suricata

Commit Graph

Author	SHA1	Message	Date
David DIALLO	c2236ea2b3	modbus: Support Unit Identifier When destination IP address does not suffice to uniquely identify the Modbus/TCP device. Some Modbus/TCP devices act as gateways to other Modbus/TCP devices that are behind this gateways.	8 years ago
Ken Steele	18e2de320b	Coding style cleanup in detect-modbus files.	11 years ago
DIALLO David	b3bf2f9939	Detect: Add Modbus keyword management Add the modbus.function and subfunction) keywords for public function match in rules (Modbus layer). Matching based on code function, and if necessary, sub-function code or based on category (assigned, unassigned, public, user or reserved) and negation is permitted. Add the modbus.access keyword for read/write Modbus function match in rules (Modbus layer). Matching based on access type (read or write), and/or function type (discretes, coils, input or holding) and, if necessary, read or write address access, and, if necessary, value to write. For address and value matching, "<", ">" and "<>" is permitted. Based on TLS source code and file size source code (address and value matching). Signed-off-by: David DIALLO <diallo@et.esia.fr>	11 years ago

Author

SHA1

Message

Date

David DIALLO

c2236ea2b3

modbus: Support Unit Identifier

When destination IP address does not suffice to uniquely identify
the Modbus/TCP device.

Some Modbus/TCP devices act as gateways to other Modbus/TCP devices
that are behind this gateways.

Ken Steele

18e2de320b

Coding style cleanup in detect-modbus files.

DIALLO David

b3bf2f9939

Detect: Add Modbus keyword management

Add the modbus.function and subfunction) keywords for public function match in rules (Modbus layer).
Matching based on code function, and if necessary, sub-function code
or based on category (assigned, unassigned, public, user or reserved)
and negation is permitted.

Add the modbus.access keyword for read/write Modbus function match in rules (Modbus layer).
Matching based on access type (read or write),
and/or function type (discretes, coils, input or holding)
and, if necessary, read or write address access,
and, if necessary, value to write.
For address and value matching, "<", ">" and "<>" is permitted.

Based on TLS source code and file size source code (address and value matching).

Signed-off-by: David DIALLO <diallo@et.esia.fr>

3 Commits (d6460392c51b2f6cbbfc6316eb96e0926ddc1d25)