(c: connection, is_orig: bool, flag: count, count_value: count%);
|
||||
|
||||
## Generated for the object with the group number 20 and variation number 2
|
||||
## counter 16 bit with flag
|
||||
event dnp3_counter_16wFlag%(c: connection, is_orig: bool, flag: count, count_value: count%);
|
||||
|
||||
## Generated for the object with the group number 20 and variation number 5
|
||||
## counter 32 bit without flag
|
||||
event dnp3_counter_32woFlag%(c: connection, is_orig: bool, count_value: count%);
|
||||
|
||||
## Generated for the object with the group number 20 and variation number 6
|
||||
## counter 16 bit without flag
|
||||
event dnp3_counter_16woFlag%(c: connection, is_orig: bool, count_value: count%);
|
||||
|
||||
## Generated for the object with the group number 21 and variation number 1
|
||||
## frozen counter 32 bit with flag
|
||||
event dnp3_frozen_counter_32wFlag%(c: connection, is_orig: bool, flag:count, count_value: count%);
|
||||
|
||||
## Generated for the object with the group number 21 and variation number 2
|
||||
## frozen counter 16 bit with flag
|
||||
event dnp3_frozen_counter_16wFlag%(c: connection, is_orig: bool, flag:count, count_value: count%);
|
||||
|
||||
## Generated for the object with the group number 21 and variation number 5
|
||||
## frozen counter 32 bit with flag and time
|
||||
event dnp3_frozen_counter_32wFlagTime%(c: connection, is_orig: bool, flag:count, count_value: count, time48: string%);
|
||||
|
||||
## Generated for the object with the group number 21 and variation number 6
|
||||
## frozen counter 16 bit with flag and time
|
||||
event dnp3_frozen_counter_16wFlagTime%(c: connection, is_orig: bool, flag:count, count_value: count, time48: string%);
|
||||
|
||||
## Generated for the object with the group number 21 and variation number 9
|
||||
## frozen counter 32 bit without flag
|
||||
event dnp3_frozen_counter_32woFlag%(c: connection, is_orig: bool, count_value: count%);
|
||||
|
||||
## Generated for the object with the group number 21 and variation number 10
|
||||
## frozen counter 16 bit without flag
|
||||
event dnp3_frozen_counter_16woFlag%(c: connection, is_orig: bool, count_value: count%);
|
||||
|
||||
## Generated for the object with the group number 30 and variation number 1
|
||||
## analog input 32 bit with flag
|
||||
event dnp3_analog_input_32wFlag%(c: connection, is_orig: bool, flag: count, value: count%);
|
||||
|
||||
## Generated for the object with the group number 30 and variation number 2
|
||||
## analog input 16 bit with flag
|
||||
event dnp3_analog_input_16wFlag%(c: connection, is_orig: bool, flag: count, value: count%);
|
||||
|
||||
## Generated for the object with the group number 30 and variation number 3
|
||||
## analog input 32 bit without flag
|
||||
event dnp3_analog_input_32woFlag%(c: connection, is_orig: bool, value: count%);
|
||||
|
||||
## Generated for the object with the group number 30 and variation number 4
|
||||
## analog input 16 bit without flag
|
||||
event dnp3_analog_input_16woFlag%(c: connection, is_orig: bool, value: count%);
|
||||
|
||||
## Generated for the object with the group number 30 and variation number 5
|
||||
## analog input single precision, float point with flag
|
||||
event dnp3_analog_input_SPwFlag%(c: connection, is_orig: bool, flag: count, value: count%);
|
||||
|
||||
## Generated for the object with the group number 30 and variation number 6
|
||||
## analog input double precision, float point with flag
|
||||
event dnp3_analog_input_DPwFlag%(c: connection, is_orig: bool, flag: count, value_low: count, value_high: count%);
|
||||
|
||||
## Generated for the object with the group number 31 and variation number 1
|
||||
## frozen analog input 32 bit with flag
|
||||
event dnp3_frozen_analog_input_32wFlag%(c: connection, is_orig: bool, flag: count, frozen_value: count%);
|
||||
|
||||
## Generated for the object with the group number 31 and variation number 2
|
||||
## frozen analog input 16 bit with flag
|
||||
event dnp3_frozen_analog_input_16wFlag%(c: connection, is_orig: bool, flag: count, frozen_value: count%);
|
||||
|
||||
## Generated for the object with the group number 31 and variation number 3
|
||||
## frozen analog input 32 bit with time-of-freeze
|
||||
event dnp3_frozen_analog_input_32wTime%(c: connection, is_orig: bool, flag: count, frozen_value: count, time48: string%);
|
||||
|
||||
## Generated for the object with the group number 31 and variation number 4
|
||||
## frozen analog input 16 bit with time-of-freeze
|
||||
event dnp3_frozen_analog_input_16wTime%(c: connection, is_orig: bool, flag: count, frozen_value: count, time48: string%);
|
||||
|
||||
## Generated for the object with the group number 31 and variation number 5
|
||||
## frozen analog input 32 bit without flag
|
||||
event dnp3_frozen_analog_input_32woFlag%(c: connection, is_orig: bool, frozen_value: count%);
|
||||
|
||||
## Generated for the object with the group number 31 and variation number 6
|
||||
## frozen analog input 16 bit without flag
|
||||
event dnp3_frozen_analog_input_16woFlag%(c: connection, is_orig: bool, frozen_value: count%);
|
||||
|
||||
## Generated for the object with the group number 31 and variation number 7
|
||||
## frozen analog input single-precision, float point with flag
|
||||
event dnp3_frozen_analog_input_SPwFlag%(c: connection, is_orig: bool, flag: count, frozen_value: count%);
|
||||
|
||||
## Generated for the object with the group number 31 and variation number 8
|
||||
## frozen analog input double-precision, float point with flag
|
||||
event dnp3_frozen_analog_input_DPwFlag%(c: connection, is_orig: bool, flag: count, frozen_value_low: count, frozen_value_high: count%);
|
||||
|
||||
## Generated for the object with the group number 32 and variation number 1
|
||||
## analog input event 32 bit without time
|
||||
event dnp3_analog_input_event_32woTime%(c: connection, is_orig: bool, flag: count, value: count%);
|
||||
|
||||
## Generated for the object with the group number 32 and variation number 2
|
||||
## analog input event 16 bit without time
|
||||
event dnp3_analog_input_event_16woTime%(c: connection, is_orig: bool, flag: count, value: count%);
|
||||
|
||||
## Generated for the object with the group number 32 and variation number 3
|
||||
## analog input event 32 bit with time
|
||||
event dnp3_analog_input_event_32wTime%(c: connection, is_orig: bool, flag: count, value: count, time48: string%);
|
||||
|
||||
## Generated for the object with the group number 32 and variation number 4
|
||||
## analog input event 16 bit with time
|
||||
event dnp3_analog_input_event_16wTime%(c: connection, is_orig: bool, flag: count, value: count, time48: string%);
|
||||
|
||||
## Generated for the object with the group number 32 and variation number 5
|
||||
## analog input event single-precision float point without time
|
||||
event dnp3_analog_input_event_SPwoTime%(c: connection, is_orig: bool, flag: count, value: count%);
|
||||
|
||||
## Generated for the object with the group number 32 and variation number 6
|
||||
## analog input event double-precision float point without time
|
||||
event dnp3_analog_input_event_DPwoTime%(c: connection, is_orig: bool, flag: count, value_low: count, value_high: count%);
|
||||
|
||||
## Generated for the object with the group number 32 and variation number 7
|
||||
## analog input event single-precision float point with time
|
||||
event dnp3_analog_input_event_SPwTime%(c: connection, is_orig: bool, flag: count, value: count, time48: string%);
|
||||
|
||||
## Generated for the object with the group number 32 and variation number 8
|
||||
## analog input event double-precisiion float point with time
|
||||
event dnp3_analog_input_event_DPwTime%(c: connection, is_orig: bool, flag: count, value_low: count, value_high: count, time48: string%);
|
||||
|
||||
## Generated for the object with the group number 33 and variation number 1
|
||||
## frozen analog input event 32 bit without time
|
||||
event dnp3_frozen_analog_input_event_32woTime%(c: connection, is_orig: bool, flag: count, frozen_value: count%);
|
||||
|
||||
## Generated for the object with the group number 33 and variation number 2
|
||||
## frozen analog input event 16 bit without time
|
||||
event dnp3_frozen_analog_input_event_16woTime%(c: connection, is_orig: bool, flag: count, frozen_value: count%);
|
||||
|
||||
## Generated for the object with the group number 33 and variation number 3
|
||||
## frozen analog input event 32 bit with time
|
||||
event dnp3_frozen_analog_input_event_32wTime%(c: connection, is_orig: bool, flag: count, frozen_value: count, time48: string%);
|
||||
|
||||
## Generated for the object with the group number 33 and variation number 4
|
||||
## frozen analog input event 16 bit with time
|
||||
event dnp3_frozen_analog_input_event_16wTime%(c: connection, is_orig: bool, flag: count, frozen_value: count, time48: string%);
|
||||
|
||||
## Generated for the object with the group number 33 and variation number 5
|
||||
## frozen analog input event single-precision float point without time
|
||||
event dnp3_frozen_analog_input_event_SPwoTime%(c: connection, is_orig: bool, flag: count, frozen_value: count%);
|
||||
|
||||
## Generated for the object with the group number 33 and variation number 6
|
||||
## frozen analog input event double-precision float point without time
|
||||
event dnp3_frozen_analog_input_event_DPwoTime%(c: connection, is_orig: bool, flag: count, frozen_value_low: count, frozen_value_high: count%);
|
||||
|
||||
## Generated for the object with the group number 33 and variation number 7
|
||||
## frozen analog input event single-precision float point with time
|
||||
event dnp3_frozen_analog_input_event_SPwTime%(c: connection, is_orig: bool, flag: count, frozen_value: count, time48: string%);
|
||||
|
||||
## Generated for the object with the group number 34 and variation number 8
|
||||
## frozen analog input event double-precision float point with time
|
||||
event dnp3_frozen_analog_input_event_DPwTime%(c: connection, is_orig: bool, flag: count, frozen_value_low: count, frozen_value_high: count, time48: string%);
|
||||
|
||||
## g70
|
||||
event dnp3_file_transport%(c: connection, is_orig: bool, file_handle: count, block_num: count, file_data: string%);
|
||||
|
||||
## Generated for the "Debug_Byte" for the binpac analyzer
|
||||
## This event handler is left for the debug usage.
|
||||
## For example, in the binpac analyzer, a unknown "case" generated
|
||||
## this event; the user can base on the debug the byte string to check
|
||||
## what cause the malformed network packets
|
||||
event dnp3_debug_byte%(c: connection, is_orig: bool, debug: string%);
|
||||
|
|
@ -0,0 +1 @@
|
|||
6 of 52 events triggered by trace
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dnp3
|
||||
#open 2013-08-02-00-08-47
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
|
||||
#types time string addr port addr port string string count
|
||||
1324503054.884183 UWkUyAuUGXf 130.126.142.250 49413 130.126.140.229 20000 DELAY_MEASURE RESPONSE 0
|
||||
#close 2013-08-02-00-08-47
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
dnp3_header_block, T, 25605, 8, 196, 2, 3
|
||||
dnp3_application_request_header, T, 23
|
||||
dnp3_header_block, F, 25605, 16, 68, 3, 2
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 13314, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
|
|
@ -0,0 +1 @@
|
|||
4 of 52 events triggered by trace
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dnp3
|
||||
#open 2013-08-02-00-08-48
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
|
||||
#types time string addr port addr port string string count
|
||||
1324916729.150101 UWkUyAuUGXf 130.126.142.250 50059 130.126.140.229 20000 ENABLE_UNSOLICITED RESPONSE 0
|
||||
#close 2013-08-02-00-08-48
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
dnp3_header_block, T, 25605, 17, 196, 2, 3
|
||||
dnp3_application_request_header, T, 20
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 2
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
|
|
@ -0,0 +1 @@
|
|||
6 of 52 events triggered by trace
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dnp3
|
||||
#open 2013-08-02-00-08-48
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
|
||||
#types time string addr port addr port string string count
|
||||
1325044377.992570 UWkUyAuUGXf 130.126.142.250 50301 130.126.140.229 20000 DELETE_FILE RESPONSE 0
|
||||
#close 2013-08-02-00-08-48
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
dnp3_header_block, T, 25605, 99, 196, 4, 3
|
||||
dnp3_application_request_header, T, 27
|
||||
dnp3_object_header, T, 17923, 91, 1, 1, 0
|
||||
dnp3_object_prefix, T, 85
|
||||
dnp3_header_block, F, 25605, 29, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 17924, 91, 1, 1, 0
|
||||
dnp3_object_prefix, F, 13
|
||||
dnp3_response_data_object, F, 255
|
||||
|
|
@ -0,0 +1 @@
|
|||
9 of 52 events triggered by trace
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dnp3
|
||||
#open 2013-08-02-00-08-49
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
|
||||
#types time string addr port addr port string string count
|
||||
1325036012.621691 UWkUyAuUGXf 130.126.142.250 50276 130.126.140.229 20000 OPEN_FILE RESPONSE 4096
|
||||
1325036016.729050 UWkUyAuUGXf 130.126.142.250 50276 130.126.140.229 20000 READ RESPONSE 4096
|
||||
1325036019.765502 UWkUyAuUGXf 130.126.142.250 50276 130.126.140.229 20000 WRITE RESPONSE 0
|
||||
1325036022.292689 UWkUyAuUGXf 130.126.142.250 50276 130.126.140.229 20000 WRITE RESPONSE 0
|
||||
1325036024.820857 UWkUyAuUGXf 130.126.142.250 50276 130.126.140.229 20000 CLOSE_FILE RESPONSE 0
|
||||
#close 2013-08-02-00-08-49
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
dnp3_header_block, T, 25605, 50, 196, 4, 3
|
||||
dnp3_application_request_header, T, 25
|
||||
dnp3_object_header, T, 17923, 91, 1, 1, 0
|
||||
dnp3_object_prefix, T, 36
|
||||
dnp3_header_block, F, 25605, 29, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 4096
|
||||
dnp3_object_header, F, 17924, 91, 1, 1, 0
|
||||
dnp3_object_prefix, F, 13
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 22, 196, 4, 3
|
||||
dnp3_application_request_header, T, 1
|
||||
dnp3_object_header, T, 17925, 91, 1, 1, 0
|
||||
dnp3_object_prefix, T, 8
|
||||
dnp3_file_transport, T, 305419896, 0
|
||||
^J
|
||||
dnp3_header_block, F, 25605, 255, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 4096
|
||||
dnp3_object_header, F, 17925, 91, 1, 1, 0
|
||||
dnp3_object_prefix, F, 838
|
||||
dnp3_file_transport, F, 305419896, 2147483648
|
||||
0000 ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e ...<?xml version^J0010 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d ="1.0" e ncoding=^J0020 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 3f 78 6d 6c "utf-8"? >..<?xml^J0030 2d 73 74 79 6c 65 73 68 65 65 74 20 74 79 70 65 -stylesh eet type^J0040 3d 27 74 65 78 74 2f 78 73 6c 27 20 68 72 65 66 ='text/x sl' href^J0050 3d 27 44 4e 50 33 44 65 76 69 63 65 50 72 6f 66 ='DNP3De viceProf^J0060 69 6c 65 4a 61 6e 32 30 31 30 2e 78 73 6c 74 27 ileJan20 10.xslt'^J0070 20 6d 65 64 69 61 3d 27 73 63 72 65 65 6e 27 3f media=' screen'?^J0080 3e 0d 0a 3c 44 4e 50 33 44 65 76 69 63 65 50 72 >..<DNP3 DevicePr^J0090 6f 66 69 6c 65 44 6f 63 75 6d 65 6e 74 20 78 6d ofileDoc ument xm^J00a0 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f lns:xsi= "http://^J00b0 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f www.w3.o rg/2001/^J00c0 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e XMLSchem a-instan^J00d0 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 ce" xmln s:xsd="h^J00e0 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 ttp://ww w.w3.org^J00f0 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 /2001/XM LSchema"^J0100 20 73 63 68 65 6d 61 56 65 72 73 69 6f 6e 3d 22 schemaV ersion="^J0110 32 2e 30 37 2e 30 30 22 20 78 6d 6c 6e 73 3d 22 2.07.00" xmlns="^J0120 68 74 74 70 3a 2f 2f 77 77 77 2e 64 6e 70 33 2e http://w ww.dnp3.^J0130 6f 72 67 2f 44 4e 50 33 2f 44 65 76 69 63 65 50 org/DNP3 /DeviceP^J0140 72 6f 66 69 6c 65 2f 4a 61 6e 32 30 31 30 22 3e rofile/J an2010">^J0150 0d 0a 20 20 3c 21 2d 2d 44 6f 63 75 6d 65 6e 74 .. <!-- Document^J0160 20 48 65 61 64 65 72 2d 2d 3e 0d 0a 20 20 3c 64 Header- ->.. <d^J0170 6f 63 75 6d 65 6e 74 48 65 61 64 65 72 3e 0d 0a ocumentH eader>..^J0180 20 20 20 20 3c 64 6f 63 75 6d 65 6e 74 4e 61 6d <doc umentNam^J0190 65 3e 41 20 44 4e 50 33 20 58 4d 4c 20 46 69 6c e>A DNP3 XML Fil^J01a0 65 3c 2f 64 6f 63 75 6d 65 6e 74 4e 61 6d 65 3e e</docum entName>^J01b0 0d 0a 20 20 20 20 3c 64 6f 63 75 6d 65 6e 74 44 .. <d ocumentD^J01c0 65 73 63 72 69 70 74 69 6f 6e 3e 54 68 69 73 20 escripti on>This ^J01d0 69 73 20 61 20 44 4e 50 33 20 43 6f 6d 70 6c 65 is a DNP 3 Comple^J01e0 74 65 20 44 65 76 69 63 65 20 50 72 6f 66 69 6c te Devic e Profil^J01f0 65 20 66 6f 72 20 44 4e 50 20 4f 75 74 73 74 61 e for DN P Outsta^J0200 74 69 6f 6e 20 69 6e 20 74 68 65 20 54 4d 57 20 tion in the TMW ^J0210 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 20 50 72 Communic ation Pr^J0220 6f 74 6f 63 6f 6c 20 54 65 73 74 20 48 61 72 6e otocol T est Harn^J0230 65 73 73 3c 2f 64 6f 63 75 6d 65 6e 74 44 65 73 ess</doc umentDes^J0240 63 72 69 70 74 69 6f 6e 3e 0d 0a 20 20 20 20 3c cription >.. <^J0250 72 65 76 69 73 69 6f 6e 48 69 73 74 6f 72 79 20 revision History ^J0260 76 65 72 73 69 6f 6e 3d 22 32 22 3e 0d 0a 20 20 version= "2">.. ^J0270 20 20 20 20 3c 64 61 74 65 3e 32 30 31 30 2d 31 <dat e>2010-1^J0280 32 2d 30 31 3c 2f 64 61 74 65 3e 0d 0a 20 20 20 2-01</da te>.. ^J0290 20 20 20 3c 61 75 74 68 6f 72 3e 53 74 65 76 65 <auth or>Steve^J02a0 20 4d 63 43 6f 79 3c 2f 61 75 74 68 6f 72 3e 0d McCoy</ author>.^J02b0 0a 20 20 20 20 20 20 3c 72 65 61 73 6f 6e 3e 44 . < reason>D^J02c0 6f 63 75 6d 65 6e 74 65 64 20 54 65 73 74 20 48 ocumente d Test H^J02d0 61 72 6e 65 73 73 20 53 44 4e 50 20 44 65 76 69 arness S DNP Devi^J02e0 63 65 20 50 72 6f 66 69 6c 65 3c 2f 72 65 61 73 ce Profi le</reas^J02f0 6f 6e 3e 0d 0a 20 20 20 20 3c 2f 72 65 76 69 73 on>.. </revis^J0300 69 6f 6e 48 69 73 74 6f 72 79 3e 0d 0a 20 20 3c ionHisto ry>.. <^J0310 2f 64 6f 63 75 6d 65 6e 74 48 65 61 64 65 72 3e /documen tHeader>^J0320 0d 0a 3c 2f 44 4e 50 33 44 65 76 69 63 65 50 72 ..</DNP3 DevicePr^J0330 6f 66 69 6c 65 44 6f 63 75 6d 65 6e 74 3e ofileDoc ument>^J
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, T, 25605, 18, 196, 4, 3
|
||||
dnp3_application_request_header, T, 2
|
||||
dnp3_object_header, T, 12801, 7, 1, 1, 0
|
||||
dnp3_object_prefix, T, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_header_block, T, 25605, 18, 196, 4, 3
|
||||
dnp3_application_request_header, T, 2
|
||||
dnp3_object_header, T, 12801, 7, 1, 1, 0
|
||||
dnp3_object_prefix, T, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_header_block, T, 25605, 27, 196, 4, 3
|
||||
dnp3_application_request_header, T, 26
|
||||
dnp3_object_header, T, 17924, 91, 1, 1, 0
|
||||
dnp3_object_prefix, T, 13
|
||||
dnp3_header_block, F, 25605, 29, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 17924, 91, 1, 1, 0
|
||||
dnp3_object_prefix, F, 13
|
||||
dnp3_response_data_object, F, 255
|
||||
|
|
@ -0,0 +1 @@
|
|||
8 of 52 events triggered by trace
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dnp3
|
||||
#open 2013-08-02-00-08-49
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
|
||||
#types time string addr port addr port string string count
|
||||
1325043635.216629 UWkUyAuUGXf 130.126.142.250 50300 130.126.140.229 20000 OPEN_FILE RESPONSE 0
|
||||
1325043637.790287 UWkUyAuUGXf 130.126.142.250 50300 130.126.140.229 20000 WRITE RESPONSE 0
|
||||
1325043638.820071 UWkUyAuUGXf 130.126.142.250 50300 130.126.140.229 20000 CLOSE_FILE RESPONSE 0
|
||||
#close 2013-08-02-00-08-49
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
dnp3_header_block, T, 25605, 99, 196, 4, 3
|
||||
dnp3_application_request_header, T, 25
|
||||
dnp3_object_header, T, 17923, 91, 1, 1, 0
|
||||
dnp3_object_prefix, T, 85
|
||||
dnp3_header_block, F, 25605, 29, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 17924, 91, 1, 1, 0
|
||||
dnp3_object_prefix, F, 13
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 255, 196, 4, 3
|
||||
dnp3_application_request_header, T, 2
|
||||
dnp3_object_header, T, 17925, 91, 1, 1, 0
|
||||
dnp3_object_prefix, T, 838
|
||||
dnp3_file_transport, T, 305419896, 2147483648
|
||||
0000 ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e ...<?xml version^J0010 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d ="1.0" e ncoding=^J0020 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 3f 78 6d 6c "utf-8"? >..<?xml^J0030 2d 73 74 79 6c 65 73 68 65 65 74 20 74 79 70 65 -stylesh eet type^J0040 3d 27 74 65 78 74 2f 78 73 6c 27 20 68 72 65 66 ='text/x sl' href^J0050 3d 27 44 4e 50 33 44 65 76 69 63 65 50 72 6f 66 ='DNP3De viceProf^J0060 69 6c 65 4a 61 6e 32 30 31 30 2e 78 73 6c 74 27 ileJan20 10.xslt'^J0070 20 6d 65 64 69 61 3d 27 73 63 72 65 65 6e 27 3f media=' screen'?^J0080 3e 0d 0a 3c 44 4e 50 33 44 65 76 69 63 65 50 72 >..<DNP3 DevicePr^J0090 6f 66 69 6c 65 44 6f 63 75 6d 65 6e 74 20 78 6d ofileDoc ument xm^J00a0 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f lns:xsi= "http://^J00b0 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f www.w3.o rg/2001/^J00c0 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e XMLSchem a-instan^J00d0 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 ce" xmln s:xsd="h^J00e0 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 ttp://ww w.w3.org^J00f0 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 /2001/XM LSchema"^J0100 20 73 63 68 65 6d 61 56 65 72 73 69 6f 6e 3d 22 schemaV ersion="^J0110 32 2e 30 37 2e 30 30 22 20 78 6d 6c 6e 73 3d 22 2.07.00" xmlns="^J0120 68 74 74 70 3a 2f 2f 77 77 77 2e 64 6e 70 33 2e http://w ww.dnp3.^J0130 6f 72 67 2f 44 4e 50 33 2f 44 65 76 69 63 65 50 org/DNP3 /DeviceP^J0140 72 6f 66 69 6c 65 2f 4a 61 6e 32 30 31 30 22 3e rofile/J an2010">^J0150 0d 0a 20 20 3c 21 2d 2d 44 6f 63 75 6d 65 6e 74 .. <!-- Document^J0160 20 48 65 61 64 65 72 2d 2d 3e 0d 0a 20 20 3c 64 Header- ->.. <d^J0170 6f 63 75 6d 65 6e 74 48 65 61 64 65 72 3e 0d 0a ocumentH eader>..^J0180 20 20 20 20 3c 64 6f 63 75 6d 65 6e 74 4e 61 6d <doc umentNam^J0190 65 3e 41 20 44 4e 50 33 20 58 4d 4c 20 46 69 6c e>A DNP3 XML Fil^J01a0 65 3c 2f 64 6f 63 75 6d 65 6e 74 4e 61 6d 65 3e e</docum entName>^J01b0 0d 0a 20 20 20 20 3c 64 6f 63 75 6d 65 6e 74 44 .. <d ocumentD^J01c0 65 73 63 72 69 70 74 69 6f 6e 3e 54 68 69 73 20 escripti on>This ^J01d0 69 73 20 61 20 44 4e 50 33 20 43 6f 6d 70 6c 65 is a DNP 3 Comple^J01e0 74 65 20 44 65 76 69 63 65 20 50 72 6f 66 69 6c te Devic e Profil^J01f0 65 20 66 6f 72 20 44 4e 50 20 4f 75 74 73 74 61 e for DN P Outsta^J0200 74 69 6f 6e 20 69 6e 20 74 68 65 20 54 4d 57 20 tion in the TMW ^J0210 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 20 50 72 Communic ation Pr^J0220 6f 74 6f 63 6f 6c 20 54 65 73 74 20 48 61 72 6e otocol T est Harn^J0230 65 73 73 3c 2f 64 6f 63 75 6d 65 6e 74 44 65 73 ess</doc umentDes^J0240 63 72 69 70 74 69 6f 6e 3e 0d 0a 20 20 20 20 3c cription >.. <^J0250 72 65 76 69 73 69 6f 6e 48 69 73 74 6f 72 79 20 revision History ^J0260 76 65 72 73 69 6f 6e 3d 22 32 22 3e 0d 0a 20 20 version= "2">.. ^J0270 20 20 20 20 3c 64 61 74 65 3e 32 30 31 30 2d 31 <dat e>2010-1^J0280 32 2d 30 31 3c 2f 64 61 74 65 3e 0d 0a 20 20 20 2-01</da te>.. ^J0290 20 20 20 3c 61 75 74 68 6f 72 3e 53 74 65 76 65 <auth or>Steve^J02a0 20 4d 63 43 6f 79 3c 2f 61 75 74 68 6f 72 3e 0d McCoy</ author>.^J02b0 0a 20 20 20 20 20 20 3c 72 65 61 73 6f 6e 3e 44 . < reason>D^J02c0 6f 63 75 6d 65 6e 74 65 64 20 54 65 73 74 20 48 ocumente d Test H^J02d0 61 72 6e 65 73 73 20 53 44 4e 50 20 44 65 76 69 arness S DNP Devi^J02e0 63 65 20 50 72 6f 66 69 6c 65 3c 2f 72 65 61 73 ce Profi le</reas^J02f0 6f 6e 3e 0d 0a 20 20 20 20 3c 2f 72 65 76 69 73 on>.. </revis^J0300 69 6f 6e 48 69 73 74 6f 72 79 3e 0d 0a 20 20 3c ionHisto ry>.. <^J0310 2f 64 6f 63 75 6d 65 6e 74 48 65 61 64 65 72 3e /documen tHeader>^J0320 0d 0a 3c 2f 44 4e 50 33 44 65 76 69 63 65 50 72 ..</DNP3 DevicePr^J0330 6f 66 69 6c 65 44 6f 63 75 6d 65 6e 74 3e ofileDoc ument>^J
|
||||
dnp3_header_block, F, 25605, 25, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 17926, 91, 1, 1, 0
|
||||
dnp3_object_prefix, F, 9
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 27, 196, 4, 3
|
||||
dnp3_application_request_header, T, 26
|
||||
dnp3_object_header, T, 17924, 91, 1, 1, 0
|
||||
dnp3_object_prefix, T, 13
|
||||
dnp3_header_block, F, 25605, 29, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 17924, 91, 1, 1, 0
|
||||
dnp3_object_prefix, F, 13
|
||||
dnp3_response_data_object, F, 255
|
||||
|
|
@ -0,0 +1 @@
|
|||
7 of 52 events triggered by trace
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dnp3
|
||||
#open 2013-08-02-00-08-50
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
|
||||
#types time string addr port addr port string string count
|
||||
1324327256.650425 UWkUyAuUGXf 130.126.142.250 51006 130.126.140.229 20000 READ RESPONSE 0
|
||||
#close 2013-08-02-00-08-50
|
||||
|
|
@ -0,0 +1,88 @@
|
|||
dnp3_header_block, T, 25605, 20, 196, 2, 3
|
||||
dnp3_application_request_header, T, 1
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15361, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 116, 68, 3, 2
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 258, 0, 9, 0, 8
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 129
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 1
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 129
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 1
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 1
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 1
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 1
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 1
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 1
|
||||
dnp3_object_header, F, 2562, 0, 7, 0, 6
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 1
|
||||
dnp3_object_header, F, 7681, 0, 15, 0, 14
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 1, 1007
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 1, 3
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 1, 1005
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 1, 18446744073709539627
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 1, 1005
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 1, 12006
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 1, 134423
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 0, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 1, 134325
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 0, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 1, 134538
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 0, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 0, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 0, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_32wFlag, F, 0, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
|
|
@ -0,0 +1 @@
|
|||
3 of 52 events triggered by trace
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dnp3
|
||||
#open 2013-08-02-00-08-50
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
|
||||
#types time string addr port addr port string string count
|
||||
1324502980.465157 UWkUyAuUGXf 130.126.142.250 49412 130.126.140.229 20000 RECORD_CURRENT_TIME RESPONSE 0
|
||||
#close 2013-08-02-00-08-50
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
dnp3_header_block, T, 25605, 8, 196, 2, 3
|
||||
dnp3_application_request_header, T, 24
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 2
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
|
|
@ -0,0 +1 @@
|
|||
7 of 52 events triggered by trace
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dnp3
|
||||
#open 2013-08-02-00-08-51
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
|
||||
#types time string addr port addr port string string count
|
||||
1324501739.752598 UWkUyAuUGXf 130.126.142.250 49404 130.126.140.229 20000 SELECT RESPONSE 0
|
||||
1324501743.758738 UWkUyAuUGXf 130.126.142.250 49404 130.126.140.229 20000 OPERATE RESPONSE 0
|
||||
#close 2013-08-02-00-08-51
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
dnp3_header_block, T, 25605, 26, 196, 2, 3
|
||||
dnp3_application_request_header, T, 3
|
||||
dnp3_object_header, T, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, T, 1
|
||||
dnp3_crob, T, 3, 1, 100, 100, 0
|
||||
dnp3_header_block, F, 25605, 28, 68, 3, 2
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_crob, F, 3, 1, 100, 100, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 26, 196, 2, 3
|
||||
dnp3_application_request_header, T, 4
|
||||
dnp3_object_header, T, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, T, 1
|
||||
dnp3_crob, T, 3, 1, 100, 100, 0
|
||||
dnp3_header_block, F, 25605, 28, 68, 3, 2
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_crob, F, 3, 1, 100, 100, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
|
|
@ -0,0 +1 @@
|
|||
5 of 52 events triggered by trace
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dnp3
|
||||
#open 2013-08-02-00-08-51
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
|
||||
#types time string addr port addr port string string count
|
||||
1324502912.898449 UWkUyAuUGXf 130.126.142.250 49411 130.126.140.229 20000 WRITE RESPONSE 0
|
||||
#close 2013-08-02-00-08-51
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
dnp3_header_block, T, 25605, 18, 196, 2, 3
|
||||
dnp3_application_request_header, T, 2
|
||||
dnp3_object_header, T, 12801, 7, 1, 1, 0
|
||||
dnp3_object_prefix, T, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 2
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
|
|
@ -0,0 +1 @@
|
|||
9 of 52 events triggered by trace
|
||||
574
testing/btest/Baseline/scripts.base.protocols.dnp3.events/output
Normal file
574
testing/btest/Baseline/scripts.base.protocols.dnp3.events/output
Normal file
|
|
@ -0,0 +1,574 @@
|
|||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 4096
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, T, 25605, 18, 196, 4, 3
|
||||
dnp3_application_request_header, T, 2
|
||||
dnp3_object_header, T, 12801, 7, 1, 1, 0
|
||||
dnp3_object_prefix, T, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_header_block, T, 25605, 17, 196, 4, 3
|
||||
dnp3_application_request_header, T, 21
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 4096
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, T, 25605, 18, 196, 4, 3
|
||||
dnp3_application_request_header, T, 2
|
||||
dnp3_object_header, T, 12801, 7, 1, 1, 0
|
||||
dnp3_object_prefix, T, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_header_block, T, 25605, 17, 196, 4, 3
|
||||
dnp3_application_request_header, T, 20
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_header_block, F, 25605, 76, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_object_header, F, 13057, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 515, 40, 5, 1280, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 8193, 40, 3, 768, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, F, 25605, 71, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_object_header, F, 13057, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 515, 40, 4, 1024, 0
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 8193, 40, 3, 768, 0
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_analog_input_event_32woTime, F, 1, 198
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, F, 25605, 76, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_object_header, F, 13057, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 515, 40, 5, 1280, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 8193, 40, 3, 768, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_event_32woTime, F, 1, 198
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_analog_input_event_32woTime, F, 1, 202
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_analog_input_event_32woTime, F, 1, 198
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, F, 25605, 71, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_object_header, F, 13057, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 515, 40, 4, 1024, 0
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 8193, 40, 3, 768, 0
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_event_32woTime, F, 1, 202
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_analog_input_event_32woTime, F, 1, 200
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, F, 25605, 76, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_object_header, F, 13057, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 515, 40, 5, 1280, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 8193, 40, 3, 768, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, F, 25605, 50, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_object_header, F, 13057, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 515, 40, 5, 1280, 0
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, F, 25605, 76, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_object_header, F, 13057, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 515, 40, 5, 1280, 0
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 8193, 40, 3, 768, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_event_32woTime, F, 1, 198
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_analog_input_event_32woTime, F, 1, 199
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_analog_input_event_32woTime, F, 1, 199
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, F, 25605, 66, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_object_header, F, 13057, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 515, 40, 3, 768, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 8193, 40, 3, 768, 0
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_event_32woTime, F, 1, 202
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_analog_input_event_32woTime, F, 1, 200
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, F, 25605, 76, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_object_header, F, 13057, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 515, 40, 5, 1280, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 8193, 40, 3, 768, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_analog_input_event_32woTime, F, 1, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, F, 25605, 56, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_object_header, F, 13057, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 515, 40, 1, 256, 0
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_header, F, 8193, 40, 3, 768, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_analog_input_event_32woTime, F, 1, 203
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 1
|
||||
dnp3_analog_input_event_32woTime, F, 1, 202
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_object_prefix, F, 2
|
||||
dnp3_analog_input_event_32woTime, F, 1, 199
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 13
|
||||
dnp3_header_block, F, 25605, 16, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 13314, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 13
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, F, 25605, 16, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 13314, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 11, 196, 4, 3
|
||||
dnp3_application_request_header, T, 1
|
||||
dnp3_object_header, T, 512, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 32768
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 32768
|
||||
dnp3_header_block, T, 25605, 17, 196, 4, 3
|
||||
dnp3_application_request_header, T, 21
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 32768
|
||||
dnp3_header_block, T, 25605, 14, 196, 4, 3
|
||||
dnp3_application_request_header, T, 2
|
||||
dnp3_object_header, T, 20481, 0, 1, 7, 7
|
||||
dnp3_object_prefix, T, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_header_block, T, 25605, 20, 196, 4, 3
|
||||
dnp3_application_request_header, T, 1
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15361, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 78, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 257, 0, 6, 0, 5
|
||||
dnp3_object_header, F, 522, 2, 4294705410, 17104896, 16843009
|
||||
dnp3_object_header, F, 276, 5, 0, 0, 21
|
||||
dnp3_object_header, F, 2304, 0, 1, 0, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_debug_byte, F, \0\0\0\x1e^C\0\0^F\xc5\0\0\0\xc7\0\0\0\xc8\0\0\0^A\0\0\0%\x1c\0\0^N\x1c\0\0^P\x1c\0\0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, T, 25605, 17, 196, 4, 3
|
||||
dnp3_application_request_header, T, 20
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, T, 25605, 17, 196, 4, 3
|
||||
dnp3_application_request_header, T, 20
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 6, 4
|
||||
dnp3_application_response_header, F, 130, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 36864
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 0
|
||||
dnp3_header_block, T, 25605, 17, 196, 4, 3
|
||||
dnp3_application_request_header, T, 21
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 36864
|
||||
dnp3_header_block, T, 25605, 18, 196, 4, 3
|
||||
dnp3_application_request_header, T, 2
|
||||
dnp3_object_header, T, 12801, 7, 1, 1, 0
|
||||
dnp3_object_prefix, T, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 32768
|
||||
dnp3_header_block, T, 25605, 17, 196, 4, 3
|
||||
dnp3_application_request_header, T, 21
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 32768
|
||||
dnp3_header_block, T, 25605, 18, 196, 4, 3
|
||||
dnp3_application_request_header, T, 2
|
||||
dnp3_object_header, T, 12801, 7, 1, 1, 0
|
||||
dnp3_object_prefix, T, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 32768
|
||||
dnp3_header_block, T, 25605, 17, 196, 4, 3
|
||||
dnp3_application_request_header, T, 21
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 32768
|
||||
dnp3_header_block, T, 25605, 14, 196, 4, 3
|
||||
dnp3_application_request_header, T, 2
|
||||
dnp3_object_header, T, 20481, 0, 1, 7, 7
|
||||
dnp3_object_prefix, T, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_header_block, T, 25605, 20, 196, 4, 3
|
||||
dnp3_application_request_header, T, 1
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15361, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 78, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 257, 0, 6, 0, 5
|
||||
dnp3_object_header, F, 6410, 2, 2155643138, 2164588544, 25264385
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_debug_byte, F, ^A^T^E\0\0\0 \0\0\0^U^I\0\0\0\0\0\0\0\x1e^C\0\0^F\xca\0\0\0\xcb\0\0\0\xc9\0\0\0\xff\xff\xff\xfff!\0\0Y!\0\0K!\0\0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 14
|
||||
dnp3_header_block, F, 25605, 16, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 13314, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 8, 196, 4, 3
|
||||
dnp3_application_request_header, T, 14
|
||||
dnp3_header_block, F, 25605, 16, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_object_header, F, 13314, 7, 1, 1, 0
|
||||
dnp3_object_prefix, F, 0
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 256
|
||||
dnp3_header_block, T, 25605, 17, 196, 65535, 3
|
||||
dnp3_application_request_header, T, 21
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 237, 0, 0, 0
|
||||
dnp3_header_block, T, 25605, 17, 196, 65535, 3
|
||||
dnp3_application_request_header, T, 21
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 237, 0, 0, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 130, 4096
|
||||
dnp3_header_block, T, 25605, 17, 196, 4, 3
|
||||
dnp3_application_request_header, T, 18
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 263, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 237, 0, 0, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 4097
|
||||
dnp3_header_block, T, 25605, 17, 196, 4, 3
|
||||
dnp3_application_request_header, T, 18
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 263, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 237, 0, 0, 0
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 4097
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 6
|
||||
dnp3_application_response_header, F, 130, 38145
|
||||
dnp3_header_block, T, 25605, 17, 196, 65535, 3
|
||||
dnp3_application_request_header, T, 18
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 263, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 237, 0, 0, 0
|
||||
dnp3_header_block, T, 25605, 17, 196, 65535, 3
|
||||
dnp3_application_request_header, T, 18
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 263, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 237, 0, 0, 0
|
||||
dnp3_header_block, T, 25605, 17, 196, 4, 3
|
||||
dnp3_application_request_header, T, 1
|
||||
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
||||
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 0
|
||||
dnp3_header_block, T, 25605, 26, 196, 4, 3
|
||||
dnp3_application_request_header, T, 3
|
||||
dnp3_object_header, T, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, T, 34463
|
||||
dnp3_crob, T, 3, 1, 100, 100, 0
|
||||
dnp3_header_block, F, 25605, 28, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 4
|
||||
dnp3_object_header, F, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, F, 34463
|
||||
dnp3_crob, F, 3, 1, 100, 100, 4
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 26, 196, 4, 3
|
||||
dnp3_application_request_header, T, 3
|
||||
dnp3_object_header, T, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, T, 34463
|
||||
dnp3_crob, T, 3, 1, 100, 100, 0
|
||||
dnp3_header_block, F, 25605, 28, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 4
|
||||
dnp3_object_header, F, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, F, 34463
|
||||
dnp3_crob, F, 3, 1, 100, 100, 4
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 26, 196, 4, 3
|
||||
dnp3_application_request_header, T, 3
|
||||
dnp3_object_header, T, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, T, 34463
|
||||
dnp3_crob, T, 3, 1, 100, 100, 0
|
||||
dnp3_header_block, F, 25605, 28, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 4
|
||||
dnp3_object_header, F, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, F, 34463
|
||||
dnp3_crob, F, 3, 1, 100, 100, 4
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 26, 196, 4, 3
|
||||
dnp3_application_request_header, T, 3
|
||||
dnp3_object_header, T, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, T, 34463
|
||||
dnp3_crob, T, 3, 1, 100, 100, 0
|
||||
dnp3_header_block, F, 25605, 28, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 4
|
||||
dnp3_object_header, F, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, F, 34463
|
||||
dnp3_crob, F, 3, 1, 100, 100, 4
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 26, 196, 4, 3
|
||||
dnp3_application_request_header, T, 3
|
||||
dnp3_object_header, T, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, T, 34463
|
||||
dnp3_crob, T, 3, 1, 100, 100, 0
|
||||
dnp3_header_block, F, 25605, 28, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 4
|
||||
dnp3_object_header, F, 3073, 40, 1, 256, 0
|
||||
dnp3_object_prefix, F, 34463
|
||||
dnp3_crob, F, 3, 1, 100, 100, 4
|
||||
dnp3_response_data_object, F, 255
|
||||
dnp3_header_block, T, 25605, 11, 196, 4, 3
|
||||
dnp3_application_request_header, T, 1
|
||||
dnp3_object_header, T, 65280, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 6
|
||||
dnp3_header_block, T, 25605, 11, 196, 4, 3
|
||||
dnp3_application_request_header, T, 1
|
||||
dnp3_object_header, T, 65280, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 6
|
||||
dnp3_header_block, T, 25605, 11, 196, 4, 3
|
||||
dnp3_application_request_header, T, 1
|
||||
dnp3_object_header, T, 65280, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 6
|
||||
dnp3_header_block, T, 25605, 11, 196, 4, 3
|
||||
dnp3_application_request_header, T, 1
|
||||
dnp3_object_header, T, 65280, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 6
|
||||
dnp3_header_block, T, 25605, 11, 196, 4, 3
|
||||
dnp3_application_request_header, T, 1
|
||||
dnp3_object_header, T, 65280, 6, 0, 65535, 65535
|
||||
dnp3_header_block, F, 25605, 10, 68, 3, 4
|
||||
dnp3_application_response_header, F, 129, 6
|
||||
BIN
testing/btest/Traces/dnp3/dnp3.trace
Normal file
BIN
testing/btest/Traces/dnp3/dnp3.trace
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dnp3/dnp3_del_measure.pcap
Normal file
BIN
testing/btest/Traces/dnp3/dnp3_del_measure.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dnp3/dnp3_en_spon.pcap
Normal file
BIN
testing/btest/Traces/dnp3/dnp3_en_spon.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dnp3/dnp3_file_del.pcap
Normal file
BIN
testing/btest/Traces/dnp3/dnp3_file_del.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dnp3/dnp3_file_read.pcap
Normal file
BIN
testing/btest/Traces/dnp3/dnp3_file_read.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dnp3/dnp3_file_write.pcap
Normal file
BIN
testing/btest/Traces/dnp3/dnp3_file_write.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dnp3/dnp3_read.pcap
Normal file
BIN
testing/btest/Traces/dnp3/dnp3_read.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dnp3/dnp3_read_p20001.pcap
Normal file
BIN
testing/btest/Traces/dnp3/dnp3_read_p20001.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dnp3/dnp3_rec_time.pcap
Normal file
BIN
testing/btest/Traces/dnp3/dnp3_rec_time.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dnp3/dnp3_select_operate.pcap
Normal file
BIN
testing/btest/Traces/dnp3/dnp3_select_operate.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dnp3/dnp3_write.pcap
Normal file
BIN
testing/btest/Traces/dnp3/dnp3_write.pcap
Normal file
Binary file not shown.
|
|
@ -0,0 +1,9 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/dnp3/dnp3_del_measure.pcap %DIR/events.bro >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered
|
||||
# @TEST-EXEC: cat ${DIST}/src/analyzer/protocol/dnp3/events.bif | grep "^event dnp3_" | wc -l >total
|
||||
# @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage
|
||||
# @TEST-EXEC: btest-diff coverage
|
||||
# @TEST-EXEC: btest-diff dnp3.log
|
||||
#
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/dnp3/dnp3_en_spon.pcap %DIR/events.bro >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered
|
||||
# @TEST-EXEC: cat ${DIST}/src/analyzer/protocol/dnp3/events.bif | grep "^event dnp3_" | wc -l >total
|
||||
# @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage
|
||||
# @TEST-EXEC: btest-diff coverage
|
||||
# @TEST-EXEC: btest-diff dnp3.log
|
||||
#
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/dnp3/dnp3_file_del.pcap %DIR/events.bro >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered
|
||||
# @TEST-EXEC: cat ${DIST}/src/analyzer/protocol/dnp3/events.bif | grep "^event dnp3_" | wc -l >total
|
||||
# @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage
|
||||
# @TEST-EXEC: btest-diff coverage
|
||||
# @TEST-EXEC: btest-diff dnp3.log
|
||||
#
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/dnp3/dnp3_file_read.pcap %DIR/events.bro >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered
|
||||
# @TEST-EXEC: cat ${DIST}/src/analyzer/protocol/dnp3/events.bif | grep "^event dnp3_" | wc -l >total
|
||||
# @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage
|
||||
# @TEST-EXEC: btest-diff coverage
|
||||
# @TEST-EXEC: btest-diff dnp3.log
|
||||
#
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/dnp3/dnp3_file_write.pcap %DIR/events.bro >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered
|
||||
# @TEST-EXEC: cat ${DIST}/src/analyzer/protocol/dnp3/events.bif | grep "^event dnp3_" | wc -l >total
|
||||
# @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage
|
||||
# @TEST-EXEC: btest-diff coverage
|
||||
# @TEST-EXEC: btest-diff dnp3.log
|
||||
#
|
||||
9
testing/btest/scripts/base/protocols/dnp3/dnp3_read.bro
Normal file
9
testing/btest/scripts/base/protocols/dnp3/dnp3_read.bro
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/dnp3/dnp3_read.pcap %DIR/events.bro >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered
|
||||
# @TEST-EXEC: cat ${DIST}/src/analyzer/protocol/dnp3/events.bif | grep "^event dnp3_" | wc -l >total
|
||||
# @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage
|
||||
# @TEST-EXEC: btest-diff coverage
|
||||
# @TEST-EXEC: btest-diff dnp3.log
|
||||
#
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/dnp3/dnp3_rec_time.pcap %DIR/events.bro >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered
|
||||
# @TEST-EXEC: cat ${DIST}/src/analyzer/protocol/dnp3/events.bif | grep "^event dnp3_" | wc -l >total
|
||||
# @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage
|
||||
# @TEST-EXEC: btest-diff coverage
|
||||
# @TEST-EXEC: btest-diff dnp3.log
|
||||
#
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/dnp3/dnp3_select_operate.pcap %DIR/events.bro >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered
|
||||
# @TEST-EXEC: cat ${DIST}/src/analyzer/protocol/dnp3/events.bif | grep "^event dnp3_" | wc -l >total
|
||||
# @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage
|
||||
# @TEST-EXEC: btest-diff coverage
|
||||
# @TEST-EXEC: btest-diff dnp3.log
|
||||
#
|
||||
9
testing/btest/scripts/base/protocols/dnp3/dnp3_write.bro
Normal file
9
testing/btest/scripts/base/protocols/dnp3/dnp3_write.bro
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/dnp3/dnp3_write.pcap %DIR/events.bro >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered
|
||||
# @TEST-EXEC: cat ${DIST}/src/analyzer/protocol/dnp3/events.bif | grep "^event dnp3_" | wc -l >total
|
||||
# @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage
|
||||
# @TEST-EXEC: btest-diff coverage
|
||||
# @TEST-EXEC: btest-diff dnp3.log
|
||||
#
|
||||
266
testing/btest/scripts/base/protocols/dnp3/events.bro
Normal file
266
testing/btest/scripts/base/protocols/dnp3/events.bro
Normal file
|
|
@ -0,0 +1,266 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/dnp3/dnp3.trace %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered
|
||||
# @TEST-EXEC: cat ${DIST}/src/analyzer/protocol/dnp3/events.bif | grep "^event dnp3_" | wc -l >total
|
||||
# @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage
|
||||
# @TEST-EXEC: btest-diff coverage
|
||||
# @TEST-EXEC: btest-diff dnp3.log
|
||||
#
|
||||
event dnp3_application_request_header(c: connection, is_orig: bool, fc: count)
|
||||
{
|
||||
print "dnp3_application_request_header", is_orig, fc;
|
||||
}
|
||||
|
||||
event dnp3_application_response_header(c: connection, is_orig: bool, fc: count, iin: count)
|
||||
{
|
||||
print "dnp3_application_response_header", is_orig, fc, iin;
|
||||
}
|
||||
|
||||
event dnp3_object_header(c: connection, is_orig: bool, obj_type: count, qua_field: count, number: count, rf_low: count, rf_high: count)
|
||||
{
|
||||
print "dnp3_object_header", is_orig, obj_type, qua_field, number, rf_low, rf_high;
|
||||
}
|
||||
|
||||
event dnp3_object_prefix(c: connection, is_orig: bool, prefix_value: count)
|
||||
{
|
||||
print "dnp3_object_prefix", is_orig, prefix_value;
|
||||
}
|
||||
|
||||
event dnp3_header_block(c: connection, is_orig: bool, start: count, len: count, ctrl: count, dest_addr: count, src_addr: count)
|
||||
{
|
||||
print "dnp3_header_block", is_orig, start, len, ctrl, dest_addr, src_addr;
|
||||
}
|
||||
|
||||
event dnp3_response_data_object(c: connection, is_orig: bool, data_value: count)
|
||||
{
|
||||
print "dnp3_response_data_object", is_orig, data_value;
|
||||
}
|
||||
|
||||
event dnp3_attribute_common(c: connection, is_orig: bool, data_type_code: count, leng: count, attribute_obj: string)
|
||||
{
|
||||
print "dnp3_attribute_common", is_orig, data_type_code, leng, attribute_obj;
|
||||
}
|
||||
|
||||
event dnp3_crob(c: connection, is_orig: bool, control_code: count, count8: count, on_time: count, off_time: count, status_code: count)
|
||||
{
|
||||
print "dnp3_crob", is_orig, control_code, count8, on_time, off_time, status_code;
|
||||
}
|
||||
|
||||
event dnp3_pcb(c: connection, is_orig: bool, control_code: count, count8: count, on_time: count, off_time: count, status_code: count)
|
||||
{
|
||||
print "dnp3_pcb", is_orig, control_code, count8, on_time, off_time, status_code;
|
||||
}
|
||||
|
||||
event dnp3_counter_32wFlag(c: connection, is_orig: bool, flag: count, count_value: count)
|
||||
{
|
||||
print "dnp3_counter_32wFlag", is_orig, flag, count_value;
|
||||
}
|
||||
|
||||
event dnp3_counter_16wFlag(c: connection, is_orig: bool, flag: count, count_value: count)
|
||||
{
|
||||
print "dnp3_counter_16wFlag", is_orig, flag, count_value;
|
||||
}
|
||||
|
||||
event dnp3_counter_32woFlag(c: connection, is_orig: bool, count_value: count)
|
||||
{
|
||||
print "dnp3_counter_32woFlag", is_orig, count_value;
|
||||
}
|
||||
|
||||
event dnp3_counter_16woFlag(c: connection, is_orig: bool, count_value: count)
|
||||
{
|
||||
print "dnp3_counter_16woFlag", is_orig, count_value;
|
||||
}
|
||||
|
||||
event dnp3_frozen_counter_32wFlag(c: connection, is_orig: bool, flag:count, count_value: count)
|
||||
{
|
||||
print "dnp3_frozen_counter_32wFlag", is_orig, flag;
|
||||
}
|
||||
|
||||
event dnp3_frozen_counter_16wFlag(c: connection, is_orig: bool, flag:count, count_value: count)
|
||||
{
|
||||
print "dnp3_frozen_counter_16wFlag", is_orig, flag;
|
||||
}
|
||||
|
||||
event dnp3_frozen_counter_32wFlagTime(c: connection, is_orig: bool, flag:count, count_value: count, time48: string)
|
||||
{
|
||||
print "dnp3_frozen_counter_32wFlagTime", is_orig, flag;
|
||||
}
|
||||
|
||||
event dnp3_frozen_counter_16wFlagTime(c: connection, is_orig: bool, flag:count, count_value: count, time48: string)
|
||||
{
|
||||
print "dnp3_frozen_counter_16wFlagTime", is_orig, flag;
|
||||
}
|
||||
|
||||
event dnp3_frozen_counter_32woFlag(c: connection, is_orig: bool, count_value: count)
|
||||
{
|
||||
print "dnp3_frozen_counter_32woFlag", is_orig, count_value;
|
||||
}
|
||||
|
||||
event dnp3_frozen_counter_16woFlag(c: connection, is_orig: bool, count_value: count)
|
||||
{
|
||||
print "dnp3_frozen_counter_16woFlag", is_orig, count_value;
|
||||
}
|
||||
|
||||
event dnp3_analog_input_32wFlag(c: connection, is_orig: bool, flag: count, value: count)
|
||||
{
|
||||
print "dnp3_analog_input_32wFlag", is_orig, flag, value;
|
||||
}
|
||||
|
||||
event dnp3_analog_input_16wFlag(c: connection, is_orig: bool, flag: count, value: count)
|
||||
{
|
||||
print "dnp3_analog_input_16wFlag", is_orig, flag, value;
|
||||
}
|
||||
|
||||
event dnp3_analog_input_32woFlag(c: connection, is_orig: bool, value: count)
|
||||
{
|
||||
print "dnp3_analog_input_32woFlag", is_orig, value;
|
||||
}
|
||||
|
||||
event dnp3_analog_input_16woFlag(c: connection, is_orig: bool, value: count)
|
||||
{
|
||||
print "dnp3_analog_input_16woFlag", is_orig, value;
|
||||
}
|
||||
|
||||
event dnp3_analog_input_SPwFlag(c: connection, is_orig: bool, flag: count, value: count)
|
||||
{
|
||||
print "dnp3_analog_input_SPwFlag", is_orig, flag, value;
|
||||
}
|
||||
|
||||
event dnp3_analog_input_DPwFlag(c: connection, is_orig: bool, flag: count, value_low: count, value_high: count)
|
||||
{
|
||||
print "dnp3_analog_input_DPwFlag", is_orig, flag, value_low, value_high;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_32wFlag(c: connection, is_orig: bool, flag: count, frozen_value: count)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_32wFlag", is_orig, flag, frozen_value;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_16wFlag(c: connection, is_orig: bool, flag: count, frozen_value: count)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_16wFlag", is_orig, flag, frozen_value;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_32wTime(c: connection, is_orig: bool, flag: count, frozen_value: count, time48: string)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_32wTime", is_orig, flag, frozen_value, time48;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_16wTime(c: connection, is_orig: bool, flag: count, frozen_value: count, time48: string)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_16wTime", is_orig, flag, frozen_value, time48;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_32woFlag(c: connection, is_orig: bool, frozen_value: count)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_32woFlag", is_orig, frozen_value;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_16woFlag(c: connection, is_orig: bool, frozen_value: count)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_16woFlag", is_orig, frozen_value;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_SPwFlag(c: connection, is_orig: bool, flag: count, frozen_value: count)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_SPwFlag", is_orig, flag, frozen_value;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_DPwFlag(c: connection, is_orig: bool, flag: count, frozen_value_low: count, frozen_value_high: count)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_DPwFlag", is_orig, flag, frozen_value_low, frozen_value_high;
|
||||
}
|
||||
|
||||
event dnp3_analog_input_event_32woTime(c: connection, is_orig: bool, flag: count, value: count)
|
||||
{
|
||||
print "dnp3_analog_input_event_32woTime", is_orig, flag, value;
|
||||
}
|
||||
|
||||
event dnp3_analog_input_event_16woTime(c: connection, is_orig: bool, flag: count, value: count)
|
||||
{
|
||||
print "dnp3_analog_input_event_16woTime", is_orig, flag, value;
|
||||
}
|
||||
|
||||
event dnp3_analog_input_event_32wTime(c: connection, is_orig: bool, flag: count, value: count, time48: string)
|
||||
{
|
||||
print "dnp3_analog_input_event_32wTime", is_orig, flag, value, time48;
|
||||
}
|
||||
|
||||
event dnp3_analog_input_16wTime(c: connection, is_orig: bool, flag: count, value: count, time48: string)
|
||||
{
|
||||
print "dnp3_analog_input_event_16wTime", is_orig, flag, value, time48;
|
||||
}
|
||||
|
||||
event dnp3_analog_inputSP_woTime(c: connection, is_orig: bool, flag: count, value: count)
|
||||
{
|
||||
print "dnp3_analog_input_event_SPwoTime", is_orig, flag, value;
|
||||
}
|
||||
|
||||
event dnp3_analog_inputDP_woTime(c: connection, is_orig: bool, flag: count, value_low: count, value_high: count)
|
||||
{
|
||||
print "dnp3_analog_input_event_DPwoTime", is_orig, flag, value_low, value_high;
|
||||
}
|
||||
|
||||
event dnp3_analog_inputSP_wTime(c: connection, is_orig: bool, flag: count, value: count, time48: string)
|
||||
{
|
||||
print "dnp3_analog_input_event_SPwTime", is_orig, flag, value, time48;
|
||||
}
|
||||
|
||||
event dnp3_analog_inputDP_wTime(c: connection, is_orig: bool, flag: count, value_low: count, value_high: count, time48: string)
|
||||
{
|
||||
print "dnp3_analog_input_event_DPwTime", is_orig, flag, value_low, value_high, time48;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_event_32woTime(c: connection, is_orig: bool, flag: count, frozen_value: count)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_event_32woTime", is_orig, flag, frozen_value;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_event_16woTime(c: connection, is_orig: bool, flag: count, frozen_value: count)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_event_16woTime", is_orig, flag, frozen_value;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_event_32wTime(c: connection, is_orig: bool, flag: count, frozen_value: count, time48: string)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_event_32wTime", is_orig, flag, frozen_value, time48;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_event_16wTime(c: connection, is_orig: bool, flag: count, frozen_value: count, time48: string)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_event_16wTime", is_orig, flag, frozen_value, time48;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_event_SPwoTime(c: connection, is_orig: bool, flag: count, frozen_value: count)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_event_SPwoTime", is_orig, flag, frozen_value;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_event_DPwoTime(c: connection, is_orig: bool, flag: count, frozen_value_low: count, frozen_value_high: count)
|
||||
{
|
||||
print "dnp3_frozen_analog_input_event_DPwoTime", is_orig, flag, frozen_value_low, frozen_value_high;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_event_SPwTime(c: connection, is_orig: bool, flag: count, frozen_value: count, time48: string)
|
||||
{
|
||||
print "dnp3_frozen_analog_inputeventSP_wTime", is_orig, flag, frozen_value, time48;
|
||||
}
|
||||
|
||||
event dnp3_frozen_analog_input_event_DPwTime(c: connection, is_orig: bool, flag: count, frozen_value_low: count, frozen_value_high: count, time48: string)
|
||||
{
|
||||
print "dnp3_frozen_analog_inputeventDP_wTime", is_orig, flag, frozen_value_low, frozen_value_high, time48;
|
||||
}
|
||||
|
||||
event dnp3_file_transport(c: connection, is_orig: bool, file_handle: count, block_num: count, file_data: string)
|
||||
{
|
||||
print "dnp3_file_transport", is_orig, file_handle, block_num;
|
||||
print hexdump(file_data);
|
||||
}
|
||||
|
||||
event dnp3_debug_byte(c: connection, is_orig: bool, debug: string)
|
||||
{
|
||||
print "dnp3_debug_byte", is_orig, debug;
|
||||
}
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue