Re: Going to add functionality for ICS technologies and SCADA protocols

["Al Lewis (allewi)" <allewi () cisco com>]

Please see the README files for DPN3 and MODBUS that are included with the snort download.

The modbus and dnp3 preprocessor examples are also in the default snort.conf .



Albert Lewis
QA SNORT/Sourcefire
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Email: allewi () cisco com<mailto:allewi () cisco com>


From: Arun Saini <mailarunsaini () gmail com<mailto:mailarunsaini () gmail com>>
Date: Tuesday, July 12, 2016 at 2:25 AM
To: 'snort-users' <snort-users () lists sourceforge net<mailto:snort-users () lists sourceforge net>>
Subject: [Snort-users] Going to add functionality for ICS technologies and SCADA protocols

Hi Team,

I want to add SCADA protocols traffic detection functionality in my snort engine/configuration , can anyone help me to 
how to add/start rules and preprocessor addition for the below ???

i have additional wire shark packet capture results for the same traffic and bits , bites and protocol header detailed 
information ready.

SCADA protocols :-DNP3, Modbus, BACNet, ICCP, IEEE 60870




<http://about.me/arun.saini>
[http://d3mod6n032mdiz.cloudfront.net/thumb2/a/r/u/arun.saini/arun.saini-105x70.jpg]

Arun Saini
about.me/arun.saini





Mobile: +91-9890738762

in.linkedin.com/in/mailarunsaini<http://in.linkedin.com/in/mailarunsaini>

------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!