Modbus parser enhancement

Zeek
5

Hi,
Besides getting function and sub function code,( func code 0x8 and func code 0x2B has sub function code support)

  1. we may need to support the way to get pdu length in case of read file record ( func code 0x14)

  2. MBAP(modbus applucation PDU) header’s transaction ID, data length, execution code, address if any etc.

  3. There should be support extracting delimeter from PDU in case of func code 0x8 and sub function code 0x01

  4. For file related access ( read or write), we need to extract File number, therefore if we know the function code, there should be option to get all possible values it returns alongside . ( eg.
    If FC == 43 and sub FC == 14 :
    Source address = extract from PDU)

Thanks
Biswa