missing fields in conn.log

Zeek
1

I’m running bro 2.4 on an industrial control system pcap file. According to , https://www.bro.org/sphinx-git/scripts/base/init-bare.bro.html#type-connection, there are a number of optional fields in conn.log. However, conn.log does not seem to include any of the optional fields.

For example, my test data includes MODBUS traffic, and one of the optional conn fields is “modbus”. I’ve checked loaded-scripts.log: modbus/main.bro is loaded. Also modbus.log is being output and populated. conn.log, however, does not include a “modbus” field.

what do I have to do for conn.log to include the optional fields?

2

Eep! You just discovered a bug. The analyzer is never validating the protocol successfully (which is required in order for it to show up in conn.log). I’m going to do a patch now that fixes it.

“modbus” should be showing up in the “service” field of conn.log (which represents analyzers that were attached and successfully analyzed a connection.

  .Seth

3

awesome! Thanks.

Best Regards,

Earl Eiland,