mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
b85801aa7e
Add the `pdu_type` field to Modbus over TCP logs to indicate whether the Modbus message was a request or a response. Due to the client/server nature of Modbus over TCP/IP, all messages from the TCP session originator are requests, while all messages from the TCP session responder are responses. Adding this information to the default log surfaces protocol metadata in a way that doesn't require users to understand the Modbus over TCP protocol.
15 lines
943 B
Text
15 lines
943 B
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path modbus
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tid unit func pdu_type exception
|
|
#types time string addr port addr port count count string string string
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.1.1.234 51411 10.10.5.104 502 1119 255 READ_INPUT_REGISTERS REQ -
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.1.1.234 51411 10.10.5.104 502 2606 255 READ_INPUT_REGISTERS RESP -
|
|
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.1.1.234 51411 10.10.5.104 502 6714 255 READ_INPUT_REGISTERS RESP -
|
|
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 10.1.1.234 51411 10.10.5.104 502 12993 255 READ_INPUT_REGISTERS REQ -
|
|
XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 10.1.1.234 51411 10.10.5.104 502 17667 255 READ_INPUT_REGISTERS RESP -
|
|
#close XXXX-XX-XX-XX-XX-XX
|