zeek/scripts/base/protocols/dnp3/dpd.sig
Robin Sommer 306d4fa6f9 Pluginizing the DNP3 analyzer, plus a basic script logging requests
and replies.

Almost ready, but now 1 test fails again ...

[Note I broke git history by copying over the files into a new branch.]
2013-08-01 17:36:11 -07:00

15 lines
290 B
Standard ML

signature dpd_dnp3_client {
ip-proto == tcp
# dnp3 packets always starts with 0x05 0x64 .
payload /\x05\0x64/
tcp-state originator
}
signature dpd_dnp3_server {
ip-proto == tcp
# dnp3 packets always starts with 0x05 0x64 .
payload /\x05\x64/
tcp-state responder
enable "dnp3"
}