Log MODBUS/SNMPv1/v2 requests

[johnnykv]

No description provided.

[johnnykv]

Work to be done yet:

• Log SNMPv3
• Transmit data using hpfriends..

[johnnykv]

@glaslos Regarding logging, conpot will be covering quite a few protocols:

• Modbus
• SNMP v1/v2
• SNMP v3
• DNP3
• HTTP
• IEC 60870

I am thinking of a generic approach (for hpfriends), something in the line of:

//some modbus data
{'remote': ('1.2.3.4', 58988),
 'data_type': 'modbus',
 'data': {'request_pdu': '0f0001000801ff',
          'response_pdu': '0f00010008'}}

//some snmp data
{'remote': ('1.2.3.4', 58994),
 'data_type': 'snmpv2',
 'data': {'request_message': '\x02\x01\x00\x04\x06public\xa1\x1a\x02\x04_\xaa\xadK\x02\x01\x00\x02\x01\x000\x0c0\n\x06\x06+\x06\x01\x02\x01\x01\x05\x00',
          'response_message': '\x02\x01\x00\x04\x06public\xa24\

Any inputs/opinions on this?

[glaslos]

Sounds good to me.

[glaslos]

Are you still doing this nested per session?

{'remote': ('1.2.3.4', 58988),
 'data_type': 'modbus',
 'session_id': 123123123,
 'data': [
        {
          '2005-10-30 T 10:45 UTC',
          'request_pdu': '0f0001000801ff',
          'response_pdu': '0f00010008'
        }
    ]
}

[johnnykv]

yes, with some minor changes to align the data... I think modbus data would look like this when finished:

{'remote': ('1.2.3.4', 58988),
 'data_type': 'modbus',
 'session_id': 123123123,
 'data': {
        '0': {
          'request_pdu': '0f0001000801ff',
          'response_pdu': '0f00010008'
        }
        '95': {
          'request_pdu': '0f0001000801ff',
          'response_pdu': '0f00010008'
        }
        '135': {
          'request_pdu': '0f0001000801ff',
          'response_pdu': '0f00010008'
        }
    }
}

The keys of the data dictionary would be offset (in milliseconds).

[glaslos]

Whats the status on this?

[johnnykv]

• Modbus: done
• SNMP v1/v2: done
• SNMP v3: no progress

Hopefully i will throw in a few test cases for modbus/snmp logging tonight. I suggest that we move SNMP v3 logging to a separate workitem - and possibly also next milestone.

[glaslos]

Closed. See #24 and #25