diff options
Diffstat (limited to 'bro-script/pasad-parsed.bro')
-rw-r--r-- | bro-script/pasad-parsed.bro | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/bro-script/pasad-parsed.bro b/bro-script/pasad-parsed.bro new file mode 100644 index 0000000..7fcc905 --- /dev/null +++ b/bro-script/pasad-parsed.bro @@ -0,0 +1,46 @@ +## Implementation that outputs pairs of register IDs and values. +## Otherwise, the same restrictions as with pasad-simple apply. Additionally, +## the correct register count is not checked and might lead to indexing errors. + +module Pasad; + +export { + redef enum Log::ID += { LOG }; + + type Info: record { + start_address: count &log; + quantity: count &log; + }; + + type Entry: record { + address: count &log; + register: count &log; + }; +} + +redef record connection += { + pasad: Info &optional; +}; + +event bro_init() &priority=5 + { + Log::create_stream(Pasad::LOG, [$columns=Entry, $path="pasad-parsed"]); + } + +event modbus_read_holding_registers_request(c: connection, headers: ModbusHeaders, start_address: count, quantity: count) + { + c$pasad = [$start_address=start_address, $quantity=quantity]; + } + +event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters) + { + local i = 0; + while ( i < c$pasad$quantity ) + { + local address = c$pasad$start_address + i; + local mb_register = registers[i]; + local entry = Entry($address=address, $register=mb_register); + Log::write(Pasad::LOG, entry); + ++i; + } + } |