icsnpp-ethercat

ICSNPP-ETHERCAT

Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat.

Overview

ICSNPP-Ethercat is a Zeek plugin for parsing and logging fields within the Ethercat protocol.

This plugin was developed to be fully customizable, so if you would like to drill down into specific Ethercat packets and log certain variables, add the logging functionality to scripts/icsnpp/ethercat/main.zeek. The functions within scripts/icsnpp/ethercat/main.zeek and src/events.bif should prove to be a good guide on how to add new logging functionality.

This parser produces 8 log files. These log files are defined in scripts/icsnpp/ethercat/main.zeek.

  • ecat_registers.log
  • ecat_log_address.log
  • ecat_dev_info.log
  • ecat_aoe_info.log
  • ecat_coe_info.log
  • ecat_foe_info.log
  • ecat_soe_info.log
  • ecat_arp_info.log

For additional information on these log files, see the Logging Capabilities section below.

Installation

Installing Zeek

Package Manager

This script is available as a package for Zeek Package Manger

zkg refresh
zkg install icsnpp-ethercat

If this package is installed from ZKG it will be added to the available plugins. This can be tested by running zeek -N. If installed correctly you will see ICSNPP::ETHERCAT.

If you have ZKG configured to load packages (see @load packages in quickstart guide), this plugin and scripts will automatically be loaded and ready to go. ZKG Quickstart Guide

If you are not using site/local.zeek or another site installation of Zeek and just want to run this package on a packet capture you can add icsnpp/ethercat to your command to run this plugin's scripts on the packet capture:

git clone https://github.com/cisagov/icsnpp-ethercat.git
zeek -Cr icsnpp-ethercat/tests/traces/ethercat_example.pcap icsnpp/ethercat

Manual Install

To install this package manually, clone this repository and run the configure and make commands as shown below.

git clone https://github.com/cisagov/icsnpp-ethercat.git
cd icsnpp-ethercat/
./configure
make

If these commands succeed, you will end up with a newly created build directory which contains all the files needed to run/test this plugin. The easiest way to test the parser is to point the ZEEK_PLUGIN_PATH environment variable to this build directory.

export ZEEK_PLUGIN_PATH=$PWD/build/
zeek -N # Ensure everything compiled correctly and you are able to see ICSNPP::ETHERCAT

Once you have tested the functionality locally and it appears to have compiled correctly, you can install it system-wide:

sudo make install
unset ZEEK_PLUGIN_PATH
zeek -N # Ensure everything installed correctly and you are able to see ICSNPP::ETHERCAT

To run this plugin in a site deployment you will need to add the line @load icsnpp/ethercat to your site/local.zeek file in order to load this plugin's scripts.

If you are not using site/local.zeek or another site installation of Zeek and just want to run this package on a packet capture you can add icsnpp/ethercat to your command to run this plugin's scripts on the packet capture:

zeek -Cr icsnpp-ethercat/tests/traces/ethercat_example.pcap icsnpp/ethercat

If you want to deploy this plugin on an already existing Zeek implementation and you don't want to build the plugin on the machine, you can extract the ICSNPP_ETHERCAT.tgz file to the directory of the established ZEEK_PLUGIN_PATH (default is ${ZEEK_INSTALLATION_DIR}/lib/zeek/plugins/).

tar xvzf build/ICSNPP_Ethercat.tgz -C $ZEEK_PLUGIN_PATH 

Logging Capabilities

ECAT Registers (ecat_registers.log)

Overview

This log captures register memory address read and writes ecat_registers.log.

This log is also the catch all. Before it gets to this point it is sent through the more parsing routines to pull out any other information. ie. CoE, AoE, FoE, EoE, and SoE mailbox data.

Fields Captured

FieldTypeDescription
tstimeTimestamp
srcmacstringSource Mac Address
dstmacstringDestination Mac Address
CommandstringEthercat Command
Slave_AddrstringEthercat Slave Address
Register_TypestringRegister Information
Register_AddrstringMemory Address being accessed
datastringData to be read or wrote to memory address

ECAT Address read write (ecat_log_address.log)

Overview

This log captures Logical Read and writes to addresses and logs them to ecat_log_address.log.

Fields Captured

FieldTypeDescription
tstimeTimestamp
srcmacstringSource Mac Address
dstmacstringDestination Mac Address
Log_AddrstringAddress data is being accessed from
LengthcountLength of data
CommandstringEthercat Command
datastringData read or write

ECAT Device Info (ecat_dev_info.log)

Overview

This log captures ECAT Device info and logs it to ecat_dev_info.log.

Fields Captured

FieldTypeDescription
tstimeTimestamp
slave_idstringEthercat Slave Address
revisionstringRevision of EtherCAT controller
dev_typestringType of EtherCAT controller
buildstringBuild version
fmmucntstringFieldbus Memory Management Unit supported channel count
smcountstringSync Manager count
portsstringPort Descriptor
dpramstringRam size
featuresstringFeatures supported

ECAT AoE Info (ecat_aoe_info.log)

Overview

This log captures AoE (ADS over Ethercat, Automation Device Specification) information and logs it to ecat_aoe_info.log.

Fields Captured

FieldTypeDescription
tstimeTimestamp
targetidstringTarget Network ID
targetportstringTarget Port
senderidstringSender Network ID
senderportstringSender Port
cmdstringCommand
stateflagsstringState Flags
datastringCommand Data

ECAT CoE Info (ecat_coe_info.log)

Overview

This log captures CoE (CAN over Ethercat) and logs it to ecat_coe_info.log.

Fields Captured

FieldTypeDescription
tstimeTimestamp
numberstringMessage number
TypestringMessage Type
req_respstringRequest or Response type
indexstringIndex
subindexstringSub Index
dataoffsetstringData Offset

ECAT FoE Info (ecat_foe_info.log)

Overview

This log captures FoE (File Over Ethercat) information and logs it to ecat_foe_info.log.

Fields Captured

FieldTypeDescription
tstimeTimestamp
opCodestringOperation Code
reservedstringReserved
packet_numstringPacket number
error_codestringError Code
filenamestringFilename
datastringTransferred Data

ECAT SoE Info (ecat_soe_info.log)

Overview

This log captures SoE (Servo over Ethercat) and logs it to ecat_soe_info.log.

Fields Captured

FieldTypeDescription
tstimeTimestamp
opCodestringCommand sent for controller
incompletestringFunction check to determine if it has been processed
errorstringError message
drive_numstringDrive number for command
element_flagsstringElement Flags
indexstringMessage Index

ECAT ARP Info (ecat_arp_info.log)

Overview

This log captures ARP info that is passed through EoE (Ethernet over Ethercat) and logs it to ecat_arp_info.log.

Fields Captured

FieldTypeDescription
tstimeTimestamp
arp_typestringArp command
mac_srcstringSource Mac address
mac_dststringDestination Mac address
SPAaddrSender protocol address
SHAstringSender hardware address
TPAaddrTarget protocol address
THAstringTarget hardware address

ICSNPP Packages

All ICSNPP Packages:

Full ICS Protocol Parsers:

  • BACnet
    • Full Zeek protocol parser for BACnet (Building Control and Automation)
  • BSAP
    • Full Zeek protocol parser for BSAP (Bristol Standard Asynchronous Protocol) over IP
    • Full Zeek protocol parser for BSAP Serial comm converted using serial tap device
  • Ethercat
    • Full Zeek protocol parser for Ethercat
  • Ethernet/IP and CIP
    • Full Zeek protocol parser for Ethernet/IP and CIP
  • Genisys
    • Full Zeek protocol parser for Genisys
  • OPCUA-Binary
    • Full Zeek protocol parser for OPC UA (OPC Unified Architecture) - Binary
  • S7Comm
    • Full Zeek protocol parser for S7comm, S7comm-plus, and COTP
  • Synchrophasor
    • Full Zeek protocol parser for Synchrophasor Data Transfer for Power Systems (C37.118)

Updates to Zeek ICS Protocol Parsers:

  • DNP3
    • DNP3 Zeek script extending logging capabilities of Zeek's default DNP3 protocol parser
  • Modbus
    • Modbus Zeek script extending logging capabilities of Zeek's default Modbus protocol parser

Other Software

Idaho National Laboratory is a cutting edge research facility which is a constantly producing high quality research and software. Feel free to take a look at our other software and scientific offerings at:

Primary Technology Offerings Page

Supported Open Source Software

Raw Experiment Open Source Software

Unsupported Open Source Software

License

Copyright 2023 Battelle Energy Alliance, LLC

Licensed under the 3-Part BSD (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

https://opensource.org/licenses/BSD-3-Clause

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensing

This software is licensed under the terms you may find in the file named "LICENSE" in this directory.

Package Version :