Feature #1495: EtherNet/IP and CIP support - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #1495

closed

KW KW

EtherNet/IP and CIP support

Feature #1495: EtherNet/IP and CIP support

Added by Kevin Wong almost 11 years ago. Updated over 9 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Kevin Wong

Target version:

3.2beta1

Effort:

Difficulty:

Label:

Description

We are implementing support for EtherNet Industrial Protocol(ENIP) and Common Industrial Protocol(CIP) for SCADA. This will provide the ability to write rules for detecting CIP service, class and attribute. As well as detection for the ENIP command (useful for storm rules)

Information on the protocol can be found here:
http://literature.rockwellautomation.com/idc/groups/literature/documents/wp/enet-wp001_-en-p.pdf

Specification (big file!)
http://read.pudn.com/downloads166/ebook/763211/EIP-CIP-V1-1.0.pdf