Project

General

Profile

Actions
Copy link

Feature #2096

closed

eve: event_type for MODBUS

Added by Austin Taylor over 7 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Simon Dugas
Target version:
7.0.0-beta1
Effort:
Difficulty:
Label:

Description

Here is an example of the type of event I'm looking for with MODBUS, but this is for DNP3.

{"timestamp":"2015-10-22T04:46:25.989814-0400","flow_id":719070443301326,"pcap_cnt":837127,"event_type":"*dnp3*","src_ip":"192.168.2.166","src_port":2142,"dest_ip":"192.168.88.95","dest_port":20000,"proto":"TCP","dnp3":{"type":"request","control":{"dir":true,"pri":true,"fcb":false,"fcv":false,"function_code":4},"src":1,"dst":1024,"application":{"control":{"fir":true,"fin":true,"con":false,"uns":false,"sequence":1},"function_code":1,"objects":[{"group":60,"variation":2,"qualifier":6,"prefix_code":0,"range_code":6,"start":0,"stop":0,"count":0}],"complete":true}}}

Would like to have similar event_type generated but with MODBUS fields.

Related issues 2 (0 open — 2 closed)

Related to Suricata - Optimization #2782: Convert Modbus from C to RustRejectedActions
Related to Suricata - Feature #3957: Convert protocol to Rust: ModbusClosedSimon DugasActions
Actions
Copy link
 #1

Updated by Victor Julien over 7 years ago

  • Description updated (diff)
  • Assignee set to Anonymous
  • Priority changed from High to Normal
  • Target version changed from 70 to TBD
Actions
Copy link
 #2

Updated by Victor Julien over 7 years ago

  • Subject changed from Add event_type for MODBUS to eve: event_type for MODBUS
Actions
Copy link
 #3

Updated by Eric Leblond over 7 years ago

  • Assignee changed from Anonymous to Eric Leblond
Actions
Copy link
 #4

Updated by Victor Julien almost 5 years ago

Actions
Copy link
 #5

Updated by Victor Julien over 4 years ago

  • Assignee changed from Eric Leblond to OISF Dev
Actions
Copy link
 #6

Updated by Shivani Bhardwaj almost 4 years ago

  • Related to Feature #3957: Convert protocol to Rust: Modbus added
Actions
Copy link
 #7

Updated by Simon Dugas almost 4 years ago

Sample output is shown in this pull request which may implement this ticket:
- https://github.com/OISF/suricata/pull/5750

Actions
Copy link
 #8

Updated by Philippe Antoine over 3 years ago

  • Status changed from New to In Review
Actions
Copy link
 #9

Updated by Victor Julien over 3 years ago

  • Status changed from In Review to Closed
  • Assignee changed from OISF Dev to Simon Dugas
  • Target version changed from TBD to 7.0.0-beta1
Actions
Copy link

Also available in: Atom PDF