main.zeek

A very basic DNP3 analysis script that just logs requests and replies.

Namespace:: DNP3
Imports:: base/protocols/conn/removal-hooks.zeek, base/protocols/dnp3/consts.zeek

Summary

Well-known ports for DNP3.

`Log::ID`: `enum`	`DNP3::LOG`
`connection`: `record`	New Fields: `connection` dnp3: `DNP3::Info` `&optional`

Event that can be handled to access the DNP3 record as it is sent on to the logging framework.

`DNP3::finalize_dnp3`: `Conn::RemovalHook`	DNP3 finalization hook.
`DNP3::log_policy`: `Log::PolicyHook`

Type:

set [port]

Attributes:

&redef

Default:

{
   20000/udp,
   20000/tcp
}

Well-known ports for DNP3.

Type:

record

Fields:

fc_request: string &log &optional: The name of the function message in the request.

fc_reply: string &log &optional: The name of the function message in the reply.

iin: count &log &optional: The response’s “internal indication number”.

Event that can be handled to access the DNP3 record as it is sent on to the logging framework.

DNP3 finalization hook. Remaining DNP3 info may get logged when it’s called.