Build Status
| Source | main Status |
main Timestamp |
|---|---|---|
| CISAGOV |  |
 |
| Development |  |
 |
ICSNPP-GE-SRTP
Industrial Control Systems Network Protocol Parsers (ICSNPP) - GE SRTP
Overview
ICSNPP-GE-SRTP is a Zeek plugin (written in Spicy) for parsing and logging fields used by the GE SRTP protocol, as defined in Leveraging the SRTP protocol for over-the-network memory acquistion of a GE Fanuc Seris 90-30
This parser produces the following log files, defined in scripts/main.zeek:
ge_srtp_general.log
For additional information on this log file, see the Logging Capabilities section below.
Installation
Package Manager
This script is available as a package for Zeek Package Manager. It requires Spicy and the Zeek Spicy plugin.
$ zkg refresh
$ zkg install icsnpp-ge-srtp
If this package is installed from ZKG, it will be added to the available plugins. This can be tested by running zeek -NN. If installed correctly, users will see [Analyzer] spicy_GE_SRTP_TCP (ANALYZER_SPICY_GE_SRTP_TCP, enabled) under the list of Zeek::Spicy analyzers.
If users have ZKG configured to load packages (see @load packages in the ZKG Quickstart Guide), this plugin and these scripts will automatically be loaded and ready to go.
Protocol Detection and Custom Ports
GE SRTP detection is port-based. By default, the TCP analyzer is registered for TCP port 18245. The Spicy parser validates payload after Zeek assigns traffic to the analyzer, but this package does not provide a DPD payload signature for discovering GE SRTP on otherwise unregistered ports.
To analyze GE SRTP on an additional TCP port, add the port to
GE_SRTP::tcp_ports in a Zeek site policy loaded after this package:
redef GE_SRTP::tcp_ports += { 12345/tcp };
GE_SRTP::tcp_ports is used both to register the TCP analyzer and to populate
Zeek's likely_server_ports direction heuristic. Adding a port only to
likely_server_ports does not enable parsing; the port must be present in
GE_SRTP::tcp_ports.
Port configuration is read when Zeek initializes. Restart a standalone Zeek process, or redeploy/restart Zeek cluster workers, after changing the site policy. Port-only configuration changes do not require rebuilding or reinstalling the parser.
Registering a port assigns every TCP connection whose inferred server port matches it to the GE SRTP analyzer. Configure only ports dedicated to GE SRTP; unrelated or malformed traffic on those ports adds parsing overhead and is rejected when it does not parse as GE SRTP.
This parser does not support GE SRTP over UDP, so there is no UDP port set to configure.
Logging Capabilities
GE SRTP Log (ge_srtp_general.log)
Overview
This log summarizes, by connection, GE SRTP frames transmitted to ge_srtp_general.log.
Fields Captured
| Field | Type | Description |
|---|---|---|
| ts | time | Timestamp (network time) |
| uid | string | Uinque ID for this connection |
| id | conn_id | Default Zeek connection info (IP Addresses, Ports, etc.) |
| proto | string | Transport protocol |
| srtp_type | string | Type: Request (0x02) Reply (0x03) |
| sequence_number_1 | count | Sequence number identifying request/reply pairs. Repeated twice in message structure. |
| text_length | count | Length of the message for messages greater than 56 bytes |
| time_seconds | count | Time in seconds |
| time_minutes | count | Time in minutes |
| time_hours | count | Time in hours |
| sequence_number_2 | count | Second sequence number |
| message_type | string | Message type |
| mailbox_source | count | Mailbox source |
| mailbox_destination | count | Mailbox destination |
| packet_number | count | Packet number |
| total_packet_number | count | Total packet number |
| service_request_code | string | Service request code based on the type of memory being requested |
| segment_selector | string | Segment selector determining which memory register is accessed |
| memory_offset | count | Memory offset starting with zero |
| data_length | count | Data length for the memory type accessed. |
| status_code | string | Status code |
| minor_status_code | string | Minor status code |
| data_requested | string | Data requested |
| control_program_number | count | The number of the control program task the master is currently logged into. |
| current_privilege_level | count | Current privilege level of the master device |
| last_sweep_time | count | The last elapsed time to fully execute program task. |
| oversweep_flag | string | Oversweep flag. Meaningful only if constant sweep mode is active |
| constant_sweep_mode | string | Constant sweep mode. Active (0x01); Not Active (0x00) |
| plc_fault_entry_last_read | string | PLC Fault Entry since last read. |
| io_fault_entry_last_read | string | I/O Falut Entry since last read. |
| plc_fault_entry_present | string | PLC Fault Entry present. |
| io_fault_entry_present | string | I/O Fault Entry present. |
| programmer_attachment | string | Programmer attachement flag. Attachment found (0x01); No Attachement found (0x00) |
| front_panel_enable_switch | string | Front panel ENABLE/DISABLE switch setting. |
| front_panel_run_switch | string | Front panel RUN/STOP switch setting. |
| oem_protected | string | OEM protected bit. |
| plc_state | string | PLC State |
Service Request Codes
The following request codes are present in the service_request_code field within ge_srtp_general.log. More detailed logging for information specific to each request code is not currently availiable.
| Service Request Code | Logging Level |
|---|---|
| Plc Short Status Request | Logged - Header Only |
| Return Control Program Names | Logged - Header Only |
| Read System Memory | Logged - Header Only |
| Read Task Memory | Logged - Header Only |
| Read Program Memory | Logged - Header Only |
| Write System Memory | Logged - Header Only |
| Write Task Memory | Logged - Header Only |
| Write Program Block Memory | Logged - Header Only |
| Programmer Logon | Logged - Header Only |
| Change Plc Cpu Privilege Level | Logged - Header Only |
| Set Control Id Cpu Id | Logged - Header Only |
| Set Plc Run Vs Stop | Logged - Header Only |
| Set Plc Time Date | Logged - Header Only |
| Return Plc Time Date | Logged - Header Only |
| Return Fault Table | Logged - Header Only |
| Clear Fault Table | Logged - Header Only |
| Program Store Upload From Plc | Logged - Header Only |
| Program Load Download To Plc | Logged - Header Only |
| Return Controller Type And Id Information | Logged - Header Only |
| Toggle Force System Memory | Logged - Header Only |
ICSNPP Packages
All ICSNPP Packages:
Full ICS Protocol Parsers:
- BACnet
- Full Zeek protocol parser for BACnet (Building Control and Automation)
- BSAP
- Full Zeek protocol parser for BSAP (Bristol Standard Asynchronous Protocol) over IP
- Full Zeek protocol parser for BSAP Serial comm converted using serial tap device
- Ethercat
- Full Zeek protocol parser for Ethercat
- Ethernet/IP and CIP
- Full Zeek protocol parser for Ethernet/IP and CIP
- Genisys
- Full Zeek protocol parser for Genisys
- OPCUA-Binary
- Full Zeek protocol parser for OPC UA (OPC Unified Architecture) - Binary
- S7Comm
- Full Zeek protocol parser for S7comm, S7comm-plus, and COTP
- Synchrophasor
- Full Zeek protocol parser for Synchrophasor Data Transfer for Power Systems (C37.118)
- Profinet IO CM
- Full Zeek protocol parser for Profinet I/O Context Manager
Updates to Zeek ICS Protocol Parsers:
- DNP3
- DNP3 Zeek script extending logging capabilities of Zeek's default DNP3 protocol parser
- Modbus
- Modbus Zeek script extending logging capabilities of Zeek's default Modbus protocol parser
License
Copyright 2023 Battelle Energy Alliance, LLC. Released under the terms of the 3-Clause BSD License (see LICENSE.txt).
~