Retrieve modbus error code in Zeek event


I am trying to write a script to log events only when a controller has sent a modbus request to a robot with no response.

At the moment, I am able to capture the response of a read_holding_registers request from the controller.

I would only like to log the event when the robot is not accessible for any reason.

Based on what I’ve read on the modbus documentation, the robot should issue a timeout response, I think that generating logs based on the Timeout error code is a good start, but I can’t figure out how to do it.

my event code for the response currently look like this :

event modbus_read_holding_registers_response(c: connection,
                                            headers: ModbusHeaders,
                                            start_address: count,
                                            quantity: count) {

    local read_holding_request: Modbus_Detailed;
    read_holding_request$ts                 = network_time();
    read_holding_request$uid                = c$uid;
    read_holding_request$id                 = c$id;

    read_holding_request$unit_id            = headers$uid;
    read_holding_request$func               = Modbus::function_codes[headers$function_code];
    read_holding_request$network_direction  = request_str_g;
    read_holding_request$address            = start_address;
    read_holding_request$quantity           = quantity;

    Log::write(LOG_DETAILED, read_holding_response;

How can I modify the event to make it work with my use case ?

Thank you for your help

How can I modify the event to make it work with my use case ?

It seems you have made progress since you asked this. Lets continue discussing in your follow-up: