Feature #2096
Updated by Victor Julien about 7 years ago
Here is an example of the type of event I'm looking for with MODBUS, but this is for DNP3. <pre> {"timestamp":"2015-10-22T04:46:25.989814-0400","flow_id":719070443301326,"pcap_cnt":837127,"event_type":"*dnp3*","src_ip":"192.168.2.166","src_port":2142,"dest_ip":"192.168.88.95","dest_port":20000,"proto":"TCP","dnp3":{"type":"request","control":{"dir":true,"pri":true,"fcb":false,"fcv":false,"function_code":4},"src":1,"dst":1024,"application":{"control":{"fir":true,"fin":true,"con":false,"uns":false,"sequence":1},"function_code":1,"objects":[{"group":60,"variation":2,"qualifier":6,"prefix_code":0,"range_code":6,"start":0,"stop":0,"count":0}],"complete":true}}} </pre> Would like to have similar event_type generated but with MODBUS fields.