update ethernet/IP and CIP to account for new packet correlation ID

idaholab / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

https://idaholab.github.io/Malcolm/

Other

357 stars 59 forks source link

update ethernet/IP and CIP to account for new packet correlation ID #558

Closed mmguero closed 1 month ago

mmguero commented 1 month ago

cisagov/icsnpp-enip#30 adds a "packet correlation ID" field to help correlate between enip and cip logs. This issue tracks the changes needed for Malcolm to do this.

mmguero-dev/Malcolm@2363779b03272b6b007db8757d16df7cd10c7709
mmguero-dev/Malcolm@abaadbd20cbfcd0d5b1742cbf03d6f4aff4c1f39
mmguero-dev/Malcolm@f5e37c535e3772637e9bdec37df2282e53ca64f4

mmguero commented 1 month ago

Done