Retrieve modbus error code in Zeek event

[awelzel]

How can I modify the event to make it work with my use case ?

It seems you have made progress since you asked this. Lets continue discussing in your follow-up:

Check if request has response in Zeek script

Good Morning, I have a Zeek machine generating logs on a Modbus traffic. My logs look like this : 1342774501.072580 32 10.2.2.2 51411 10.2.2.3 502 255 READ_HOLDING_REGISTERS request 1342774501.087014 32 10.2.2.2 51411 10.2.2.3 502 255 READ_HOLDING_REGISTERS response ‘tid’ is the transaction id to identify a request/response couple. I want to know if a robot hasn’t responded to the Controller by logging only requests that did not…