[Bro-Dev] [Bro-Commits] [git/bro] topic/jsiwek/modbus-fixes: Adjust modbus register array parsing. (c911d03)
Seth Hall
seth at icir.org
Mon Nov 12 18:14:31 PST 2012
On Nov 12, 2012, at 5:53 PM, Jonathan Siwek <jsiwek at ncsa.illinois.edu> wrote:
> Added another parameter to modbus events that carry register arrays to
> the script-layer which indicates the associated byte count from the
> message (allowing for invalid values to be detected):
I actually don't like this. If an invalid value is found, I'd rather that a protocol violation or weird gets generated instead since it actually indicates a protocol error (I believe it does in this case at least).
What do you think about that?
.Seth
--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/
More information about the bro-dev
mailing list