zeek/testing/btest/Traces/modbus
Emmanuele Zambon 05d92dc2a5 Prevent non-Modbus on port 502 to be reported as Modbus
This commit prevents most non-Modbus TCP traffic on port 502 to be
reported as Modbus in conn.log as well as in modbus.log.
To do so, we have introduced two &enforce checks in the Modbus
protocol definition that checks that some specific fields of the
(supposedly) Modbus header are compatible with values specified in
the specs.

To ensure non-regression, with this commit we also introduce a
new btest.

Closes #3962
2024-10-21 14:40:45 +02:00
..
4SICS-GeekLounge-151022-min.pcap BIT-1829: add unit test for modbus parser issue 2018-05-18 09:24:06 -05:00
fuzz-72.trace Adjustments to modbus test cases. 2012-11-12 11:51:42 -06:00
fuzz-1011.trace Adjust modbus register array parsing. 2012-11-12 16:40:16 -06:00
modbus-and-non-modbus-p502.pcap Prevent non-Modbus on port 502 to be reported as Modbus 2024-10-21 14:40:45 +02:00
modbus-eit.pcap Modbus: Add support for Encapsulation Interface Transport (FC=2B) requests and responses 2023-08-07 13:44:37 -07:00
modbus.trace Adjustments to modbus test cases. 2012-11-12 11:51:42 -06:00
modbusBig.pcap Merge remote-tracking branch 'origin/topic/robin/modbus-events-merge' 2014-07-22 17:34:11 -07:00
modbusSmall.pcap add/update test file and baseline result 2014-06-17 21:30:04 -05:00