main.bro¶

A very basic DNP3 analysis script that just logs requests and replies.

Namespace:	DNP3
Imports:	base/protocols/dnp3/consts.bro
Source File:	`/scripts/base/protocols/dnp3/main.bro`

Summary¶

DNP3::Info: record

`Log::ID`: `enum`
`connection`: `record`
`likely_server_ports`: `set` `&redef`

DNP3::log_dnp3: event Event that can be handled to access the DNP3 record as it is sent on to the logging framework.

DNP3::Info¶

Type:

Type:	`record` ts: `time` `&log` Time of the request. uid: `string` `&log` Unique identifier for the connection. id: `conn_id` `&log` Identifier for the connection. fc_request: `string` `&log` `&optional` The name of the function message in the request. fc_reply: `string` `&log` `&optional` The name of the function message in the reply. iin: `count` `&log` `&optional` The response’s “internal indication number”.

ts: time &log: Time of the request.
uid: string &log: Unique identifier for the connection.
id: conn_id &log: Identifier for the connection.
fc_request: string &log &optional: The name of the function message in the request.
fc_reply: string &log &optional: The name of the function message in the reply.
iin: count &log &optional: The response’s “internal indication number”.

DNP3::log_dnp3¶

Type:	`event` (rec: `DNP3::Info`)

Event that can be handled to access the DNP3 record as it is sent on to the logging framework.