main.zeek

A very basic DNP3 analysis script that just logs requests and replies.

Namespace: DNP3
Imports: base/protocols/conn/removal-hooks.zeek, base/protocols/dnp3/consts.zeek

Summary

`Log::ID`: `enum`	`DNP3::LOG`
`connection`: `record`	New Fields `connection` dnp3: `DNP3::Info` `&optional`
`likely_server_ports`: `set` `&redef`

Event that can be handled to access the DNP3 record as it is sent on to the logging framework.

`DNP3::finalize_dnp3`: `Conn::RemovalHook`	DNP3 finalization hook.
`DNP3::log_policy`: `Log::PolicyHook`

Type

record

ts: time &log: Time of the request.
uid: string &log: Unique identifier for the connection.
id: conn_id &log: Identifier for the connection.
fc_request: string &log &optional: The name of the function message in the request.
fc_reply: string &log &optional: The name of the function message in the reply.
iin: count &log &optional: The response’s “internal indication number”.

Event that can be handled to access the DNP3 record as it is sent on to the logging framework.

DNP3 finalization hook. Remaining DNP3 info may get logged when it’s called.