Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/hui/modbus-events'

Browse source 
* origin/topic/hui/modbus-events:
  adding another trace file to test read and write coil function codes
  add/update test file and baseline result
  add implementation of bytestring_to_coils for modbusy analyzer
  adding a missing field in record ModbusHeaders
  add event handlers for modbus
This commit is contained in:
Robin Sommer 2014-07-22 01:03:48 +02:00
commit fa1ba06414
13 changed files with 90907 additions and 79645 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/analyzer/protocol/modbus/modbus-analyzer.pac
View file

@ -17,6 +17,11 @@
VectorVal* bytestring_to_coils(bytestring coils, uint quantity)
{
VectorVal* modbus_coils = new VectorVal(BifType::Vector::ModbusCoils);
for ( uint i = 0; i < quantity; i++ )
{
char currentCoil = (coils[i/8] >> (i % 8)) % 2;
modbus_coils->Assign(i, new Val(currentCoil, TYPE_BOOL));
}
return modbus_coils;
}
@ -26,8 +31,9 @@
RecordVal* modbus_header = new RecordVal(BifType::Record::ModbusHeaders);
modbus_header->Assign(0, new Val(header->tid(), TYPE_COUNT));
modbus_header->Assign(1, new Val(header->pid(), TYPE_COUNT));
modbus_header->Assign(2, new Val(header->uid(), TYPE_COUNT));
modbus_header->Assign(3, new Val(header->fc(), TYPE_COUNT));
modbus_header->Assign(2, new Val(header->len(), TYPE_COUNT));
modbus_header->Assign(3, new Val(header->uid(), TYPE_COUNT));
modbus_header->Assign(4, new Val(header->fc(), TYPE_COUNT));
return modbus_header;
}
@ -614,6 +620,3 @@ refine flow ModbusTCP_Flow += {
return true;
%}
};