Merge remote-tracking branch 'origin/topic/hui/dnp3-udp'

* origin/topic/hui/dnp3-udp:
  remove redundnt codes; find a way to use the analyzer function, such as Weird; fix a small bug in ProcessData function in DNP3.cc; passed the test
  Renameing the DNP3 TCP analyzer
  quickly fix another bug; adding missing field of the declaration of dnp3_request_application_header and dnp3_response_application_header
  Removing the debug printf in DNP3.cc
  fixed the bug of deciding the size of object 1 varition 1 in DNP3
  Fix some things in DNP3 UDP analyzer.
  changed a bug, but still not working
  modify DNP3.cc and DNP3.h to add DNP3_UDP_Analyzer; binpac unchanged
This commit is contained in:
Robin Sommer 2014-09-07 21:08:23 -07:00
commit 525816b03d
30 changed files with 2153 additions and 828 deletions

View file

@ -5,5 +5,11 @@ signature dpd_dnp3_server {
ip-proto == tcp
payload /\x05\x64/
tcp-state responder
enable "dnp3"
enable "dnp3_tcp"
}
signature dpd_dnp3_server_udp {
ip-proto == udp
payload /\x05\x64/
enable "dnp3_udp"
}

View file

@ -37,10 +37,10 @@ redef likely_server_ports += { ports };
event bro_init() &priority=5
{
Log::create_stream(DNP3::LOG, [$columns=Info, $ev=log_dnp3]);
Analyzer::register_for_ports(Analyzer::ANALYZER_DNP3, ports);
Analyzer::register_for_ports(Analyzer::ANALYZER_DNP3_TCP, ports);
}
event dnp3_application_request_header(c: connection, is_orig: bool, fc: count)
event dnp3_application_request_header(c: connection, is_orig: bool, application_control: count, fc: count)
{
if ( ! c?$dnp3 )
c$dnp3 = [$ts=network_time(), $uid=c$uid, $id=c$id];
@ -49,7 +49,7 @@ event dnp3_application_request_header(c: connection, is_orig: bool, fc: count)
c$dnp3$fc_request = function_codes[fc];
}
event dnp3_application_response_header(c: connection, is_orig: bool, fc: count, iin: count)
event dnp3_application_response_header(c: connection, is_orig: bool, application_control: count, fc: count, iin: count)
{
if ( ! c?$dnp3 )
c$dnp3 = [$ts=network_time(), $uid=c$uid, $id=c$id];

View file

@ -97,7 +97,6 @@
// Binpac DNP3 Analyzer
#include "DNP3.h"
#include "analyzer/protocol/tcp/TCP_Reassembler.h"
#include "events.bif.h"
using namespace analyzer::dnp3;
@ -112,60 +111,19 @@ const unsigned int PSEUDO_LINK_LAYER_LEN = 8; // length of DNP3 Pseudo Link Lay
bool DNP3_Analyzer::crc_table_initialized = false;
unsigned int DNP3_Analyzer::crc_table[256];
DNP3_Analyzer::DNP3_Analyzer(Connection* c) : TCP_ApplicationAnalyzer("DNP3", c)
DNP3_Analyzer::DNP3_Analyzer()
{
interp = new binpac::DNP3::DNP3_Conn(this);
ClearEndpointState(true);
ClearEndpointState(false);
if ( ! crc_table_initialized )
PrecomputeCRCTable();
}
DNP3_Analyzer::~DNP3_Analyzer()
{
delete interp;
}
void DNP3_Analyzer::Done()
{
TCP_ApplicationAnalyzer::Done();
interp->FlowEOF(true);
interp->FlowEOF(false);
}
void DNP3_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
{
TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
try
{
if ( ! ProcessData(len, data, orig) )
SetSkip(1);
}
catch ( const binpac::Exception& e )
{
SetSkip(1);
throw;
}
}
void DNP3_Analyzer::Undelivered(uint64 seq, int len, bool orig)
{
TCP_ApplicationAnalyzer::Undelivered(seq, len, orig);
interp->NewGap(orig, len);
}
void DNP3_Analyzer::EndpointEOF(bool is_orig)
{
TCP_ApplicationAnalyzer::EndpointEOF(is_orig);
interp->FlowEOF(is_orig);
}
bool DNP3_Analyzer::ProcessData(int len, const u_char* data, bool orig)
bool DNP3_Analyzer::ProcessData(analyzer::Analyzer* thisAnalyzer, binpac::DNP3::DNP3_Conn* thisInterp, int len, const u_char* data, bool orig)
{
Endpoint* endp = orig ? &orig_state : &resp_state;
@ -180,25 +138,25 @@ bool DNP3_Analyzer::ProcessData(int len, const u_char* data, bool orig)
// The first two bytes must always be 0x0564.
if( endp->buffer[0] != 0x05 || endp->buffer[1] != 0x64 )
{
Weird("dnp3_header_lacks_magic");
thisAnalyzer->Weird("dnp3_header_lacks_magic");
return false;
}
// Make sure header checksum is correct.
if ( ! CheckCRC(PSEUDO_LINK_LAYER_LEN, endp->buffer, endp->buffer + PSEUDO_LINK_LAYER_LEN, "header") )
if ( ! CheckCRC(thisAnalyzer, PSEUDO_LINK_LAYER_LEN, endp->buffer, endp->buffer + PSEUDO_LINK_LAYER_LEN, "header") )
{
ProtocolViolation("broken_checksum");
thisAnalyzer->ProtocolViolation("broken_checksum");
return false;
}
// If the checksum works out, we're pretty certainly DNP3.
ProtocolConfirmation();
thisAnalyzer->ProtocolConfirmation();
// DNP3 packets without transport and application
// layers can happen, we ignore them.
if ( (endp->buffer[PSEUDO_LENGTH_INDEX] + 3) == (char)PSEUDO_LINK_LAYER_LEN )
{
ClearEndpointState(orig);
ClearEndpointState(thisInterp, orig);
return true;
}
@ -207,7 +165,7 @@ bool DNP3_Analyzer::ProcessData(int len, const u_char* data, bool orig)
u_char ctrl = endp->buffer[PSEUDO_CONTROL_FIELD_INDEX];
if ( orig != (bool)(ctrl & 0x80) )
Weird("dnp3_unexpected_flow_direction");
thisAnalyzer->Weird("dnp3_unexpected_flow_direction");
// Update state.
endp->pkt_length = endp->buffer[PSEUDO_LENGTH_INDEX];
@ -217,7 +175,7 @@ bool DNP3_Analyzer::ProcessData(int len, const u_char* data, bool orig)
// For the first packet, we submit the header to
// BinPAC.
if ( ++endp->pkt_cnt == 1 )
interp->NewData(orig, endp->buffer, endp->buffer + PSEUDO_LINK_LAYER_LEN);
thisInterp->NewData(orig, endp->buffer, endp->buffer + PSEUDO_LINK_LAYER_LEN);
}
if ( ! endp->in_hdr )
@ -230,13 +188,15 @@ bool DNP3_Analyzer::ProcessData(int len, const u_char* data, bool orig)
// the packet length by determining how much 16-byte
// chunks fit in there, and then add 2 bytes CRC for
// each.
int n = PSEUDO_APP_LAYER_INDEX + (endp->pkt_length - 5) + ((endp->pkt_length - 5) / 16) * 2 + 2 - 1;
int n = PSEUDO_APP_LAYER_INDEX + (endp->pkt_length - 5) + ((endp->pkt_length - 5) / 16) * 2
+ 2 * ( ((endp->pkt_length - 5) % 16 == 0) ? 0 : 1) - 1 ;
if ( ! AddToBuffer(endp, n, &data, &len) )
return true;
// Parse the the application layer data.
if ( ! ParseAppLayer(endp) )
//if ( ! ParseAppLayer(endp) )
if ( ! ParseAppLayer(thisAnalyzer, thisInterp, endp) )
return false;
// Done with this packet, prepare for next.
@ -263,10 +223,10 @@ bool DNP3_Analyzer::AddToBuffer(Endpoint* endp, int target_len, const u_char** d
return endp->buffer_len == target_len;
}
bool DNP3_Analyzer::ParseAppLayer(Endpoint* endp)
bool DNP3_Analyzer::ParseAppLayer(analyzer::Analyzer* thisAnalyzer, binpac::DNP3::DNP3_Conn* thisInterp, Endpoint* endp)
{
bool orig = (endp == &orig_state);
binpac::DNP3::DNP3_Flow* flow = orig ? interp->upflow() : interp->downflow();
binpac::DNP3::DNP3_Flow* flow = orig ? thisInterp->upflow() : thisInterp->downflow();
u_char* data = endp->buffer + PSEUDO_TRANSPORT_INDEX; // The transport layer byte counts as app-layer it seems.
int len = endp->pkt_length - 5;
@ -288,7 +248,7 @@ bool DNP3_Analyzer::ParseAppLayer(Endpoint* endp)
int n = min(len, 16);
// Make sure chunk has a correct checksum.
if ( ! CheckCRC(n, data, data + n, "app_chunk") )
if ( ! CheckCRC(thisAnalyzer, n, data, data + n, "app_chunk") )
return false;
// Pass on to BinPAC.
@ -306,7 +266,7 @@ bool DNP3_Analyzer::ParseAppLayer(Endpoint* endp)
if ( ! is_first && ! endp->encountered_first_chunk )
{
// We lost the first chunk.
Weird("dnp3_first_application_layer_chunk_missing");
thisAnalyzer->Weird("dnp3_first_application_layer_chunk_missing");
return false;
}
@ -314,16 +274,16 @@ bool DNP3_Analyzer::ParseAppLayer(Endpoint* endp)
{
flow->flow_buffer()->FinishBuffer();
flow->FlowEOF();
ClearEndpointState(orig);
ClearEndpointState(thisInterp, orig);
}
return true;
}
void DNP3_Analyzer::ClearEndpointState(bool orig)
void DNP3_Analyzer::ClearEndpointState(binpac::DNP3::DNP3_Conn* thisInterp, bool orig)
{
Endpoint* endp = orig ? &orig_state : &resp_state;
binpac::DNP3::DNP3_Flow* flow = orig ? interp->upflow() : interp->downflow();
binpac::DNP3::DNP3_Flow* flow = orig ? thisInterp->upflow() : thisInterp->downflow();
endp->in_hdr = true;
endp->encountered_first_chunk = false;
@ -333,14 +293,14 @@ void DNP3_Analyzer::ClearEndpointState(bool orig)
endp->pkt_cnt = 0;
}
bool DNP3_Analyzer::CheckCRC(int len, const u_char* data, const u_char* crc16, const char* where)
bool DNP3_Analyzer::CheckCRC(analyzer::Analyzer* thisAnalyzer, int len, const u_char* data, const u_char* crc16, const char* where)
{
unsigned int crc = CalcCRC(len, data);
if ( crc16[0] == (crc & 0xff) && crc16[1] == (crc & 0xff00) >> 8 )
return true;
Weird(fmt("dnp3_corrupt_%s_checksum", where));
thisAnalyzer->Weird(fmt("dnp3_corrupt_%s_checksum", where));
return false;
}
@ -374,3 +334,95 @@ unsigned int DNP3_Analyzer::CalcCRC(int len, const u_char* data)
return ~crc & 0xFFFF;
}
DNP3_TCP_Analyzer::DNP3_TCP_Analyzer(Connection* c) : TCP_ApplicationAnalyzer("DNP3_TCP", c)
{
interp = new binpac::DNP3::DNP3_Conn(this);
ClearEndpointState(interp, true);
ClearEndpointState(interp, false);
}
DNP3_TCP_Analyzer::~DNP3_TCP_Analyzer()
{
delete interp;
}
void DNP3_TCP_Analyzer::Done()
{
TCP_ApplicationAnalyzer::Done();
interp->FlowEOF(true);
interp->FlowEOF(false);
}
void DNP3_TCP_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
{
TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
try
{
if ( ! ProcessData(this, interp, len, data, orig) )
SetSkip(1);
}
catch ( const binpac::Exception& e )
{
SetSkip(1);
throw;
}
}
void DNP3_TCP_Analyzer::Undelivered(uint64 seq, int len, bool orig)
{
TCP_ApplicationAnalyzer::Undelivered(seq, len, orig);
interp->NewGap(orig, len);
}
void DNP3_TCP_Analyzer::EndpointEOF(bool is_orig)
{
TCP_ApplicationAnalyzer::EndpointEOF(is_orig);
interp->FlowEOF(is_orig);
}
DNP3_UDP_Analyzer::DNP3_UDP_Analyzer(Connection* c) : Analyzer("DNP3_UDP", c)
{
interp = new binpac::DNP3::DNP3_Conn(this);
ClearEndpointState(interp, true);
ClearEndpointState(interp, false);
if ( ! crc_table_initialized )
PrecomputeCRCTable();
}
DNP3_UDP_Analyzer::~DNP3_UDP_Analyzer()
{
delete interp;
}
void DNP3_UDP_Analyzer::Done()
{
Analyzer::Done();
}
void DNP3_UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, uint64 seq, const IP_Hdr* ip, int caplen)
{
Analyzer::DeliverPacket(len, data, orig, seq, ip, caplen);
try
{
if ( ! ProcessData(this, interp, len, data, orig) )
SetSkip(1);
}
catch ( const binpac::Exception& e )
{
SetSkip(1);
throw;
}
}

View file

@ -3,24 +3,18 @@
#define ANALYZER_PROTOCOL_DNP3_DNP3_H
#include "analyzer/protocol/tcp/TCP.h"
#include "analyzer/protocol/udp/UDP.h"
#include "dnp3_pac.h"
namespace analyzer { namespace dnp3 {
class DNP3_Analyzer : public tcp::TCP_ApplicationAnalyzer {
class DNP3_Analyzer {
public:
DNP3_Analyzer(Connection* conn);
DNP3_Analyzer();
virtual ~DNP3_Analyzer();
virtual void Done();
virtual void DeliverStream(int len, const u_char* data, bool orig);
virtual void Undelivered(uint64 seq, int len, bool orig);
virtual void EndpointEOF(bool is_orig);
static Analyzer* Instantiate(Connection* conn)
{ return new DNP3_Analyzer(conn); }
private:
protected:
static const int MAX_BUFFER_SIZE = 300;
struct Endpoint {
@ -33,24 +27,56 @@ private:
bool encountered_first_chunk;
};
bool ProcessData(int len, const u_char* data, bool orig);
void ClearEndpointState(bool orig);
bool ProcessData(analyzer::Analyzer* thisAnalyzer, binpac::DNP3::DNP3_Conn* thisInterp, int len, const u_char* data, bool orig);
void ClearEndpointState(binpac::DNP3::DNP3_Conn* thisInterp, bool orig);
bool AddToBuffer(Endpoint* endp, int target_len, const u_char** data, int* len);
bool ParseAppLayer(Endpoint* endp);
bool CheckCRC(int len, const u_char* data, const u_char* crc16, const char* where);
bool ParseAppLayer(analyzer::Analyzer* thisAnalyzer, binpac::DNP3::DNP3_Conn* thisInterp, Endpoint* endp);
bool CheckCRC(analyzer::Analyzer* thisAnalyzer, int len, const u_char* data, const u_char* crc16, const char* where);
unsigned int CalcCRC(int len, const u_char* data);
binpac::DNP3::DNP3_Conn* interp;
Endpoint orig_state;
Endpoint resp_state;
static void PrecomputeCRCTable();
static bool crc_table_initialized;
static unsigned int crc_table[256];
Endpoint orig_state;
Endpoint resp_state;
};
class DNP3_TCP_Analyzer : public DNP3_Analyzer, public tcp::TCP_ApplicationAnalyzer {
public:
DNP3_TCP_Analyzer(Connection* conn);
virtual ~DNP3_TCP_Analyzer();
virtual void Done();
virtual void DeliverStream(int len, const u_char* data, bool orig);
virtual void Undelivered(uint64 seq, int len, bool orig);
virtual void EndpointEOF(bool is_orig);
static Analyzer* Instantiate(Connection* conn)
{ return new DNP3_TCP_Analyzer(conn); }
private:
binpac::DNP3::DNP3_Conn* interp;
};
class DNP3_UDP_Analyzer : public DNP3_Analyzer, public analyzer::Analyzer {
public:
DNP3_UDP_Analyzer(Connection* conn);
virtual ~DNP3_UDP_Analyzer();
virtual void Done();
virtual void DeliverPacket(int len, const u_char* data, bool orig,
uint64 seq, const IP_Hdr* ip, int caplen);
static analyzer::Analyzer* Instantiate(Connection* conn)
{ return new DNP3_UDP_Analyzer(conn); }
private:
binpac::DNP3::DNP3_Conn* interp;
};
} } // namespace analyzer::*
#endif

View file

@ -12,11 +12,12 @@ class Plugin : public plugin::Plugin {
public:
plugin::Configuration Configure()
{
AddComponent(new ::analyzer::Component("DNP3", ::analyzer::dnp3::DNP3_Analyzer::Instantiate));
AddComponent(new ::analyzer::Component("DNP3_TCP", ::analyzer::dnp3::DNP3_TCP_Analyzer::Instantiate));
AddComponent(new ::analyzer::Component("DNP3_UDP", ::analyzer::dnp3::DNP3_UDP_Analyzer::Instantiate));
plugin::Configuration config;
config.name = "Bro::DNP3";
config.description = "DNP3 analyzer";
config.description = "DNP3 UDP/TCP analyzers";
return config;
}
} plugin;

View file

@ -20,7 +20,7 @@ flow DNP3_Flow(is_orig: bool) {
return true;
%}
function get_dnp3_application_request_header(fc: uint8): bool
function get_dnp3_application_request_header(application_control: uint8, fc: uint8): bool
%{
if ( ::dnp3_application_request_header )
{
@ -28,13 +28,14 @@ flow DNP3_Flow(is_orig: bool) {
connection()->bro_analyzer(),
connection()->bro_analyzer()->Conn(),
is_orig(),
application_control,
fc
);
}
return true;
%}
function get_dnp3_application_response_header(fc: uint8, iin: uint16): bool
function get_dnp3_application_response_header(application_control: uint8, fc: uint8, iin: uint16): bool
%{
if ( ::dnp3_application_response_header )
{
@ -42,6 +43,7 @@ flow DNP3_Flow(is_orig: bool) {
connection()->bro_analyzer(),
connection()->bro_analyzer()->Conn(),
is_orig(),
application_control,
fc,
iin
);
@ -725,11 +727,11 @@ refine typeattr Header_Block += &let {
};
refine typeattr DNP3_Application_Request_Header += &let {
process_request: bool = $context.flow.get_dnp3_application_request_header(function_code);
process_request: bool = $context.flow.get_dnp3_application_request_header(application_control, function_code);
};
refine typeattr DNP3_Application_Response_Header += &let {
process_request: bool = $context.flow.get_dnp3_application_response_header(function_code, internal_indications);
process_request: bool = $context.flow.get_dnp3_application_response_header(application_control, function_code, internal_indications);
};
refine typeattr Object_Header += &let {

View file

@ -90,7 +90,7 @@ type DNP3_Application_Response_Header = record {
type Request_Objects(function_code: uint8) = record {
object_header: Object_Header(function_code);
data: case (object_header.object_type_field) of {
0x0c03 -> bocmd_PM: Request_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) + 1 ];
0x0c03 -> bocmd_PM: Request_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) + 1*( object_header.number_of_item > ( (object_header.number_of_item / 8)*8 ) ) ];
0x3202 -> time_interval_ojbects: Request_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ object_header.number_of_item]
&check( object_header.qualifer_field == 0x0f && object_header.number_of_item == 0x01);
default -> ojbects: Request_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ object_header.number_of_item];
@ -112,10 +112,10 @@ type Request_Objects(function_code: uint8) = record {
type Response_Objects(function_code: uint8) = record {
object_header: Object_Header(function_code);
data: case (object_header.object_type_field) of {
0x0101 -> biwoflag: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) + 1 ];
0x0301 -> diwoflag: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) + 1 ];
0x0a01 -> bowoflag: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) + 1 ];
0x0c03 -> bocmd_PM: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) + 1 ];
0x0101 -> biwoflag: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) + 1*( object_header.number_of_item > ( (object_header.number_of_item / 8)*8 ) ) ];
0x0301 -> diwoflag: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) + 1*( object_header.number_of_item > ( (object_header.number_of_item / 8)*8 ) ) ];
0x0a01 -> bowoflag: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) + 1*( object_header.number_of_item > ( (object_header.number_of_item / 8)*8 ) )];
0x0c03 -> bocmd_PM: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ ( object_header.number_of_item / 8 ) + 1*( object_header.number_of_item > ( (object_header.number_of_item / 8)*8 ) )];
default -> ojbects: Response_Data_Object(function_code, object_header.qualifier_field, object_header.object_type_field )[ object_header.number_of_item];
};
};

View file

@ -7,7 +7,7 @@
##
## fc: function code.
##
event dnp3_application_request_header%(c: connection, is_orig: bool, fc: count%);
event dnp3_application_request_header%(c: connection, is_orig: bool, application: count, fc: count%);
## Generated for a DNP3 response header.
##
@ -19,7 +19,7 @@ event dnp3_application_request_header%(c: connection, is_orig: bool, fc: count%)
##
## iin: internal indication number.
##
event dnp3_application_response_header%(c: connection, is_orig: bool, fc: count, iin: count%);
event dnp3_application_response_header%(c: connection, is_orig: bool, application: count, fc: count, iin: count%);
## Generated for the object header found in both DNP3 requests and responses.
##

View file

@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path dnp3
#open 2013-08-26-19-04-04
#open 2014-08-16-15-58-44
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
#types time string addr port addr port string string count
1324503054.884183 CXWv6p3arKYeMETxOg 130.126.142.250 49413 130.126.140.229 20000 DELAY_MEASURE RESPONSE 0
#close 2013-08-26-19-04-04
#close 2014-08-16-15-58-44

View file

@ -1,7 +1,7 @@
dnp3_header_block, T, 25605, 8, 196, 2, 3
dnp3_application_request_header, T, 23
dnp3_application_request_header, T, 196, 23
dnp3_header_block, F, 25605, 16, 68, 3, 2
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 196, 129, 0
dnp3_object_header, F, 13314, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255

View file

@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path dnp3
#open 2013-08-26-19-04-04
#open 2014-08-16-15-58-46
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
#types time string addr port addr port string string count
1324916729.150101 CXWv6p3arKYeMETxOg 130.126.142.250 50059 130.126.140.229 20000 ENABLE_UNSOLICITED RESPONSE 0
#close 2013-08-26-19-04-04
#close 2014-08-16-15-58-46

View file

@ -1,7 +1,7 @@
dnp3_header_block, T, 25605, 17, 196, 2, 3
dnp3_application_request_header, T, 20
dnp3_application_request_header, T, 203, 20
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 2
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 203, 129, 0

View file

@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path dnp3
#open 2013-08-26-19-04-05
#open 2014-08-16-15-58-47
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
#types time string addr port addr port string string count
1325044377.992570 CXWv6p3arKYeMETxOg 130.126.142.250 50301 130.126.140.229 20000 DELETE_FILE RESPONSE 0
#close 2013-08-26-19-04-05
#close 2014-08-16-15-58-47

View file

@ -1,9 +1,9 @@
dnp3_header_block, T, 25605, 99, 196, 4, 3
dnp3_application_request_header, T, 27
dnp3_application_request_header, T, 201, 27
dnp3_object_header, T, 17923, 91, 1, 1, 0
dnp3_object_prefix, T, 85
dnp3_header_block, F, 25605, 29, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 201, 129, 0
dnp3_object_header, F, 17924, 91, 1, 1, 0
dnp3_object_prefix, F, 13
dnp3_response_data_object, F, 255

View file

@ -3,7 +3,7 @@
#empty_field (empty)
#unset_field -
#path dnp3
#open 2013-08-26-19-04-05
#open 2014-08-16-15-58-48
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
#types time string addr port addr port string string count
1325036012.621691 CXWv6p3arKYeMETxOg 130.126.142.250 50276 130.126.140.229 20000 OPEN_FILE RESPONSE 4096
@ -11,4 +11,4 @@
1325036019.765502 CXWv6p3arKYeMETxOg 130.126.142.250 50276 130.126.140.229 20000 WRITE RESPONSE 0
1325036022.292689 CXWv6p3arKYeMETxOg 130.126.142.250 50276 130.126.140.229 20000 WRITE RESPONSE 0
1325036024.820857 CXWv6p3arKYeMETxOg 130.126.142.250 50276 130.126.140.229 20000 CLOSE_FILE RESPONSE 0
#close 2013-08-26-19-04-05
#close 2014-08-16-15-58-48

View file

@ -1,45 +1,45 @@
dnp3_header_block, T, 25605, 50, 196, 4, 3
dnp3_application_request_header, T, 25
dnp3_application_request_header, T, 206, 25
dnp3_object_header, T, 17923, 91, 1, 1, 0
dnp3_object_prefix, T, 36
dnp3_header_block, F, 25605, 29, 68, 3, 4
dnp3_application_response_header, F, 129, 4096
dnp3_application_response_header, F, 206, 129, 4096
dnp3_object_header, F, 17924, 91, 1, 1, 0
dnp3_object_prefix, F, 13
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 22, 196, 4, 3
dnp3_application_request_header, T, 1
dnp3_application_request_header, T, 207, 1
dnp3_object_header, T, 17925, 91, 1, 1, 0
dnp3_object_prefix, T, 8
dnp3_file_transport, T, 305419896, 0
^J
dnp3_header_block, F, 25605, 255, 68, 3, 4
dnp3_application_response_header, F, 129, 4096
dnp3_application_response_header, F, 239, 129, 4096
dnp3_object_header, F, 17925, 91, 1, 1, 0
dnp3_object_prefix, F, 838
dnp3_file_transport, F, 305419896, 2147483648
0000 ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e ...<?xml version^J0010 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d ="1.0" e ncoding=^J0020 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 3f 78 6d 6c "utf-8"? >..<?xml^J0030 2d 73 74 79 6c 65 73 68 65 65 74 20 74 79 70 65 -stylesh eet type^J0040 3d 27 74 65 78 74 2f 78 73 6c 27 20 68 72 65 66 ='text/x sl' href^J0050 3d 27 44 4e 50 33 44 65 76 69 63 65 50 72 6f 66 ='DNP3De viceProf^J0060 69 6c 65 4a 61 6e 32 30 31 30 2e 78 73 6c 74 27 ileJan20 10.xslt'^J0070 20 6d 65 64 69 61 3d 27 73 63 72 65 65 6e 27 3f media=' screen'?^J0080 3e 0d 0a 3c 44 4e 50 33 44 65 76 69 63 65 50 72 >..<DNP3 DevicePr^J0090 6f 66 69 6c 65 44 6f 63 75 6d 65 6e 74 20 78 6d ofileDoc ument xm^J00a0 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f lns:xsi= "http://^J00b0 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f www.w3.o rg/2001/^J00c0 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e XMLSchem a-instan^J00d0 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 ce" xmln s:xsd="h^J00e0 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 ttp://ww w.w3.org^J00f0 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 /2001/XM LSchema"^J0100 20 73 63 68 65 6d 61 56 65 72 73 69 6f 6e 3d 22 schemaV ersion="^J0110 32 2e 30 37 2e 30 30 22 20 78 6d 6c 6e 73 3d 22 2.07.00" xmlns="^J0120 68 74 74 70 3a 2f 2f 77 77 77 2e 64 6e 70 33 2e http://w ww.dnp3.^J0130 6f 72 67 2f 44 4e 50 33 2f 44 65 76 69 63 65 50 org/DNP3 /DeviceP^J0140 72 6f 66 69 6c 65 2f 4a 61 6e 32 30 31 30 22 3e rofile/J an2010">^J0150 0d 0a 20 20 3c 21 2d 2d 44 6f 63 75 6d 65 6e 74 .. <!-- Document^J0160 20 48 65 61 64 65 72 2d 2d 3e 0d 0a 20 20 3c 64 Header- ->.. <d^J0170 6f 63 75 6d 65 6e 74 48 65 61 64 65 72 3e 0d 0a ocumentH eader>..^J0180 20 20 20 20 3c 64 6f 63 75 6d 65 6e 74 4e 61 6d <doc umentNam^J0190 65 3e 41 20 44 4e 50 33 20 58 4d 4c 20 46 69 6c e>A DNP3 XML Fil^J01a0 65 3c 2f 64 6f 63 75 6d 65 6e 74 4e 61 6d 65 3e e</docum entName>^J01b0 0d 0a 20 20 20 20 3c 64 6f 63 75 6d 65 6e 74 44 .. <d ocumentD^J01c0 65 73 63 72 69 70 74 69 6f 6e 3e 54 68 69 73 20 escripti on>This ^J01d0 69 73 20 61 20 44 4e 50 33 20 43 6f 6d 70 6c 65 is a DNP 3 Comple^J01e0 74 65 20 44 65 76 69 63 65 20 50 72 6f 66 69 6c te Devic e Profil^J01f0 65 20 66 6f 72 20 44 4e 50 20 4f 75 74 73 74 61 e for DN P Outsta^J0200 74 69 6f 6e 20 69 6e 20 74 68 65 20 54 4d 57 20 tion in the TMW ^J0210 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 20 50 72 Communic ation Pr^J0220 6f 74 6f 63 6f 6c 20 54 65 73 74 20 48 61 72 6e otocol T est Harn^J0230 65 73 73 3c 2f 64 6f 63 75 6d 65 6e 74 44 65 73 ess</doc umentDes^J0240 63 72 69 70 74 69 6f 6e 3e 0d 0a 20 20 20 20 3c cription >.. <^J0250 72 65 76 69 73 69 6f 6e 48 69 73 74 6f 72 79 20 revision History ^J0260 76 65 72 73 69 6f 6e 3d 22 32 22 3e 0d 0a 20 20 version= "2">.. ^J0270 20 20 20 20 3c 64 61 74 65 3e 32 30 31 30 2d 31 <dat e>2010-1^J0280 32 2d 30 31 3c 2f 64 61 74 65 3e 0d 0a 20 20 20 2-01</da te>.. ^J0290 20 20 20 3c 61 75 74 68 6f 72 3e 53 74 65 76 65 <auth or>Steve^J02a0 20 4d 63 43 6f 79 3c 2f 61 75 74 68 6f 72 3e 0d McCoy</ author>.^J02b0 0a 20 20 20 20 20 20 3c 72 65 61 73 6f 6e 3e 44 . < reason>D^J02c0 6f 63 75 6d 65 6e 74 65 64 20 54 65 73 74 20 48 ocumente d Test H^J02d0 61 72 6e 65 73 73 20 53 44 4e 50 20 44 65 76 69 arness S DNP Devi^J02e0 63 65 20 50 72 6f 66 69 6c 65 3c 2f 72 65 61 73 ce Profi le</reas^J02f0 6f 6e 3e 0d 0a 20 20 20 20 3c 2f 72 65 76 69 73 on>.. </revis^J0300 69 6f 6e 48 69 73 74 6f 72 79 3e 0d 0a 20 20 3c ionHisto ry>.. <^J0310 2f 64 6f 63 75 6d 65 6e 74 48 65 61 64 65 72 3e /documen tHeader>^J0320 0d 0a 3c 2f 44 4e 50 33 44 65 76 69 63 65 50 72 ..</DNP3 DevicePr^J0330 6f 66 69 6c 65 44 6f 63 75 6d 65 6e 74 3e ofileDoc ument>^J
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 207, 0
dnp3_header_block, T, 25605, 18, 196, 4, 3
dnp3_application_request_header, T, 2
dnp3_application_request_header, T, 192, 2
dnp3_object_header, T, 12801, 7, 1, 1, 0
dnp3_object_prefix, T, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 192, 129, 0
dnp3_header_block, T, 25605, 18, 196, 4, 3
dnp3_application_request_header, T, 2
dnp3_application_request_header, T, 193, 2
dnp3_object_header, T, 12801, 7, 1, 1, 0
dnp3_object_prefix, T, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 193, 129, 0
dnp3_header_block, T, 25605, 27, 196, 4, 3
dnp3_application_request_header, T, 26
dnp3_application_request_header, T, 194, 26
dnp3_object_header, T, 17924, 91, 1, 1, 0
dnp3_object_prefix, T, 13
dnp3_header_block, F, 25605, 29, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 194, 129, 0
dnp3_object_header, F, 17924, 91, 1, 1, 0
dnp3_object_prefix, F, 13
dnp3_response_data_object, F, 255

View file

@ -3,10 +3,10 @@
#empty_field (empty)
#unset_field -
#path dnp3
#open 2013-08-26-19-04-06
#open 2014-08-16-15-58-49
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
#types time string addr port addr port string string count
1325043635.216629 CXWv6p3arKYeMETxOg 130.126.142.250 50300 130.126.140.229 20000 OPEN_FILE RESPONSE 0
1325043637.790287 CXWv6p3arKYeMETxOg 130.126.142.250 50300 130.126.140.229 20000 WRITE RESPONSE 0
1325043638.820071 CXWv6p3arKYeMETxOg 130.126.142.250 50300 130.126.140.229 20000 CLOSE_FILE RESPONSE 0
#close 2013-08-26-19-04-06
#close 2014-08-16-15-58-49

View file

@ -1,29 +1,29 @@
dnp3_header_block, T, 25605, 99, 196, 4, 3
dnp3_application_request_header, T, 25
dnp3_application_request_header, T, 198, 25
dnp3_object_header, T, 17923, 91, 1, 1, 0
dnp3_object_prefix, T, 85
dnp3_header_block, F, 25605, 29, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 198, 129, 0
dnp3_object_header, F, 17924, 91, 1, 1, 0
dnp3_object_prefix, F, 13
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 255, 196, 4, 3
dnp3_application_request_header, T, 2
dnp3_application_request_header, T, 199, 2
dnp3_object_header, T, 17925, 91, 1, 1, 0
dnp3_object_prefix, T, 838
dnp3_file_transport, T, 305419896, 2147483648
0000 ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e ...<?xml version^J0010 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d ="1.0" e ncoding=^J0020 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 3f 78 6d 6c "utf-8"? >..<?xml^J0030 2d 73 74 79 6c 65 73 68 65 65 74 20 74 79 70 65 -stylesh eet type^J0040 3d 27 74 65 78 74 2f 78 73 6c 27 20 68 72 65 66 ='text/x sl' href^J0050 3d 27 44 4e 50 33 44 65 76 69 63 65 50 72 6f 66 ='DNP3De viceProf^J0060 69 6c 65 4a 61 6e 32 30 31 30 2e 78 73 6c 74 27 ileJan20 10.xslt'^J0070 20 6d 65 64 69 61 3d 27 73 63 72 65 65 6e 27 3f media=' screen'?^J0080 3e 0d 0a 3c 44 4e 50 33 44 65 76 69 63 65 50 72 >..<DNP3 DevicePr^J0090 6f 66 69 6c 65 44 6f 63 75 6d 65 6e 74 20 78 6d ofileDoc ument xm^J00a0 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f lns:xsi= "http://^J00b0 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f www.w3.o rg/2001/^J00c0 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e XMLSchem a-instan^J00d0 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 ce" xmln s:xsd="h^J00e0 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 ttp://ww w.w3.org^J00f0 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 /2001/XM LSchema"^J0100 20 73 63 68 65 6d 61 56 65 72 73 69 6f 6e 3d 22 schemaV ersion="^J0110 32 2e 30 37 2e 30 30 22 20 78 6d 6c 6e 73 3d 22 2.07.00" xmlns="^J0120 68 74 74 70 3a 2f 2f 77 77 77 2e 64 6e 70 33 2e http://w ww.dnp3.^J0130 6f 72 67 2f 44 4e 50 33 2f 44 65 76 69 63 65 50 org/DNP3 /DeviceP^J0140 72 6f 66 69 6c 65 2f 4a 61 6e 32 30 31 30 22 3e rofile/J an2010">^J0150 0d 0a 20 20 3c 21 2d 2d 44 6f 63 75 6d 65 6e 74 .. <!-- Document^J0160 20 48 65 61 64 65 72 2d 2d 3e 0d 0a 20 20 3c 64 Header- ->.. <d^J0170 6f 63 75 6d 65 6e 74 48 65 61 64 65 72 3e 0d 0a ocumentH eader>..^J0180 20 20 20 20 3c 64 6f 63 75 6d 65 6e 74 4e 61 6d <doc umentNam^J0190 65 3e 41 20 44 4e 50 33 20 58 4d 4c 20 46 69 6c e>A DNP3 XML Fil^J01a0 65 3c 2f 64 6f 63 75 6d 65 6e 74 4e 61 6d 65 3e e</docum entName>^J01b0 0d 0a 20 20 20 20 3c 64 6f 63 75 6d 65 6e 74 44 .. <d ocumentD^J01c0 65 73 63 72 69 70 74 69 6f 6e 3e 54 68 69 73 20 escripti on>This ^J01d0 69 73 20 61 20 44 4e 50 33 20 43 6f 6d 70 6c 65 is a DNP 3 Comple^J01e0 74 65 20 44 65 76 69 63 65 20 50 72 6f 66 69 6c te Devic e Profil^J01f0 65 20 66 6f 72 20 44 4e 50 20 4f 75 74 73 74 61 e for DN P Outsta^J0200 74 69 6f 6e 20 69 6e 20 74 68 65 20 54 4d 57 20 tion in the TMW ^J0210 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 20 50 72 Communic ation Pr^J0220 6f 74 6f 63 6f 6c 20 54 65 73 74 20 48 61 72 6e otocol T est Harn^J0230 65 73 73 3c 2f 64 6f 63 75 6d 65 6e 74 44 65 73 ess</doc umentDes^J0240 63 72 69 70 74 69 6f 6e 3e 0d 0a 20 20 20 20 3c cription >.. <^J0250 72 65 76 69 73 69 6f 6e 48 69 73 74 6f 72 79 20 revision History ^J0260 76 65 72 73 69 6f 6e 3d 22 32 22 3e 0d 0a 20 20 version= "2">.. ^J0270 20 20 20 20 3c 64 61 74 65 3e 32 30 31 30 2d 31 <dat e>2010-1^J0280 32 2d 30 31 3c 2f 64 61 74 65 3e 0d 0a 20 20 20 2-01</da te>.. ^J0290 20 20 20 3c 61 75 74 68 6f 72 3e 53 74 65 76 65 <auth or>Steve^J02a0 20 4d 63 43 6f 79 3c 2f 61 75 74 68 6f 72 3e 0d McCoy</ author>.^J02b0 0a 20 20 20 20 20 20 3c 72 65 61 73 6f 6e 3e 44 . < reason>D^J02c0 6f 63 75 6d 65 6e 74 65 64 20 54 65 73 74 20 48 ocumente d Test H^J02d0 61 72 6e 65 73 73 20 53 44 4e 50 20 44 65 76 69 arness S DNP Devi^J02e0 63 65 20 50 72 6f 66 69 6c 65 3c 2f 72 65 61 73 ce Profi le</reas^J02f0 6f 6e 3e 0d 0a 20 20 20 20 3c 2f 72 65 76 69 73 on>.. </revis^J0300 69 6f 6e 48 69 73 74 6f 72 79 3e 0d 0a 20 20 3c ionHisto ry>.. <^J0310 2f 64 6f 63 75 6d 65 6e 74 48 65 61 64 65 72 3e /documen tHeader>^J0320 0d 0a 3c 2f 44 4e 50 33 44 65 76 69 63 65 50 72 ..</DNP3 DevicePr^J0330 6f 66 69 6c 65 44 6f 63 75 6d 65 6e 74 3e ofileDoc ument>^J
dnp3_header_block, F, 25605, 25, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 199, 129, 0
dnp3_object_header, F, 17926, 91, 1, 1, 0
dnp3_object_prefix, F, 9
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 27, 196, 4, 3
dnp3_application_request_header, T, 26
dnp3_application_request_header, T, 200, 26
dnp3_object_header, T, 17924, 91, 1, 1, 0
dnp3_object_prefix, T, 13
dnp3_header_block, F, 25605, 29, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 200, 129, 0
dnp3_object_header, F, 17924, 91, 1, 1, 0
dnp3_object_prefix, F, 13
dnp3_response_data_object, F, 255

View file

@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path dnp3
#open 2013-08-26-19-04-06
#open 2014-08-16-15-58-51
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
#types time string addr port addr port string string count
1324327256.650425 CXWv6p3arKYeMETxOg 130.126.142.250 51006 130.126.140.229 20000 READ RESPONSE 0
#close 2013-08-26-19-04-06
#close 2014-08-16-15-58-51

View file

@ -1,11 +1,11 @@
dnp3_header_block, T, 25605, 20, 196, 2, 3
dnp3_application_request_header, T, 1
dnp3_application_request_header, T, 200, 1
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_object_header, T, 15361, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 116, 68, 3, 2
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 200, 129, 0
dnp3_object_header, F, 258, 0, 9, 0, 8
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 129

View file

@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path dnp3
#open 2013-08-26-19-04-06
#open 2014-08-16-15-58-53
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
#types time string addr port addr port string string count
1324502980.465157 CXWv6p3arKYeMETxOg 130.126.142.250 49412 130.126.140.229 20000 RECORD_CURRENT_TIME RESPONSE 0
#close 2013-08-26-19-04-06
#close 2014-08-16-15-58-53

View file

@ -1,4 +1,4 @@
dnp3_header_block, T, 25605, 8, 196, 2, 3
dnp3_application_request_header, T, 24
dnp3_application_request_header, T, 193, 24
dnp3_header_block, F, 25605, 10, 68, 3, 2
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 193, 129, 0

View file

@ -3,9 +3,9 @@
#empty_field (empty)
#unset_field -
#path dnp3
#open 2013-08-26-19-04-07
#open 2014-08-16-15-58-54
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
#types time string addr port addr port string string count
1324501739.752598 CXWv6p3arKYeMETxOg 130.126.142.250 49404 130.126.140.229 20000 SELECT RESPONSE 0
1324501743.758738 CXWv6p3arKYeMETxOg 130.126.142.250 49404 130.126.140.229 20000 OPERATE RESPONSE 0
#close 2013-08-26-19-04-07
#close 2014-08-16-15-58-54

View file

@ -1,21 +1,21 @@
dnp3_header_block, T, 25605, 26, 196, 2, 3
dnp3_application_request_header, T, 3
dnp3_application_request_header, T, 199, 3
dnp3_object_header, T, 3073, 40, 1, 256, 0
dnp3_object_prefix, T, 1
dnp3_crob, T, 3, 1, 100, 100, 0
dnp3_header_block, F, 25605, 28, 68, 3, 2
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 199, 129, 0
dnp3_object_header, F, 3073, 40, 1, 256, 0
dnp3_object_prefix, F, 1
dnp3_crob, F, 3, 1, 100, 100, 0
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 26, 196, 2, 3
dnp3_application_request_header, T, 4
dnp3_application_request_header, T, 200, 4
dnp3_object_header, T, 3073, 40, 1, 256, 0
dnp3_object_prefix, T, 1
dnp3_crob, T, 3, 1, 100, 100, 0
dnp3_header_block, F, 25605, 28, 68, 3, 2
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 200, 129, 0
dnp3_object_header, F, 3073, 40, 1, 256, 0
dnp3_object_prefix, F, 1
dnp3_crob, F, 3, 1, 100, 100, 0

View file

@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path dnp3
#open 2013-08-26-19-04-07
#open 2014-08-16-15-58-55
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
#types time string addr port addr port string string count
1324502912.898449 CXWv6p3arKYeMETxOg 130.126.142.250 49411 130.126.140.229 20000 WRITE RESPONSE 0
#close 2013-08-26-19-04-07
#close 2014-08-16-15-58-55

View file

@ -1,6 +1,6 @@
dnp3_header_block, T, 25605, 18, 196, 2, 3
dnp3_application_request_header, T, 2
dnp3_application_request_header, T, 192, 2
dnp3_object_header, T, 12801, 7, 1, 1, 0
dnp3_object_prefix, T, 0
dnp3_header_block, F, 25605, 10, 68, 3, 2
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 192, 129, 0

View file

@ -3,7 +3,7 @@
#empty_field (empty)
#unset_field -
#path dnp3
#open 2013-08-26-19-47-53
#open 2014-08-16-15-58-56
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fc_request fc_reply iin
#types time string addr port addr port string string count
1097501938.504844 CXWv6p3arKYeMETxOg 10.0.0.8 2789 10.0.0.3 20000 - UNSOLICITED_RESPONSE 4096
@ -72,4 +72,4 @@
1178206045.032815 C7XEbhP654jzLoe3a 192.168.66.33 1167 192.168.66.34 20000 READ RESPONSE 6
1178206045.557097 C7XEbhP654jzLoe3a 192.168.66.33 1167 192.168.66.34 20000 READ RESPONSE 6
1178206046.086403 C7XEbhP654jzLoe3a 192.168.66.33 1167 192.168.66.34 20000 READ RESPONSE 6
#close 2013-08-26-19-47-53
#close 2014-08-16-15-58-56

View file

@ -1,41 +1,41 @@
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 130, 4096
dnp3_application_response_header, F, 247, 130, 4096
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 215, 0
dnp3_header_block, T, 25605, 18, 196, 4, 3
dnp3_application_request_header, T, 2
dnp3_application_request_header, T, 193, 2
dnp3_object_header, T, 12801, 7, 1, 1, 0
dnp3_object_prefix, T, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 193, 129, 0
dnp3_header_block, T, 25605, 17, 196, 4, 3
dnp3_application_request_header, T, 21
dnp3_application_request_header, T, 194, 21
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 194, 129, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 249, 130, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 130, 4096
dnp3_application_response_header, F, 242, 130, 4096
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 210, 0
dnp3_header_block, T, 25605, 18, 196, 4, 3
dnp3_application_request_header, T, 2
dnp3_application_request_header, T, 193, 2
dnp3_object_header, T, 12801, 7, 1, 1, 0
dnp3_object_prefix, T, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 193, 129, 0
dnp3_header_block, T, 25605, 17, 196, 4, 3
dnp3_application_request_header, T, 20
dnp3_application_request_header, T, 194, 20
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 194, 129, 0
dnp3_header_block, F, 25605, 76, 68, 3, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 243, 130, 0
dnp3_object_header, F, 13057, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
@ -61,9 +61,9 @@ dnp3_object_prefix, F, 2
dnp3_analog_input_event_32woTime, F, 1, 0
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 211, 0
dnp3_header_block, F, 25605, 71, 68, 3, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 244, 130, 0
dnp3_object_header, F, 13057, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
@ -87,9 +87,9 @@ dnp3_object_prefix, F, 1
dnp3_analog_input_event_32woTime, F, 1, 0
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 212, 0
dnp3_header_block, F, 25605, 76, 68, 3, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 245, 130, 0
dnp3_object_header, F, 13057, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
@ -115,9 +115,9 @@ dnp3_object_prefix, F, 2
dnp3_analog_input_event_32woTime, F, 1, 198
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 213, 0
dnp3_header_block, F, 25605, 71, 68, 3, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 246, 130, 0
dnp3_object_header, F, 13057, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
@ -141,9 +141,9 @@ dnp3_object_prefix, F, 1
dnp3_analog_input_event_32woTime, F, 1, 200
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 214, 0
dnp3_header_block, F, 25605, 76, 68, 3, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 247, 130, 0
dnp3_object_header, F, 13057, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
@ -169,9 +169,9 @@ dnp3_object_prefix, F, 2
dnp3_analog_input_event_32woTime, F, 1, 0
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 215, 0
dnp3_header_block, F, 25605, 50, 68, 3, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 248, 130, 0
dnp3_object_header, F, 13057, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
@ -187,9 +187,9 @@ dnp3_response_data_object, F, 255
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 216, 0
dnp3_header_block, F, 25605, 76, 68, 3, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 249, 130, 0
dnp3_object_header, F, 13057, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
@ -215,9 +215,9 @@ dnp3_object_prefix, F, 2
dnp3_analog_input_event_32woTime, F, 1, 199
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 217, 0
dnp3_header_block, F, 25605, 66, 68, 3, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 250, 130, 0
dnp3_object_header, F, 13057, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
@ -239,9 +239,9 @@ dnp3_object_prefix, F, 1
dnp3_analog_input_event_32woTime, F, 1, 200
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 218, 0
dnp3_header_block, F, 25605, 76, 68, 3, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 251, 130, 0
dnp3_object_header, F, 13057, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
@ -267,9 +267,9 @@ dnp3_object_prefix, F, 2
dnp3_analog_input_event_32woTime, F, 1, 0
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 219, 0
dnp3_header_block, F, 25605, 56, 68, 3, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 252, 130, 0
dnp3_object_header, F, 13057, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
@ -287,53 +287,53 @@ dnp3_object_prefix, F, 2
dnp3_analog_input_event_32woTime, F, 1, 199
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 220, 0
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 13
dnp3_application_request_header, T, 195, 13
dnp3_header_block, F, 25605, 16, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 195, 129, 0
dnp3_object_header, F, 13314, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 13
dnp3_application_request_header, T, 193, 13
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 247, 130, 0
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 248, 130, 0
dnp3_header_block, F, 25605, 16, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 193, 129, 0
dnp3_object_header, F, 13314, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 11, 196, 4, 3
dnp3_application_request_header, T, 1
dnp3_application_request_header, T, 194, 1
dnp3_object_header, T, 512, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 32768
dnp3_application_response_header, F, 194, 129, 32768
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 32768
dnp3_application_response_header, F, 249, 130, 32768
dnp3_header_block, T, 25605, 17, 196, 4, 3
dnp3_application_request_header, T, 21
dnp3_application_request_header, T, 195, 21
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 32768
dnp3_application_response_header, F, 195, 129, 32768
dnp3_header_block, T, 25605, 14, 196, 4, 3
dnp3_application_request_header, T, 2
dnp3_application_request_header, T, 196, 2
dnp3_object_header, T, 20481, 0, 1, 7, 7
dnp3_object_prefix, T, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 196, 129, 0
dnp3_header_block, T, 25605, 20, 196, 4, 3
dnp3_application_request_header, T, 1
dnp3_application_request_header, T, 197, 1
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_object_header, T, 15361, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 78, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 197, 129, 0
dnp3_object_header, F, 257, 0, 6, 0, 5
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 2
@ -381,90 +381,90 @@ dnp3_object_prefix, F, 0
dnp3_analog_input_32woFlag, F, 7184
dnp3_response_data_object, F, 255
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 250, 130, 0
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 251, 130, 0
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 252, 130, 0
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 253, 130, 0
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 254, 130, 0
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 255, 130, 0
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 240, 130, 0
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 241, 130, 0
dnp3_header_block, T, 25605, 17, 196, 4, 3
dnp3_application_request_header, T, 20
dnp3_application_request_header, T, 198, 20
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 198, 129, 0
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 242, 130, 0
dnp3_header_block, T, 25605, 17, 196, 4, 3
dnp3_application_request_header, T, 20
dnp3_application_request_header, T, 199, 20
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 199, 129, 0
dnp3_header_block, F, 25605, 10, 68, 6, 4
dnp3_application_response_header, F, 130, 0
dnp3_application_response_header, F, 243, 130, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 130, 36864
dnp3_application_response_header, F, 240, 130, 36864
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 0
dnp3_application_request_header, T, 208, 0
dnp3_header_block, T, 25605, 17, 196, 4, 3
dnp3_application_request_header, T, 21
dnp3_application_request_header, T, 193, 21
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 36864
dnp3_application_response_header, F, 193, 129, 36864
dnp3_header_block, T, 25605, 18, 196, 4, 3
dnp3_application_request_header, T, 2
dnp3_application_request_header, T, 194, 2
dnp3_object_header, T, 12801, 7, 1, 1, 0
dnp3_object_prefix, T, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 32768
dnp3_application_response_header, F, 194, 129, 32768
dnp3_header_block, T, 25605, 17, 196, 4, 3
dnp3_application_request_header, T, 21
dnp3_application_request_header, T, 195, 21
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 32768
dnp3_application_response_header, F, 195, 129, 32768
dnp3_header_block, T, 25605, 18, 196, 4, 3
dnp3_application_request_header, T, 2
dnp3_application_request_header, T, 196, 2
dnp3_object_header, T, 12801, 7, 1, 1, 0
dnp3_object_prefix, T, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 32768
dnp3_application_response_header, F, 196, 129, 32768
dnp3_header_block, T, 25605, 17, 196, 4, 3
dnp3_application_request_header, T, 21
dnp3_application_request_header, T, 197, 21
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 32768
dnp3_application_response_header, F, 197, 129, 32768
dnp3_header_block, T, 25605, 14, 196, 4, 3
dnp3_application_request_header, T, 2
dnp3_application_request_header, T, 198, 2
dnp3_object_header, T, 20481, 0, 1, 7, 7
dnp3_object_prefix, T, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 198, 129, 0
dnp3_header_block, T, 25605, 20, 196, 4, 3
dnp3_application_request_header, T, 1
dnp3_application_request_header, T, 199, 1
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_object_header, T, 15361, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 78, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 199, 129, 0
dnp3_object_header, F, 257, 0, 6, 0, 5
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 25
@ -512,143 +512,143 @@ dnp3_object_prefix, F, 0
dnp3_analog_input_32woFlag, F, 8523
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 14
dnp3_application_request_header, T, 200, 14
dnp3_header_block, F, 25605, 16, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 200, 129, 0
dnp3_object_header, F, 13314, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 8, 196, 4, 3
dnp3_application_request_header, T, 14
dnp3_application_request_header, T, 201, 14
dnp3_header_block, F, 25605, 16, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 201, 129, 0
dnp3_object_header, F, 13314, 7, 1, 1, 0
dnp3_object_prefix, F, 0
dnp3_response_data_object, F, 255
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 130, 256
dnp3_application_response_header, F, 253, 130, 256
dnp3_header_block, T, 25605, 17, 196, 65535, 3
dnp3_application_request_header, T, 21
dnp3_application_request_header, T, 193, 21
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 237, 0, 0, 0
dnp3_header_block, T, 25605, 17, 196, 65535, 3
dnp3_application_request_header, T, 21
dnp3_application_request_header, T, 193, 21
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 237, 0, 0, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 130, 4096
dnp3_application_response_header, F, 241, 130, 4096
dnp3_header_block, T, 25605, 17, 196, 4, 3
dnp3_application_request_header, T, 18
dnp3_application_request_header, T, 193, 18
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 263, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 237, 0, 0, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 4097
dnp3_application_response_header, F, 195, 129, 4097
dnp3_header_block, T, 25605, 17, 196, 4, 3
dnp3_application_request_header, T, 18
dnp3_application_request_header, T, 193, 18
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 263, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 237, 0, 0, 0
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 4097
dnp3_application_response_header, F, 196, 129, 4097
dnp3_header_block, F, 25605, 10, 68, 3, 6
dnp3_application_response_header, F, 130, 38145
dnp3_application_response_header, F, 246, 130, 38145
dnp3_header_block, T, 25605, 17, 196, 65535, 3
dnp3_application_request_header, T, 18
dnp3_application_request_header, T, 193, 18
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 263, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 237, 0, 0, 0
dnp3_header_block, T, 25605, 17, 196, 65535, 3
dnp3_application_request_header, T, 18
dnp3_application_request_header, T, 193, 18
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 263, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 237, 0, 0, 0
dnp3_header_block, T, 25605, 17, 196, 4, 3
dnp3_application_request_header, T, 1
dnp3_application_request_header, T, 194, 1
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 0
dnp3_application_response_header, F, 194, 129, 0
dnp3_header_block, T, 25605, 26, 196, 4, 3
dnp3_application_request_header, T, 3
dnp3_application_request_header, T, 195, 3
dnp3_object_header, T, 3073, 40, 1, 256, 0
dnp3_object_prefix, T, 34463
dnp3_crob, T, 3, 1, 100, 100, 0
dnp3_header_block, F, 25605, 28, 68, 3, 4
dnp3_application_response_header, F, 129, 4
dnp3_application_response_header, F, 195, 129, 4
dnp3_object_header, F, 3073, 40, 1, 256, 0
dnp3_object_prefix, F, 34463
dnp3_crob, F, 3, 1, 100, 100, 4
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 26, 196, 4, 3
dnp3_application_request_header, T, 3
dnp3_application_request_header, T, 196, 3
dnp3_object_header, T, 3073, 40, 1, 256, 0
dnp3_object_prefix, T, 34463
dnp3_crob, T, 3, 1, 100, 100, 0
dnp3_header_block, F, 25605, 28, 68, 3, 4
dnp3_application_response_header, F, 129, 4
dnp3_application_response_header, F, 196, 129, 4
dnp3_object_header, F, 3073, 40, 1, 256, 0
dnp3_object_prefix, F, 34463
dnp3_crob, F, 3, 1, 100, 100, 4
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 26, 196, 4, 3
dnp3_application_request_header, T, 3
dnp3_application_request_header, T, 197, 3
dnp3_object_header, T, 3073, 40, 1, 256, 0
dnp3_object_prefix, T, 34463
dnp3_crob, T, 3, 1, 100, 100, 0
dnp3_header_block, F, 25605, 28, 68, 3, 4
dnp3_application_response_header, F, 129, 4
dnp3_application_response_header, F, 197, 129, 4
dnp3_object_header, F, 3073, 40, 1, 256, 0
dnp3_object_prefix, F, 34463
dnp3_crob, F, 3, 1, 100, 100, 4
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 26, 196, 4, 3
dnp3_application_request_header, T, 3
dnp3_application_request_header, T, 198, 3
dnp3_object_header, T, 3073, 40, 1, 256, 0
dnp3_object_prefix, T, 34463
dnp3_crob, T, 3, 1, 100, 100, 0
dnp3_header_block, F, 25605, 28, 68, 3, 4
dnp3_application_response_header, F, 129, 4
dnp3_application_response_header, F, 198, 129, 4
dnp3_object_header, F, 3073, 40, 1, 256, 0
dnp3_object_prefix, F, 34463
dnp3_crob, F, 3, 1, 100, 100, 4
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 26, 196, 4, 3
dnp3_application_request_header, T, 3
dnp3_application_request_header, T, 199, 3
dnp3_object_header, T, 3073, 40, 1, 256, 0
dnp3_object_prefix, T, 34463
dnp3_crob, T, 3, 1, 100, 100, 0
dnp3_header_block, F, 25605, 28, 68, 3, 4
dnp3_application_response_header, F, 129, 4
dnp3_application_response_header, F, 199, 129, 4
dnp3_object_header, F, 3073, 40, 1, 256, 0
dnp3_object_prefix, F, 34463
dnp3_crob, F, 3, 1, 100, 100, 4
dnp3_response_data_object, F, 255
dnp3_header_block, T, 25605, 11, 196, 4, 3
dnp3_application_request_header, T, 1
dnp3_application_request_header, T, 200, 1
dnp3_object_header, T, 65280, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 6
dnp3_application_response_header, F, 200, 129, 6
dnp3_header_block, T, 25605, 11, 196, 4, 3
dnp3_application_request_header, T, 1
dnp3_application_request_header, T, 201, 1
dnp3_object_header, T, 65280, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 6
dnp3_application_response_header, F, 201, 129, 6
dnp3_header_block, T, 25605, 11, 196, 4, 3
dnp3_application_request_header, T, 1
dnp3_application_request_header, T, 202, 1
dnp3_object_header, T, 65280, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 6
dnp3_application_response_header, F, 202, 129, 6
dnp3_header_block, T, 25605, 11, 196, 4, 3
dnp3_application_request_header, T, 1
dnp3_application_request_header, T, 203, 1
dnp3_object_header, T, 65280, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 6
dnp3_application_response_header, F, 203, 129, 6
dnp3_header_block, T, 25605, 11, 196, 4, 3
dnp3_application_request_header, T, 1
dnp3_application_request_header, T, 204, 1
dnp3_object_header, T, 65280, 6, 0, 65535, 65535
dnp3_header_block, F, 25605, 10, 68, 3, 4
dnp3_application_response_header, F, 129, 6
dnp3_application_response_header, F, 204, 129, 6

View file

@ -7,14 +7,14 @@
# @TEST-EXEC: btest-diff coverage
# @TEST-EXEC: btest-diff dnp3.log
#
event dnp3_application_request_header(c: connection, is_orig: bool, fc: count)
event dnp3_application_request_header(c: connection, is_orig: bool, application_control: count, fc: count)
{
print "dnp3_application_request_header", is_orig, fc;
print "dnp3_application_request_header", is_orig, application_control, fc;
}
event dnp3_application_response_header(c: connection, is_orig: bool, fc: count, iin: count)
event dnp3_application_response_header(c: connection, is_orig: bool, application_control: count, fc: count, iin: count)
{
print "dnp3_application_response_header", is_orig, fc, iin;
print "dnp3_application_response_header", is_orig, application_control, fc, iin;
}
event dnp3_object_header(c: connection, is_orig: bool, obj_type: count, qua_field: count, number: count, rf_low: count, rf_high: count)