search

DINA-community / ot-parsers

a collection of OT and ICS protocol parsers for Zeek
BSD 3-Clause "New" or "Revised" License
6 stars 2 forks source link

Tested and integrated some BSI-based ASDUs #2

Closed georgemakrakis closed 7 months ago

georgemakrakis commented 9 months ago

Dear team,

This PR adds some Spicy events and parsing for some BSI-based ASDUs. These have been tested using the PCAP from: https://github.com/automayt/ICS-pcap/blob/master/IEC%2060870/iec104/iec104.pcap

I do not have access to the IEC 60870-5-104:2006 and IEC 60870-5-101:2003 documents from the standard so all my contributions are based on the documents that I describe here.

George.

Crubumble commented 9 months ago

Thanks George for the contribution. We will check these with the standard

Crubumble commented 9 months ago

Code review

Next, we will run the parser with your provided pcap.

Question regarding qualifier

In the meanwhile, could you explain why the qualifier QU_UNSPECIFIED is not caught? In my point of view, there is a difference between "I know that I know nothing about something" and "I know nothing about something". In this case, I would know that no qualifier is provided instead of no qualifier was detected in the protocol and may be missing or available.

Data types affected: C_RC_NA_1, C_DC_NA_1 , C_SC_NA_1

georgemakrakis commented 8 months ago

@Crubumble and @JPLettuce thank you for taking a look at it.

I am not entirely sure about what do you mean with the question regarding the qualifier in the ASDU types C_RC_NA_1, C_DC_NA_1 , C_SC_NA_1. As far as I can tell from the resources that I have followed, when the bits 2..6 (counting from 0) are all False, the QU is considered not defined. Or that maybe something that I am not aware of since I do not have access to the IEC 60870-5-104:2006 and IEC 60870-5-101:2003 documents.