Need help to print data_value in zeek

[biswa]

Hi,
I need help to print data_value of event dnp3_response_data_object() in dnp3/events.bif.
This event is generated from type Response_Data_Object() of dnp3-objects.pac. I want to know how can I fetch these attributes using the above event. Please suggest.
Thanks
Biswa

[awelzel]

Hello @biswa , it’s not immediately clear what you want to achive.

Have you looked if the dnp3_attribute_common() event would cover your case? Are you looking for an event that gives you just the raw data of a Response_Data_Object? Can you sketch the declaration of the event or a bit of scripting code what you’re looking to do?

Thanks,
Arne

[awelzel]

Ah, this is probably all related to your previous post:

How to new events for parsed parameters from dnp3 binpac

Hi, I was trying to understand the existing binpac framework (as DNP3 protocol parser is is binpac only ). I can see zeek_dnp3.events.bif.zeek has many events supported which can be called from zeek script and we can fetch parameters and log accordingly. However, in dnp3_objects.pac has deadband g34 analog input block inside Response_Data_Object() but I can’t able to understand how to get this value in zeek script and log it . Similarly there are many fields which I think parsed properly in thi…

If the existing parser doesn’t provide you with the events you need and you have pcaps available for testing, you could start looking at extending the parser and contributing back

[biswa]

Thanks a lot @awelzel for the reply. I have started adding few events in the existing parser, I have few doubts.

1. When I change anything in zeek related files and try to make then it starts again from configure and make from scratch. Is there any option to get rid of this and compile only the changed files?

2. You mentioned about dnp3_attribute_common(), if you check dnp3-objects.pac, you will see in request and response data object handling these common attributes are mentioned under “device attribute g0” and I am assuming I will get these value only in the script but I am trying to extract deadband which is defined as ai_dead_16, ai_dead_32 in the same file under “analog input g34”. I am not sure if I get these values using this event dnp3_attribute_common().

3. There is another event in events.bif in dnp3 called dnp3_response_data_object() with argument data_value which states “the value for those objects that carry their information here directly”. Firstly the meaning is not clear to me and secondly how to print/dump such data_value in zeek scripts is not clear. Is it a vector of values or just a value ? As it’s type is count… why I am interested because I think deadband values may be extracted (ai_dead, ai_dead_16 of dnp3-objects.pac). Please help in this area.

4. There are few more fields needs to be extracted from dnp3 application pdu such as time value in g50 or device name/identifier in g0v247 , fragment size in g0v240 etc are not there . So I am trying to add these things. If you can help here someway will be very much appreciated.

Thanks
Biswa