base/bif/plugins/Bro_DNP3.events.bif.bro¶
-
GLOBAL
¶
Namespace: | GLOBAL |
---|
Summary¶
Events¶
dnp3_analog_input_16wFlag : event |
Generated for DNP3 objects with the group number 30 and variation number 2 analog input 16 bit with flag |
dnp3_analog_input_16woFlag : event |
Generated for DNP3 objects with the group number 30 and variation number 4 analog input 16 bit without flag |
dnp3_analog_input_32wFlag : event |
Generated for DNP3 objects with the group number 30 and variation number 1 analog input 32 bit with flag |
dnp3_analog_input_32woFlag : event |
Generated for DNP3 objects with the group number 30 and variation number 3 analog input 32 bit without flag |
dnp3_analog_input_DPwFlag : event |
Generated for DNP3 objects with the group number 30 and variation number 6 analog input double precision, float point with flag |
dnp3_analog_input_SPwFlag : event |
Generated for DNP3 objects with the group number 30 and variation number 5 analog input single precision, float point with flag |
dnp3_analog_input_event_16wTime : event |
Generated for DNP3 objects with the group number 32 and variation number 4 analog input event 16 bit with time |
dnp3_analog_input_event_16woTime : event |
Generated for DNP3 objects with the group number 32 and variation number 2 analog input event 16 bit without time |
dnp3_analog_input_event_32wTime : event |
Generated for DNP3 objects with the group number 32 and variation number 3 analog input event 32 bit with time |
dnp3_analog_input_event_32woTime : event |
Generated for DNP3 objects with the group number 32 and variation number 1 analog input event 32 bit without time |
dnp3_analog_input_event_DPwTime : event |
Generated for DNP3 objects with the group number 32 and variation number 8 analog input event double-precisiion float point with time |
dnp3_analog_input_event_DPwoTime : event |
Generated for DNP3 objects with the group number 32 and variation number 6 analog input event double-precision float point without time |
dnp3_analog_input_event_SPwTime : event |
Generated for DNP3 objects with the group number 32 and variation number 7 analog input event single-precision float point with time |
dnp3_analog_input_event_SPwoTime : event |
Generated for DNP3 objects with the group number 32 and variation number 5 analog input event single-precision float point without time |
dnp3_application_request_header : event |
Generated for a DNP3 request header. |
dnp3_application_response_header : event |
Generated for a DNP3 response header. |
dnp3_attribute_common : event |
Generated for DNP3 attributes. |
dnp3_counter_16wFlag : event |
Generated for DNP3 objects with the group number 20 and variation number 2 counter 16 bit with flag |
dnp3_counter_16woFlag : event |
Generated for DNP3 objects with the group number 20 and variation number 6 counter 16 bit without flag |
dnp3_counter_32wFlag : event |
Generated for DNP3 objects with the group number 20 and variation number 1 counter 32 bit with flag |
dnp3_counter_32woFlag : event |
Generated for DNP3 objects with the group number 20 and variation number 5 counter 32 bit without flag |
dnp3_crob : event |
Generated for DNP3 objects with the group number 12 and variation number 1 CROB: control relay output block |
dnp3_debug_byte : event |
Debugging event generated by the DNP3 analyzer. |
dnp3_file_transport : event |
g70 |
dnp3_frozen_analog_input_16wFlag : event |
Generated for DNP3 objects with the group number 31 and variation number 2 frozen analog input 16 bit with flag |
dnp3_frozen_analog_input_16wTime : event |
Generated for DNP3 objects with the group number 31 and variation number 4 frozen analog input 16 bit with time-of-freeze |
dnp3_frozen_analog_input_16woFlag : event |
Generated for DNP3 objects with the group number 31 and variation number 6 frozen analog input 16 bit without flag |
dnp3_frozen_analog_input_32wFlag : event |
Generated for DNP3 objects with the group number 31 and variation number 1 frozen analog input 32 bit with flag |
dnp3_frozen_analog_input_32wTime : event |
Generated for DNP3 objects with the group number 31 and variation number 3 frozen analog input 32 bit with time-of-freeze |
dnp3_frozen_analog_input_32woFlag : event |
Generated for DNP3 objects with the group number 31 and variation number 5 frozen analog input 32 bit without flag |
dnp3_frozen_analog_input_DPwFlag : event |
Generated for DNP3 objects with the group number 31 and variation number 8 frozen analog input double-precision, float point with flag |
dnp3_frozen_analog_input_SPwFlag : event |
Generated for DNP3 objects with the group number 31 and variation number 7 frozen analog input single-precision, float point with flag |
dnp3_frozen_analog_input_event_16wTime : event |
Generated for DNP3 objects with the group number 33 and variation number 4 frozen analog input event 16 bit with time |
dnp3_frozen_analog_input_event_16woTime : event |
Generated for DNP3 objects with the group number 33 and variation number 2 frozen analog input event 16 bit without time |
dnp3_frozen_analog_input_event_32wTime : event |
Generated for DNP3 objects with the group number 33 and variation number 3 frozen analog input event 32 bit with time |
dnp3_frozen_analog_input_event_32woTime : event |
Generated for DNP3 objects with the group number 33 and variation number 1 frozen analog input event 32 bit without time |
dnp3_frozen_analog_input_event_DPwTime : event |
Generated for DNP3 objects with the group number 34 and variation number 8 frozen analog input event double-precision float point with time |
dnp3_frozen_analog_input_event_DPwoTime : event |
Generated for DNP3 objects with the group number 33 and variation number 6 frozen analog input event double-precision float point without time |
dnp3_frozen_analog_input_event_SPwTime : event |
Generated for DNP3 objects with the group number 33 and variation number 7 frozen analog input event single-precision float point with time |
dnp3_frozen_analog_input_event_SPwoTime : event |
Generated for DNP3 objects with the group number 33 and variation number 5 frozen analog input event single-precision float point without time |
dnp3_frozen_counter_16wFlag : event |
Generated for DNP3 objects with the group number 21 and variation number 2 frozen counter 16 bit with flag |
dnp3_frozen_counter_16wFlagTime : event |
Generated for DNP3 objects with the group number 21 and variation number 6 frozen counter 16 bit with flag and time |
dnp3_frozen_counter_16woFlag : event |
Generated for DNP3 objects with the group number 21 and variation number 10 frozen counter 16 bit without flag |
dnp3_frozen_counter_32wFlag : event |
Generated for DNP3 objects with the group number 21 and variation number 1 frozen counter 32 bit with flag |
dnp3_frozen_counter_32wFlagTime : event |
Generated for DNP3 objects with the group number 21 and variation number 5 frozen counter 32 bit with flag and time |
dnp3_frozen_counter_32woFlag : event |
Generated for DNP3 objects with the group number 21 and variation number 9 frozen counter 32 bit without flag |
dnp3_header_block : event |
Generated for an additional header that the DNP3 analyzer passes to the script-level. |
dnp3_object_header : event |
Generated for the object header found in both DNP3 requests and responses. |
dnp3_object_prefix : event |
Generated for the prefix before a DNP3 object. |
dnp3_pcb : event |
Generated for DNP3 objects with the group number 12 and variation number 2 PCB: Pattern Control Block |
dnp3_response_data_object : event |
Generated for a DNP3 “Response_Data_Object”. |
Detailed Interface¶
Events¶
-
dnp3_analog_input_16wFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value:count
)Generated for DNP3 objects with the group number 30 and variation number 2 analog input 16 bit with flag
-
dnp3_analog_input_16woFlag
¶ Type: event
(c:connection
, is_orig:bool
, value:count
)Generated for DNP3 objects with the group number 30 and variation number 4 analog input 16 bit without flag
-
dnp3_analog_input_32wFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value:count
)Generated for DNP3 objects with the group number 30 and variation number 1 analog input 32 bit with flag
-
dnp3_analog_input_32woFlag
¶ Type: event
(c:connection
, is_orig:bool
, value:count
)Generated for DNP3 objects with the group number 30 and variation number 3 analog input 32 bit without flag
-
dnp3_analog_input_DPwFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value_low:count
, value_high:count
)Generated for DNP3 objects with the group number 30 and variation number 6 analog input double precision, float point with flag
-
dnp3_analog_input_SPwFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value:count
)Generated for DNP3 objects with the group number 30 and variation number 5 analog input single precision, float point with flag
-
dnp3_analog_input_event_16wTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value:count
, time48:count
)Generated for DNP3 objects with the group number 32 and variation number 4 analog input event 16 bit with time
-
dnp3_analog_input_event_16woTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value:count
)Generated for DNP3 objects with the group number 32 and variation number 2 analog input event 16 bit without time
-
dnp3_analog_input_event_32wTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value:count
, time48:count
)Generated for DNP3 objects with the group number 32 and variation number 3 analog input event 32 bit with time
-
dnp3_analog_input_event_32woTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value:count
)Generated for DNP3 objects with the group number 32 and variation number 1 analog input event 32 bit without time
-
dnp3_analog_input_event_DPwTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value_low:count
, value_high:count
, time48:count
)Generated for DNP3 objects with the group number 32 and variation number 8 analog input event double-precisiion float point with time
-
dnp3_analog_input_event_DPwoTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value_low:count
, value_high:count
)Generated for DNP3 objects with the group number 32 and variation number 6 analog input event double-precision float point without time
-
dnp3_analog_input_event_SPwTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value:count
, time48:count
)Generated for DNP3 objects with the group number 32 and variation number 7 analog input event single-precision float point with time
-
dnp3_analog_input_event_SPwoTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, value:count
)Generated for DNP3 objects with the group number 32 and variation number 5 analog input event single-precision float point without time
-
dnp3_application_request_header
¶ Type: event
(c:connection
, is_orig:bool
, application:count
, fc:count
)Generated for a DNP3 request header.
C: The connection the DNP3 communication is part of. Is_orig: True if this reflects originator-side activity. Fc: function code.
-
dnp3_application_response_header
¶ Type: event
(c:connection
, is_orig:bool
, application:count
, fc:count
, iin:count
)Generated for a DNP3 response header.
C: The connection the DNP3 communication is part of. Is_orig: True if this reflects originator-side activity. Fc: function code. Iin: internal indication number.
-
dnp3_attribute_common
¶ Type: event
(c:connection
, is_orig:bool
, data_type_code:count
, leng:count
, attribute_obj:string
)Generated for DNP3 attributes.
-
dnp3_counter_16wFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, count_value:count
)Generated for DNP3 objects with the group number 20 and variation number 2 counter 16 bit with flag
-
dnp3_counter_16woFlag
¶ Type: event
(c:connection
, is_orig:bool
, count_value:count
)Generated for DNP3 objects with the group number 20 and variation number 6 counter 16 bit without flag
-
dnp3_counter_32wFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, count_value:count
)Generated for DNP3 objects with the group number 20 and variation number 1 counter 32 bit with flag
-
dnp3_counter_32woFlag
¶ Type: event
(c:connection
, is_orig:bool
, count_value:count
)Generated for DNP3 objects with the group number 20 and variation number 5 counter 32 bit without flag
-
dnp3_crob
¶ Type: event
(c:connection
, is_orig:bool
, control_code:count
, count8:count
, on_time:count
, off_time:count
, status_code:count
)Generated for DNP3 objects with the group number 12 and variation number 1
CROB: control relay output block
-
dnp3_debug_byte
¶ Type: event
(c:connection
, is_orig:bool
, debug:string
)Debugging event generated by the DNP3 analyzer. The “Debug_Byte” binpac unit generates this for unknown “cases”. The user can use it to debug the byte string to check what caused the malformed network packets.
-
dnp3_file_transport
¶ Type: event
(c:connection
, is_orig:bool
, file_handle:count
, block_num:count
, file_data:string
)g70
-
dnp3_frozen_analog_input_16wFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value:count
)Generated for DNP3 objects with the group number 31 and variation number 2 frozen analog input 16 bit with flag
-
dnp3_frozen_analog_input_16wTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value:count
, time48:count
)Generated for DNP3 objects with the group number 31 and variation number 4 frozen analog input 16 bit with time-of-freeze
-
dnp3_frozen_analog_input_16woFlag
¶ Type: event
(c:connection
, is_orig:bool
, frozen_value:count
)Generated for DNP3 objects with the group number 31 and variation number 6 frozen analog input 16 bit without flag
-
dnp3_frozen_analog_input_32wFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value:count
)Generated for DNP3 objects with the group number 31 and variation number 1 frozen analog input 32 bit with flag
-
dnp3_frozen_analog_input_32wTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value:count
, time48:count
)Generated for DNP3 objects with the group number 31 and variation number 3 frozen analog input 32 bit with time-of-freeze
-
dnp3_frozen_analog_input_32woFlag
¶ Type: event
(c:connection
, is_orig:bool
, frozen_value:count
)Generated for DNP3 objects with the group number 31 and variation number 5 frozen analog input 32 bit without flag
-
dnp3_frozen_analog_input_DPwFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value_low:count
, frozen_value_high:count
)Generated for DNP3 objects with the group number 31 and variation number 8 frozen analog input double-precision, float point with flag
-
dnp3_frozen_analog_input_SPwFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value:count
)Generated for DNP3 objects with the group number 31 and variation number 7 frozen analog input single-precision, float point with flag
-
dnp3_frozen_analog_input_event_16wTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value:count
, time48:count
)Generated for DNP3 objects with the group number 33 and variation number 4 frozen analog input event 16 bit with time
-
dnp3_frozen_analog_input_event_16woTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value:count
)Generated for DNP3 objects with the group number 33 and variation number 2 frozen analog input event 16 bit without time
-
dnp3_frozen_analog_input_event_32wTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value:count
, time48:count
)Generated for DNP3 objects with the group number 33 and variation number 3 frozen analog input event 32 bit with time
-
dnp3_frozen_analog_input_event_32woTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value:count
)Generated for DNP3 objects with the group number 33 and variation number 1 frozen analog input event 32 bit without time
-
dnp3_frozen_analog_input_event_DPwTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value_low:count
, frozen_value_high:count
, time48:count
)Generated for DNP3 objects with the group number 34 and variation number 8 frozen analog input event double-precision float point with time
-
dnp3_frozen_analog_input_event_DPwoTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value_low:count
, frozen_value_high:count
)Generated for DNP3 objects with the group number 33 and variation number 6 frozen analog input event double-precision float point without time
-
dnp3_frozen_analog_input_event_SPwTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value:count
, time48:count
)Generated for DNP3 objects with the group number 33 and variation number 7 frozen analog input event single-precision float point with time
-
dnp3_frozen_analog_input_event_SPwoTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, frozen_value:count
)Generated for DNP3 objects with the group number 33 and variation number 5 frozen analog input event single-precision float point without time
-
dnp3_frozen_counter_16wFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, count_value:count
)Generated for DNP3 objects with the group number 21 and variation number 2 frozen counter 16 bit with flag
-
dnp3_frozen_counter_16wFlagTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, count_value:count
, time48:count
)Generated for DNP3 objects with the group number 21 and variation number 6 frozen counter 16 bit with flag and time
-
dnp3_frozen_counter_16woFlag
¶ Type: event
(c:connection
, is_orig:bool
, count_value:count
)Generated for DNP3 objects with the group number 21 and variation number 10 frozen counter 16 bit without flag
-
dnp3_frozen_counter_32wFlag
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, count_value:count
)Generated for DNP3 objects with the group number 21 and variation number 1 frozen counter 32 bit with flag
-
dnp3_frozen_counter_32wFlagTime
¶ Type: event
(c:connection
, is_orig:bool
, flag:count
, count_value:count
, time48:count
)Generated for DNP3 objects with the group number 21 and variation number 5 frozen counter 32 bit with flag and time
-
dnp3_frozen_counter_32woFlag
¶ Type: event
(c:connection
, is_orig:bool
, count_value:count
)Generated for DNP3 objects with the group number 21 and variation number 9 frozen counter 32 bit without flag
-
dnp3_header_block
¶ Type: event
(c:connection
, is_orig:bool
, len:count
, ctrl:count
, dest_addr:count
, src_addr:count
)Generated for an additional header that the DNP3 analyzer passes to the script-level. This header mimics the DNP3 transport-layer yet is only passed once for each sequence of DNP3 records (which are otherwise reassembled and treated as a single entity).
C: The connection the DNP3 communication is part of. Is_orig: True if this reflects originator-side activity. Len: the “length” field in the DNP3 Pseudo Link Layer. Ctrl: the “control” field in the DNP3 Pseudo Link Layer. Dest_addr: the “destination” field in the DNP3 Pseudo Link Layer. Src_addr: the “source” field in the DNP3 Pseudo Link Layer.
-
dnp3_object_header
¶ Type: event
(c:connection
, is_orig:bool
, obj_type:count
, qua_field:count
, number:count
, rf_low:count
, rf_high:count
)Generated for the object header found in both DNP3 requests and responses.
C: The connection the DNP3 communication is part of. Is_orig: True if this reflects originator-side activity. Obj_type: type of object, which is classified based on an 8-bit group number and an 8-bit variation number. Qua_field: qualifier field. Number: TODO. Rf_low: the structure of the range field depends on the qualified field. In some cases, the range field contains only one logic part, e.g., number of objects, so only rf_low contains useful values. Rf_high: in some cases, the range field contains two logic parts, e.g., start index and stop index, so rf_low contains the start index while rf_high contains the stop index.
-
dnp3_object_prefix
¶ Type: event
(c:connection
, is_orig:bool
, prefix_value:count
)Generated for the prefix before a DNP3 object. The structure and the meaning of the prefix are defined by the qualifier field.
C: The connection the DNP3 communication is part of. Is_orig: True if this reflects originator-side activity. Prefix_value: The prefix.
-
dnp3_pcb
¶ Type: event
(c:connection
, is_orig:bool
, control_code:count
, count8:count
, on_time:count
, off_time:count
, status_code:count
)Generated for DNP3 objects with the group number 12 and variation number 2
PCB: Pattern Control Block
-
dnp3_response_data_object
¶ Type: event
(c:connection
, is_orig:bool
, data_value:count
)Generated for a DNP3 “Response_Data_Object”. The “Response_Data_Object” contains two parts: object prefix and object data. In most cases, object data are defined by new record types. But in a few cases, object data are directly basic types, such as int16, or int8; thus we use an additional data_value to record the values of those object data.
C: The connection the DNP3 communication is part of. Is_orig: True if this reflects originator-side activity. Data_value: The value for those objects that carry their information here directly.