Industrial Control Systems Network Protocol Parsers (ICSNPP) - s7comm, s7comm-plus, and COTP.
ICSNPP-S7COMM is a Zeek plugin for parsing and logging fields within the s7comm, s7comm-plus, and COTP protocols.
This plugin was developed to be fully customizable, so if you would like to drill down into specific packets and log certain variables, add the logging functionality to scripts/icsnpp/s7comm/main.zeek. The functions within scripts/icsnpp/s7comm/main.zeek and src/events.bif should prove to be a good guide on how to add new logging functionality.
This parser currently produces five log files. These log files are defined in scripts/icsnpp/s7comm/main.zeek.
- cotp.log
- s7comm.log
- s7comm_read_szl.log
- s7comm_upload_download.log
- s7comm_plus.log
For additional information on these log files, see the Logging Capabilities section below.
This script is available as a package for Zeek Package Manger
zkg refresh
zkg install icsnpp-s7commIf this package is installed from ZKG it will be added to the available plugins. This can be tested by running zeek -N. If installed correctly you will see ICSNPP::S7COMM.
If you have ZKG configured to load packages (see @load packages in quickstart guide), this plugin and scripts will automatically be loaded and ready to go. ZKG Quickstart Guide
If you are not using site/local.zeek or another site installation of Zeek and just want to run this package on a packet capture you can add icsnpp/s7comm to your command to run this plugin's scripts on the packet capture:
git clone https://github.com/cisagov/icsnpp-s7comm.git
zeek -Cr icsnpp-s7comm/tests/traces/s7comm_plus_example.pcap icsnpp/s7commTo install this package manually, clone this repository and run the configure and make commands as shown below.
git clone https://github.com/cisagov/icsnpp-s7comm.git
cd icsnpp-s7comm/
./configure
makeIf these commands succeed, you will end up with a newly create build directory. This contains all the files needed to run/test this plugin. The easiest way to test the parser is to point the ZEEK_PLUGIN_PATH environment variable to this build directory.
export ZEEK_PLUGIN_PATH=$PWD/build/
zeek -N # Ensure everything compiled correctly and you are able to see ICSNPP::S7COMMOnce you have tested the functionality locally and it appears to have compiled correctly, you can install it system-wide:
sudo make install
unset ZEEK_PLUGIN_PATH
zeek -N # Ensure everything installed correctly and you are able to see ICSNPP::S7COMMTo run this plugin in a site deployment you will need to add the line @load icsnpp/s7comm to your site/local.zeek file in order to load this plugin's scripts.
If you are not using site/local.zeek or another site installation of Zeek and just want to run this package on a packet capture you can add icsnpp/s7comm to your command to run this plugin's scripts on the packet capture:
zeek -Cr icsnpp-s7comm/tests/traces/s7comm_plus_example.pcap icsnpp/s7commIf you want to deploy this on an already existing Zeek implementation and you don't want to build the plugin on the machine, you can extract the ICSNPP_S7comm.tgz file to the directory of the established ZEEK_PLUGIN_PATH (default is ${ZEEK_INSTALLATION_DIR}/lib/zeek/plugins/).
tar xvzf build/ICSNPP_S7comm.tgz -C $ZEEK_PLUGIN_PATH This log captures COTP information for every COTP packet and logs it to cotp.log.
| Field | Type | Description |
|---|---|---|
| ts | time | Timestamp |
| uid | string | Unique ID for this Connection |
| id | conn_id | Default Zeek Connection Info (IP addresses, ports) |
| is_orig | bool | True if the packet is sent from the originator |
| pdu_code | string | COTP PDU Type Code (in hex) |
| pdu_name | string | COTP PDU Name |
This log captures s7comm header information for every s7comm packet and logs it to s7comm.log.
| Field | Type | Description |
|---|---|---|
| ts | time | Timestamp |
| uid | string | Unique ID for this Connection |
| id | conn_id | Default Zeek Connection Info (IP addresses, ports) |
| is_orig | bool | True if the packet is sent from the originator |
| rosctr_code | count | Remote Operating Service Control Code (in hex) |
| rosctr_name | string | Remote Operating Service Control Name |
| pdu_reference | count | Reference ID Used to Link Requests to Responses |
| function_code | string | Parameter Function Code (in hex) |
| function_name | string | Parameter Function Name |
| subfunction_code | string | User-Data Subfunction Code (in hex) |
| subfunction_name | string | User-Data Subfunction Name |
| error_class | string | Error Class Name |
| error_code | string | Error Code within Error Class |
This log captures information for the common S7Comm Read-SZL function. This data is logged to s7comm_read_szl.log.
| Field | Type | Description |
|---|---|---|
| ts | time | Timestamp |
| uid | string | Unique ID for this Connection |
| id | conn_id | Default Zeek Connection Info (IP addresses, ports) |
| pdu_reference | count | Reference ID Used to Link Requests to Responses |
| method | string | Request or Response |
| szl_id | string | SZL ID (in hex) |
| szl_id_name | string | Meaning of SZL ID |
| szl_index | string | SZL Index (in hex) |
| return_code | string | Return Code (in hex) |
| return_code_name | string | Meaning of Return Code |
This log captures information for the S7Comm Upload and Download functions (see list below). This data is logged to s7comm_upload_download.log.:
- Start Upload
- Upload
- End Upload
- Request Download
- Download Block
- Download Ended
| Field | Type | Description |
|---|---|---|
| ts | time | Timestamp |
| uid | string | Unique ID for this Connection |
| id | conn_id | Default Zeek Connection Info (IP addresses, ports) |
| rosctr | count | Remote Operating Service Control |
| pdu_reference | count | Reference ID Used to Link Requests to Responses |
| function_code | count | Parameter Function Code |
| function_status | count | Function Status |
| session_id | count | Session ID |
| blocklength | count | Length of Block to Upload/Download |
| filename | string | Filename of Block to Upload/Download |
| block_type | string | Block Type to Upload/Download |
| block_number | string | Block Number to Upload/Download |
| destination_filesystem | string | Destination Filesystem of Upload/Download |
This log captures s7comm-plus header information for every s7comm-plus packet and logs it to s7comm_plus.log.
| Field | Type | Description |
|---|---|---|
| ts | time | Timestamp |
| uid | string | Unique ID for this Connection |
| id | conn_id | Default Zeek Connection Info (IP addresses, ports) |
| is_orig | bool | True if the packet is sent from the originator |
| version | count | S7comm-plus Version |
| opcode | string | Opcode Code (in hex) |
| opcode_name | string | Opcode Name |
| function_code | string | Opcode Function Code (in hex) |
| function_name | string | Opcode Function Name |
S7COMM contains two functions for sending and receiving files: Upload and Download-Block. This plugin will extract files sent via these two functions and pass the extracted files to Zeek's file analysis framework.
All ICSNPP Packages:
Full ICS Protocol Parsers:
- BACnet
- Full Zeek protocol parser for BACnet (Building Control and Automation)
- BSAP
- Full Zeek protocol parser for BSAP (Bristol Standard Asynchronous Protocol) over IP
- Full Zeek protocol parser for BSAP Serial comm converted using serial tap device
- Ethercat
- Full Zeek protocol parser for Ethercat
- Ethernet/IP and CIP
- Full Zeek protocol parser for Ethernet/IP and CIP
- Genisys
- Full Zeek protocol parser for Genisys
- OPCUA-Binary
- Full Zeek protocol parser for OPC UA (OPC Unified Architecture) - Binary
- S7Comm
- Full Zeek protocol parser for S7comm, S7comm-plus, and COTP
Updates to Zeek ICS Protocol Parsers:
- DNP3
- DNP3 Zeek script extending logging capabilities of Zeek's default DNP3 protocol parser
- Modbus
- Modbus Zeek script extending logging capabilities of Zeek's default Modbus protocol parser
Idaho National Laboratory is a cutting edge research facility which is a constantly producing high quality research and software. Feel free to take a look at our other software and scientific offerings at:
Primary Technology Offerings Page
Supported Open Source Software
Raw Experiment Open Source Software
Unsupported Open Source Software
Copyright 2022 Battelle Energy Alliance, LLC
Licensed under the 3-Part BSD (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
https://opensource.org/licenses/BSD-3-Clause
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
This software is licensed under the terms you may find in the file named "LICENSE" in this directory.