S7Comm-Analyzer

https://github.com/dw2102/S7Comm-Analyzer
0 36 15 0 Last Push 6/23/23, 11:48 AM

ISO over TCP / S7Comm protocol analyzer.

Based on the Wireshark dissector written by Thomas Wiens https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-s7comm.h https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-s7comm.c https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-s7comm_szl_ids.h https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-s7comm_szl_ids.c https://sourceforge.net/projects/s7commwireshark/

partially on the PoC S7Comm-Bro-Plugin written by György Miru https://github.com/CrySyS/bro-step7-plugin/blob/master/README.md,

RFC 1006 (ISO Transport Service on top of the TCP) https://tools.ietf.org/html/rfc1006

and RFC 905 (ISO Transport Protocol Specification) https://tools.ietf.org/html/rfc0905

Author: Dane Wullen Date: 02.06.2023 Version: 1.1

This plugin was a part of a master's thesis written at Fachhochschule in Aachen (Aachen University of Applied Sciences) Rewritten for Zeek version 5.0.9

Package Version :

Description :

Protocol parser for the Siemens S7Comm and S7CommPlus protocol.
Both parser are based on the Iso-Over-TCP protocol. Not all functions are covered
in this analyzer, it may not capture all of the packets.

Script Dir :

scripts/

Build Command :

./configure && make

Tags :

zeek plugin, protocol analyzer, s7comm, s7commplus, siemens, zeek