If we want to extract the value such as coil value from Modbus analyzer, do
we need to redeclare the event handler included in event.bif? I saw that
you use the "this" pointer to represent the whole payload message. I might
need to use the Modbus analyzer in another project later.
On Wed, May 14, 2014 at 11:24 AM, Seth Hall <seth(a)icir.org> wrote:
On May 14, 2014, at 10:40 AM, Robin Sommer <robin(a)icir.org> wrote:
On Wed, May 14, 2014 at 03:08 -0700, Vishak
> I have a trace file which has a write request to write to coil 0.
> But when I monitor that trace file in my bro script, I cannot see the
says the size of the coil vector is empty.
Iirc, the analyzer doesn't further extract coil values yet.
I was unable to find traffic that dealt with coils so I left that out.
Most of the infrastructure is in place however. Vishak, can we use the
traffic you submitted in our test suite if it works out when we look at it?
International Computer Science Institute
(Bro) because everyone has a network
PhD Candidate, Research Assistant
Electrical and Computer Engineering Department
University of Illinois at Urbana-Champaign