Re: Going to add functionality for ICS technologies and SCADA protocols

[Arun Saini <mailarunsaini () gmail com>]

yes that i got , still i have two queries ,

1) please provide sample rules to capture the traffic as i have generated
the traffic but it is not detecting it , do we really need to create the
rules set for the same i.e. Modbus /DNP3
2) if i want to create the preprocessor for IEEE 60870 , how should i
proceed as i want to make my snort for ICS/SCADA specific only .




[image: --]
Arun Saini
[image: http://]about.me/arun.saini
<http://about.me/arun.saini>

*Mobile: +91-9890738762*

*in.linkedin.com/in/mailarunsaini <http://in.linkedin.com/in/mailarunsaini>*

On 12 July 2016 at 16:09, Al Lewis (allewi) <allewi () cisco com> wrote:

> Please see the README files for DPN3 and MODBUS that are included with the
> snort download.
>
> The modbus and dnp3 preprocessor examples are also in the default
> snort.conf .
>
>
>
> *Albert Lewis*
>
> QA SNORT/Sourcefire
>
> SOURCE*fire*, Inc. now part of *Cisco*
>
> 9780 Patuxent Woods Drive
> Columbia, MD 21046
>
> Email: allewi () cisco com
>
>
> From: Arun Saini <mailarunsaini () gmail com>
> Date: Tuesday, July 12, 2016 at 2:25 AM
> To: 'snort-users' <snort-users () lists sourceforge net>
> Subject: [Snort-users] Going to add functionality for ICS technologies
> and SCADA protocols
>
> Hi Team,
>
>
>
> I want to add SCADA protocols traffic detection functionality in my snort
> engine/configuration , can anyone help me to how to add/start rules and
> preprocessor addition for the below ???
>
>
> i have additional wire shark packet capture results for the same traffic
> and bits , bites and protocol header detailed information ready.
>
>
>
> SCADA protocols :-DNP3, Modbus, BACNet, ICCP, IEEE 60870
>
>
>
>
>
> [image: --]
> Arun Saini
> [image: http://]about.me/arun.saini
> <http://about.me/arun.saini>
>
> *Mobile: +91-9890738762*
>
> *in.linkedin.com/in/mailarunsaini
> <http://in.linkedin.com/in/mailarunsaini>*
------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!