# Need help to print data\_value in zeek **URL:** \ **Category:** Zeek\ **Tags:** development\ **Created:** [April 4, 2023, 1:16pm UTC](https://community.zeek.org/t/need-help-to-print-data-value-in-zeek/6966 "2023-04-04T13:16:36Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\ **Post date:** [April 4, 2023, 1:16pm UTC](https://community.zeek.org/t/need-help-to-print-data-value-in-zeek/6966/1 "2023-04-04T13:16:36Z")
Hi, I need help to print data\_value of event dnp3\_response\_data\_object() in dnp3/events.bif. This event is generated from type Response\_Data\_Object() of dnp3-objects.pac. I want to know how can I fetch these attributes using the above event. Please suggest. Thanks Biswa ---
**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\ **Post date:** [April 6, 2023, 8:52am UTC](https://community.zeek.org/t/need-help-to-print-data-value-in-zeek/6966/2 "2023-04-06T08:52:07Z")
Hello @biswa , it’s not immediately clear what you want to achive. Have you looked if the `dnp3_attribute_common()` event would cover your case? Are you looking for an event that gives you just the raw data of a Response\_Data\_Object? Can you sketch the declaration of the event or a bit of scripting code what you’re looking to do? Thanks, Arne ---
**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\ **Post date:** [April 6, 2023, 8:54am UTC](https://community.zeek.org/t/need-help-to-print-data-value-in-zeek/6966/3 "2023-04-06T08:54:41Z")
Ah, this is probably all related to your previous post: > [@How to new events for parsed parameters from dnp3 binpac](https://community.zeek.org/t/how-to-new-events-for-parsed-parameters-from-dnp3-binpac/6965): > > Hi, I was trying to understand the existing binpac framework (as DNP3 protocol parser is is binpac only ). I can see zeek\_dnp3.events.bif.zeek has many events supported which can be called from zeek script and we can fetch parameters and log accordingly. However, in dnp3\_objects.pac has deadband g34 analog input block inside Response\_Data\_Object() but I can’t able to understand how to get this value in zeek script and log it . Similarly there are many fields which I think parsed properly in thi… If the existing parser doesn’t provide you with the events you need and you have pcaps available for testing, you could start looking at extending the parser and contributing back 🙂 ---
**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\ **Post date:** [April 7, 2023, 4:23pm UTC](https://community.zeek.org/t/need-help-to-print-data-value-in-zeek/6966/4 "2023-04-07T16:23:41Z")
Thanks a lot @awelzel for the reply. I have started adding few events in the existing parser, I have few doubts. 1. When I change anything in zeek related files and try to make then it starts again from configure and make from scratch. Is there any option to get rid of this and compile only the changed files? 2. You mentioned about dnp3\_attribute\_common(), if you check dnp3-objects.pac, you will see in request and response data object handling these common attributes are mentioned under “device attribute g0” and I am assuming I will get these value only in the script but I am trying to extract deadband which is defined as ai\_dead\_16, ai\_dead\_32 in the same file under “analog input g34”. I am not sure if I get these values using this event dnp3\_attribute\_common(). 3. There is another event in events.bif in dnp3 called dnp3\_response\_data\_object() with argument data\_value which states “the value for those objects that carry their information here directly”. Firstly the meaning is not clear to me and secondly how to print/dump such data\_value in zeek scripts is not clear. Is it a vector of values or just a value ? As it’s type is count… why I am interested because I think deadband values may be extracted (ai\_dead, ai\_dead\_16 of dnp3-objects.pac). Please help in this area. 4. There are few more fields needs to be extracted from dnp3 application pdu such as time value in g50 or device name/identifier in g0v247 , fragment size in g0v240 etc are not there . So I am trying to add these things. If you can help here someway will be very much appreciated. Thanks Biswa ---
**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\ **Post date:** [June 15, 2023, 12:41pm UTC](https://community.zeek.org/t/need-help-to-print-data-value-in-zeek/6966/5 "2023-06-15T12:41:28Z")
Hi @awelzel , any pointers regarding these doubts would be very helpful. Query 1 is related to compilation, whereas 2,3 is related to printing attr\_obj, data\_value format and 4 is related to enhancement for missing fields. Thanks Biswa ---
**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\ **Post date:** [June 16, 2023, 1:13pm UTC](https://community.zeek.org/t/need-help-to-print-data-value-in-zeek/6966/6 "2023-06-16T13:13:03Z")
Hello @biswa - this went under. > When I change anything in zeek related files and try to make then it starts again from configure and make from scratch. Is there any option to get rid of this and compile only the changed files? Hmm - this depends a bit on the files you modify, but for `.pac`, `.cc` or `.h` files it shouldn’t restart from the `configure` step. It might help if you explain which commands you run and/or which files you modify. > I am not sure if I get these values using this event dnp3\_attribute\_common(). Looking at the parser a bit more, one course of action would be to introduce new events ` dnp3_analog_input_deadband_16()` and ` dnp3_analog_input_deadband_32()` and `dnp3_analog_input_deadband_sp()` and raise these whenever the respective objects are set, but see below for thoughts around the data\_object event. You could take a similar approach as for `FrozenAnaInputEveDPwTime` and the above, introducing new types and specific events for the deadband g34 types. But, see below. > Is it a vector of values or just a value ? As it’s type is count… why I am interested because I think deadband values may be extracted (ai\_dead, ai\_dead\_16 of dnp3-objects.pac). Please help in this area. This is curious. The event currently handles a few selected object types only and otherwise returns 0xff as the value. You could probably extend this to handle the `ai_dead-*` identifiers as well. > From a usage perspective, it seems the idea is that you first handle `dnp3_object_header()`, keep the `obj_type` and then upon `dnp3_response_data_object()` see if it holds what you expect. There may be a reasonable extension to have a `dnp3_typed_response_data_object(c, is_orig, obj_type, data_value)` event that gives you type and data at once: Feel free to open a Github issue if this would help you. > There are few more fields needs to be extracted from dnp3 application pdu such as time value in g50 or device name/identifier in g0v247 , fragment size in g0v240 etc are not there . So I am trying to add these things. If you can help here someway will be very much appreciated. I’d mostly be trying to replicate the existing code. For `g50` it appears the `AbsTime`, `AbsTimeInterval` and `Last_AbsTime` don’t have a `&let += { process_request }` method to raise events. So taking one of the existing events and replicating it for `AbsTime`. If you’re not sure about implementing these, do you have pcaps that you could share that show-case all these attributes? That would help testing. Hope this helps and sorry for the delay, Arne ---
**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\ **Post date:** [June 20, 2023, 2:22am UTC](https://community.zeek.org/t/need-help-to-print-data-value-in-zeek/6966/7 "2023-06-20T02:22:23Z")
Thanks a lot @awelzel for this detailed reply. It’s better if you can implement these requirements in zeek dnp3. You understand the framework better, I can do the implementation but it may take time to bring it into the main stream. I will add all the requirements in the GitHub issues, please take up this activity as per you convenience. Thanks Biswa