Need help to print data_value in zeek

Hi,
I need help to print data_value of event dnp3_response_data_object() in dnp3/events.bif.
This event is generated from type Response_Data_Object() of dnp3-objects.pac. I want to know how can I fetch these attributes using the above event. Please suggest.
Thanks
Biswa

Hello @biswa , it’s not immediately clear what you want to achive.

Have you looked if the dnp3_attribute_common() event would cover your case? Are you looking for an event that gives you just the raw data of a Response_Data_Object? Can you sketch the declaration of the event or a bit of scripting code what you’re looking to do?

Thanks,
Arne

Ah, this is probably all related to your previous post:

If the existing parser doesn’t provide you with the events you need and you have pcaps available for testing, you could start looking at extending the parser and contributing back :slight_smile:

1 Like

Thanks a lot @awelzel for the reply. I have started adding few events in the existing parser, I have few doubts.

  1. When I change anything in zeek related files and try to make then it starts again from configure and make from scratch. Is there any option to get rid of this and compile only the changed files?

  2. You mentioned about dnp3_attribute_common(), if you check dnp3-objects.pac, you will see in request and response data object handling these common attributes are mentioned under “device attribute g0” and I am assuming I will get these value only in the script but I am trying to extract deadband which is defined as ai_dead_16, ai_dead_32 in the same file under “analog input g34”. I am not sure if I get these values using this event dnp3_attribute_common().

  3. There is another event in events.bif in dnp3 called dnp3_response_data_object() with argument data_value which states “the value for those objects that carry their information here directly”. Firstly the meaning is not clear to me and secondly how to print/dump such data_value in zeek scripts is not clear. Is it a vector of values or just a value ? As it’s type is count… why I am interested because I think deadband values may be extracted (ai_dead, ai_dead_16 of dnp3-objects.pac). Please help in this area.

  4. There are few more fields needs to be extracted from dnp3 application pdu such as time value in g50 or device name/identifier in g0v247 , fragment size in g0v240 etc are not there . So I am trying to add these things. If you can help here someway will be very much appreciated.

Thanks
Biswa

Hi @awelzel , any pointers regarding these doubts would be very helpful.
Query 1 is related to compilation, whereas 2,3 is related to printing attr_obj, data_value format and
4 is related to enhancement for missing fields.
Thanks
Biswa

Hello @biswa - this went under.

When I change anything in zeek related files and try to make then it starts again from configure and make from scratch. Is there any option to get rid of this and compile only the changed files?

Hmm - this depends a bit on the files you modify, but for .pac, .cc or .h files it shouldn’t restart from the configure step. It might help if you explain which commands you run and/or which files you modify.

I am not sure if I get these values using this event dnp3_attribute_common().

Looking at the parser a bit more, one course of action would be to introduce new events dnp3_analog_input_deadband_16() and dnp3_analog_input_deadband_32() and dnp3_analog_input_deadband_sp() and raise these whenever the respective objects are set, but see below for thoughts around the data_object event.

You could take a similar approach as for FrozenAnaInputEveDPwTime and the above, introducing new types and specific events for the deadband g34 types. But, see below.

Is it a vector of values or just a value ? As it’s type is count… why I am interested because I think deadband values may be extracted (ai_dead, ai_dead_16 of dnp3-objects.pac). Please help in this area.

This is curious. The event currently handles a few selected object types only and otherwise returns 0xff as the value. You could probably extend this to handle the ai_dead-* identifiers as well.

From a usage perspective, it seems the idea is that you first handle dnp3_object_header(), keep the obj_type and then upon dnp3_response_data_object() see if it holds what you expect.

There may be a reasonable extension to have a dnp3_typed_response_data_object(c, is_orig, obj_type, data_value) event that gives you type and data at once: Feel free to open a Github issue if this would help you.

There are few more fields needs to be extracted from dnp3 application pdu such as time value in g50 or device name/identifier in g0v247 , fragment size in g0v240 etc are not there . So I am trying to add these things. If you can help here someway will be very much appreciated.

I’d mostly be trying to replicate the existing code. For g50 it appears the AbsTime, AbsTimeInterval and Last_AbsTime don’t have a &let += { process_request } method to raise events. So taking one of the existing events and replicating it for AbsTime.

If you’re not sure about implementing these, do you have pcaps that you could share that show-case all these attributes? That would help testing.

Hope this helps and sorry for the delay,
Arne

Thanks a lot @awelzel for this detailed reply. It’s better if you can implement these requirements in zeek dnp3. You understand the framework better, I can do the implementation but it may take time to bring it into the main stream. I will add all the requirements in the GitHub issues, please take up this activity as per you convenience.
Thanks
Biswa