Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Small modbus documentation update and tiny refactoring.

Browse source
This commit is contained in:
Seth Hall 2012-10-31 23:57:38 -04:00
parent a2f336cc72
commit c32b179ac5
2 changed files with 14 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

18
scripts/base/protocols/modbus/main.bro
View file

@ -14,8 +14,6 @@ export {
id: conn_id &log; id: conn_id &log;
## The name of the function message that was sent. ## The name of the function message that was sent.
func: string &log &optional; func: string &log &optional;
## The status of the response.
success: bool &log &default=T;
## The exception if the response was a failure. ## The exception if the response was a failure.
exception: string &log &optional; exception: string &log &optional;
}; };
@ -48,26 +46,24 @@ event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool) &prio
c$modbus$ts = network_time(); c$modbus$ts = network_time();
c$modbus$func = function_codes[headers$function_code]; c$modbus$func = function_codes[headers$function_code];
if ( ! is_orig &&
( headers$function_code >= 0x81 || headers$function_code <= 0x98 ) )
c$modbus$success = F;
else
c$modbus$success = T;
} }
event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool) &priority=-5 event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool) &priority=-5
{ {
# Don't log now if this is an exception (log in the exception event handler) # Only log upon replies.
if ( c$modbus$success ) # Also, don't log now if this is an exception (log in the exception event handler)
if ( ! is_orig && ( headers$function_code <= 0x81 || headers$function_code >= 0x98 ) )
Log::write(LOG, c$modbus); Log::write(LOG, c$modbus);
} }
event modbus_exception(c: connection, headers: ModbusHeaders, code: count) &priority=5 event modbus_exception(c: connection, headers: ModbusHeaders, code: count) &priority=5
{ {
c$modbus$exception = exception_codes[code]; c$modbus$exception = exception_codes[code];
Log::write(LOG, c$modbus); }
event modbus_exception(c: connection, headers: ModbusHeaders, code: count) &priority=-5
{
Log::write(LOG, c$modbus);
delete c$modbus$exception; delete c$modbus$exception;
} }

7
scripts/policy/protocols/modbus/track-memmap.bro
View file

@ -11,12 +11,19 @@ export {
const track_memmap: Host = ALL_HOSTS &redef; const track_memmap: Host = ALL_HOSTS &redef;
type MemmapInfo: record { type MemmapInfo: record {
## Timestamp for the detected register change
ts: time &log; ts: time &log;
## Unique ID for the connection
uid: string &log; uid: string &log;
## Connection ID.
id: conn_id &log; id: conn_id &log;
## The device memory offset.
register: count &log; register: count &log;
## The old value stored in the register.
old_val: count &log; old_val: count &log;
## The new value stored in the register.
new_val: count &log; new_val: count &log;
## The time delta between when the 'old_val' and 'new_val' were seen.
delta: interval &log; delta: interval &log;
}; };