Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add modbus transaction and unit ids to logs

Browse source 
Add transaction IDs and unit IDs to default modbus over TCP/IP logs.
Update the relevant testing baselines to account for the extra fields.
This commit is contained in:
Michael Torres 2022-07-16 16:18:35 +00:00
parent 7c24b53b4f
commit bab2036aa4
4 changed files with 40001 additions and 19996 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/protocols/modbus/main.zeek
View file

@ -16,6 +16,10 @@ export {
uid: string &log;
## Identifier for the connection.
id: conn_id &log;
## Modbus transaction ID
tid: count &log &optional;
## The terminal unit identifier for the message
unit: count &log &optional;
## The name of the function message that was sent.
func: string &log &optional;
## The exception if the response was a failure.
@ -48,6 +52,8 @@ event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool) &prio
}
c$modbus$ts = network_time();
c$modbus$tid = headers$tid;
c$modbus$unit = headers$uid;
c$modbus$func = function_codes[headers$function_code];
}