# bro and DNP3 decoder

**URL:** <https://community.zeek.org/t/bro-and-dnp3-decoder/4003>\
**Category:** Development\
**Tags:** development\
**Created:** [February 9, 2016, 9:04pm UTC](https://community.zeek.org/t/bro-and-dnp3-decoder/4003 "2016-02-09T21:04:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jeff\_Barber](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@Jeff\_Barber](https://community.zeek.org/u/Jeff_Barber)\
**Post date:** [February 9, 2016, 9:04pm UTC](https://community.zeek.org/t/bro-and-dnp3-decoder/4003/1 "2016-02-09T21:04:43Z")

</div>

Hi

I’m trying to use bro for decoding DNP3 traffic and following the logic through its parser to the various dnp3\_xxx events. (The documentation on how to use the DNP3 events is a bit light but I think I understand what’s happening.) When I try to follow the request objects logic (e.g. as you might get from a DNP3 write command), I can’t see how they’re getting output to the bro script layer at all. Most of them seem to simply dead-end in the parser with no event generated.

I spent a little while looking through the bro branches and came across a branch called topics/hui/dnp3-events that _seems_ to have support for a bunch of additional objects. It was last worked on in February 2014 but I can’t find any hint of it in the master branch.

Just wondering if anyone can clarify. Am I misunderstanding how it works? Or did the code in dnp3-events branch get lost? Or was it never merged? Or never completed?

Thanks!

Addressing to Hui Lin but also including bro-dev in case someone else knows the history.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/bro-and-dnp3-decoder/4003/2 "2022-05-06T15:43:23Z")

</div>