[Bro-Dev] [Bro-Commits] [git/bro] topic/jsiwek/modbus-fixes: Adjust modbus register array parsing. (c911d03)

Seth Hall seth at icir.org
Mon Nov 12 18:14:31 PST 2012


On Nov 12, 2012, at 5:53 PM, Jonathan Siwek <jsiwek at ncsa.illinois.edu> wrote:

>   Added another parameter to modbus events that carry register arrays to
>    the script-layer which indicates the associated byte count from the
>    message (allowing for invalid values to be detected):


I actually don't like this.  If an invalid value is found, I'd rather that a protocol violation or weird gets generated instead since it actually indicates a protocol error (I believe it does in this case at least).

What do you think about that?

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/




More information about the bro-dev mailing list