zeek/scripts/base/protocols/dnp3/dpd.sig
Jon Siwek b83d4a9c84 Fix some things in DNP3 UDP analyzer.
- DeliverPacket override had a wrong parameter.
- Change the DNP3 plugin to provide both UDP and TCP analyzer versions.
- Add a DPD signature.
2014-08-06 15:41:53 -05:00

15 lines
243 B
Standard ML

# DNP3 packets always starts with 0x05 0x64 .
signature dpd_dnp3_server {
ip-proto == tcp
payload /\x05\x64/
tcp-state responder
enable "dnp3"
}
signature dpd_dnp3_server_udp {
ip-proto == udp
payload /\x05\x64/
enable "dnp3_udp"
}