[Bro-Dev] [Bro-Commits] [git/bro] topic/jsiwek/modbus-fixes: Adjust modbus register array parsing. (c911d03)

Seth Hall seth at icir.org
Mon Nov 12 18:14:31 PST 2012

On Nov 12, 2012, at 5:53 PM, Jonathan Siwek <jsiwek at ncsa.illinois.edu> wrote:

>   Added another parameter to modbus events that carry register arrays to
>    the script-layer which indicates the associated byte count from the
>    message (allowing for invalid values to be detected):

I actually don't like this.  If an invalid value is found, I'd rather that a protocol violation or weird gets generated instead since it actually indicates a protocol error (I believe it does in this case at least).

What do you think about that?


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the bro-dev mailing list