Multiple object types, but only one got output

[helenwangjia]

🐛 Summary

When there are multiple object types in one packet, zeek only output one. For example, There are 20 packets in test.pcap, and no.1 has two object types (device and accumulator) as shown in the screenshot of Wireshark. But after I ran this command, zeek-Cr test.pcap /usr/local/zeek/share/zeek/site/icsnpp-bacnet/main.zeek, the object_type is output as “accumulator” only in bacnet_discovery.log. Another example is the no.18 got 8 object types. However, after I ran this command, zeek-Cr test.pcap /usr/local/zeek/share/zeek/site/icsnpp-bacnet/main.zeek, the object_type is output as “schedule” only in bacnet_property.log. For further confirmation, I output this pcap by tshark, and each object type has output.

To reproduce

Run zeek-Cr test.pcap /usr/local/zeek/share/zeek/site/icsnpp-bacnet/main.zeek

Expected behavior

Logic for which object type should be output

Any helpful log output

bacnet_discovery.log for no.1

1692099997.714948   CyFXcfmZiqRZeZJ4b   10.0.0.2    47808   10.0.0.255  47808   T   i-have  accumulator 4   -   -   (empty)

bacnet_property.log for no.18

1692099997.715010   Cuoso93BOASnNw524i  10.0.0.2    47808   10.0.0.1    47808   T   94  read-property-ack   schedule    385 Vendor Specific (71303554)  -   schedule: 388

Add any screenshots of the problem here. no.1

no.18

test.pcap test.pcap.zip

For further information, log output by tshark for no.1

1692099997.714948000    10.0.0.2    10.0.0.255  i-Have (1)  47808   Unconfirmed-REQ (1) device
1692099997.714948000    10.0.0.2    10.0.0.255  i-Have (1)  47808   Unconfirmed-REQ (1) accumulator

log output by tshark for no.18

1692099997.715010000    10.0.0.2    10.0.0.1    readProperty (12)   47808   Complex-ACK (3) binary-input
1692099997.715010000    10.0.0.2    10.0.0.1    readProperty (12)   47808   Complex-ACK (3) binary-output
1692099997.715010000    10.0.0.2    10.0.0.1    readProperty (12)   47808   Complex-ACK (3) binary-value
1692099997.715010000    10.0.0.2    10.0.0.1    readProperty (12)   47808   Complex-ACK (3) device
1692099997.715010000    10.0.0.2    10.0.0.1    readProperty (12)   47808   Complex-ACK (3) group
1692099997.715010000    10.0.0.2    10.0.0.1    readProperty (12)   47808   Complex-ACK (3) notification-class
1692099997.715010000    10.0.0.2    10.0.0.1    readProperty (12)   47808   Complex-ACK (3) schedule
1692099997.715010000    10.0.0.2    10.0.0.1    readProperty (12)   47808   Complex-ACK (3) accumulator

[kkvarfordt]

Fixed see PR #38