Feature #1495: EtherNet/IP and CIP support - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #1495

closed

EtherNet/IP and CIP support

Added by Kevin Wong over 9 years ago. Updated about 8 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Kevin Wong

Target version:

3.2beta1

Effort:

Difficulty:

Label:

Description

We are implementing support for EtherNet Industrial Protocol(ENIP) and Common Industrial Protocol(CIP) for SCADA. This will provide the ability to write rules for detecting CIP service, class and attribute. As well as detection for the ENIP command (useful for storm rules)

Information on the protocol can be found here:
http://literature.rockwellautomation.com/idc/groups/literature/documents/wp/enet-wp001_-en-p.pdf

Specification (big file!)
http://read.pudn.com/downloads166/ebook/763211/EIP-CIP-V1-1.0.pdf