# bro and DNP3 decoder **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [February 9, 2016, 9:49pm UTC](https://community.zeek.org/t/bro-and-dnp3-decoder/4004 "2016-02-09T21:49:25Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\ **Post date:** [February 9, 2016, 9:49pm UTC](https://community.zeek.org/t/bro-and-dnp3-decoder/4004/1 "2016-02-09T21:49:25Z")
​Hi Jeff, I think the master branch should contain what we wrote before. I run some simple DNP3 test cases included in Bro from master branch and I do see the simple print out message. Does running your pcap generate any error message? Do you mind sharing the trace that you are using for me to take a look at what is going on?​ Best, Hui Lin ---
**Author:** ![Jeff\_Barber](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@Jeff\_Barber](https://community.zeek.org/u/Jeff_Barber)\ **Post date:** [February 9, 2016, 11:19pm UTC](https://community.zeek.org/t/bro-and-dnp3-decoder/4004/2 "2016-02-09T23:19:28Z")
It’s only particular object types and especially those in the _request_ that I’m referring to. I do see response objects fine. I wish I had better pcaps to share, but I’m having trouble finding those myself. 🙂 I have attached one I found on the web which, according to wireshark, has a single write of object type 50, variation 01. It produces these events: header\_block, [orig\_h=127.0.0.1, orig\_p=37712/tcp, resp\_h=127.0.0.1, resp\_p=20000/tcp, vlan=0, inner\_vlan=0], T, Start, 25605, Len, 18, Ctrl, 196, Dst, 3, Src, 4 application\_request\_header, [orig\_h=127.0.0.1, orig\_p=37712/tcp, resp\_h=127.0.0.1, resp\_p=20000/tcp, vlan=0, inner\_vlan=0], T, App, 193, FC, 2 object\_header, [orig\_h=127.0.0.1, orig\_p=37712/tcp, resp\_h=127.0.0.1, resp\_p=20000/tcp, vlan=0, inner\_vlan=0], T, OT, 12801, Qua, 7, Num, 1, RF, 1, 0 object\_prefix, [orig\_h=127.0.0.1, orig\_p=37712/tcp, resp\_h=127.0.0.1, resp\_p=20000/tcp, vlan=0, inner\_vlan=0], T, PREF, 0 (Mnemonics included except for the first two fields which are always c$id and is\_orig.) but there’s no event giving the content of that object type. I’m not getting any error messages, but just in looking at the .pac files in the dnp3 directory, I see the code apparently parsing all the unique types below, but it doesn’t seem to be generating events for any of them. At least some of those _do_ seem to have had events generated for them in that dnp3-events branch code. AnaOutStatus32 AnaOutStatus16 AnaOutStatusSP AnaOutStatusDP AnaOut32 AnaOut16 AnaOutSP AnaOutDP AnaOutEve32woTime AnaOutEve16woTime AnaOutEve32wTime AnaOutEve16wTime AnaOutEveSPwoTime AnaOutEveDPwoTime AnaOutEveSPwTime AnaOutEveDPwTime Thanks. [DNP3-Write.pcap](https://community.zeek.org/uploads/short-url/oYNffXyuGZ1dTE3FhfWWSFNj1Be.pcap) (610 Bytes) ---
**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\ **Post date:** [February 10, 2016, 9:46pm UTC](https://community.zeek.org/t/bro-and-dnp3-decoder/4004/3 "2016-02-10T21:46:59Z")
Hi Jeff, I think in the current master, we do support the function code of “write” in the master branch, but not the type of objects used in the given pcap file. In that development branch you mentioned, I think I added as many as event handlers I can. But we could not merge them into the master branch, as at that time, we could not find any sufficient test pcap files that can trigger the event handlers. Probably it is the time for me to search again for the test pcap files again from the Internet. The pacp that you provide may not be used as a test case, as it looks like a truncated communication, i.e., a request without responses. If you have any test pcap, feel free to share with us if that is appropriate for you. Also, if you need to use these event handlers, I think that you can also go for that development branch. And also feel free to let me know if there is any bug in that branch, I can work to fix them. Best, Hui Lin ---
**Author:** ![Jeff\_Barber](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@Jeff\_Barber](https://community.zeek.org/u/Jeff_Barber)\ **Post date:** [February 10, 2016, 10:02pm UTC](https://community.zeek.org/t/bro-and-dnp3-decoder/4004/4 "2016-02-10T22:02:05Z")
Thanks a lot for the response. That makes sense. If I find some packet captures for this stuff, I will share them if I can. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/bro-and-dnp3-decoder/4004/5 "2022-05-06T15:43:24Z")