mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
10b1857a9c
* The altered Modbus checks seemed overly strict -- the pcap used for the unit test at least had quantities/byte_count fields of zero, to which the server responds with an error (expected). * Most of the altered DNP3 checks seemed overly strict and caused the unit tests to fail. The one that was just wrong was the 'start' field in header blocks. * Removed the "start" parameter of the dnp3_header_block event since it's always the same value. * The SMB check failed to compile and I don't know what it intended to do, so removed.
88 lines
2.8 KiB
Text
88 lines
2.8 KiB
Text
dnp3_header_block, T, 20, 196, 2, 3
|
|
dnp3_application_request_header, T, 200, 1
|
|
dnp3_object_header, T, 15362, 6, 0, 65535, 65535
|
|
dnp3_object_header, T, 15363, 6, 0, 65535, 65535
|
|
dnp3_object_header, T, 15364, 6, 0, 65535, 65535
|
|
dnp3_object_header, T, 15361, 6, 0, 65535, 65535
|
|
dnp3_header_block, F, 116, 68, 3, 2
|
|
dnp3_application_response_header, F, 200, 129, 0
|
|
dnp3_object_header, F, 258, 0, 9, 0, 8
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 129
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 1
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 129
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 1
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 1
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 1
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 1
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 1
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 1
|
|
dnp3_object_header, F, 2562, 0, 7, 0, 6
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 0
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 0
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 0
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 0
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 0
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 0
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_response_data_object, F, 1
|
|
dnp3_object_header, F, 7681, 0, 15, 0, 14
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 1, 1007
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 1, 3
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 1, 1005
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 1, 18446744073709539627
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 1, 1005
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 1, 12006
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 1, 134423
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 0, 0
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 1, 134325
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 0, 0
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 1, 134538
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 0, 0
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 0, 0
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 0, 0
|
|
dnp3_response_data_object, F, 255
|
|
dnp3_object_prefix, F, 0
|
|
dnp3_analog_input_32wFlag, F, 0, 0
|
|
dnp3_response_data_object, F, 255
|