Zeek-Parser-CCLinkFieldBasic
English is here
æ¦è¦
Zeek-Parser-CCLinkFieldBasicã¨ã¯CC-Linkãã¡ããªã¼ã®CC-Link IE Field Basicãè§£æã§ããZeekãã©ã°ã¤ã³ã§ãã
ã¤ã³ã¹ãã¼ã«
ããã±ã¼ã¸ããã¼ã¸ã£ã¼ã«ããã¤ã³ã¹ãã¼ã«
ãã®ãã©ã°ã¤ã³ã¯Zeek Package Mangerç¨ã®ããã±ã¼ã¸ã¨ãã¦æä¾ããã¦ãã¾ãã
以ä¸ã®ã³ãã³ããå®è¡ãããã¨ã§ãæ¬ãã©ã°ã¤ã³ã¯å©ç¨å¯è½ã«ãªãã¾ãã
zkg refresh
zkg install zeek-parser-CCLinkFieldBasic
ããã¥ã¢ã«ã¤ã³ã¹ãã¼ã«
æ¬ãã©ã°ã¤ã³ãå©ç¨ããåã«ãZeek, Spicyãã¤ã³ã¹ãã¼ã«ããã¦ãããã¨ã確èªãã¾ãã
# Zeekã®ãã§ãã¯
~$ zeek -version
zeek version 5.0.0
# Spicyã®ãã§ãã¯
~$ spicyz -version
1.3.16
~$ spicyc -version
spicyc v1.5.0 (d0bc6053)
# æ¬ããã¥ã¢ã«ã§ã¯Zeekã®ãã¹ã以ä¸ã§ãããã¨ãåæã¨ãã¦ãã¾ãã
~$ which zeek
/usr/local/zeek/bin/zeek
æ¬ãªãã¸ããªããã¼ã«ã«ç°å¢ã« git clone
ãã¾ãã
~$ git clone https://github.com/nttcom/zeek-parser-CCLinkFieldBasic.git
ä½¿ãæ¹
ããã±ã¼ã¸ããã¼ã¸ã£ã¼ã«ããã¤ã³ã¹ãã¼ã«ã®å ´å
以ä¸ã®ããã«æ¬ãã©ã°ã¤ã³ã使ããã¨ã§ cclink-ief-basic.log
ãçæããã¾ãã
zeek -Cr /usr/local/zeek/var/lib/zkg/clones/package/zeek-parser-CCLinkFieldBasic/testing/Traces/cclink_ief_basic_only.pcap zeek-parser-CCLinkFieldBasic
ããã¥ã¢ã«ã¤ã³ã¹ãã¼ã«ã®å ´å
ã½ã¼ã¹ã³ã¼ããã³ã³ãã¤ã«ãã¦ããªãã¸ã§ã¯ããã¡ã¤ã«ã以ä¸ã®ãã¹ã«ã³ãã¼ãã¾ãã
~$ cd ~/zeek-parser-CCLinkFieldBasic/analyzer
~$ spicyz -o cc_link_basic.hlto cc_link_basic.spicy cc_link_basic.evt
~$ # cc_link_basic.hltoãçæããã¾ã
~$ cp cc_link_basic.hlto /usr/local/zeek/lib/zeek-spicy/modules/
åæ§ã«Zeekãã¡ã¤ã«ã以ä¸ã®ãã¹ã«ã³ãã¼ãã¾ãã
~$ cd ~/zeek-parser-CCLinkFieldBasic/scripts/
~$ cp main.zeek /usr/local/zeek/share/zeek/site/cc_link_basic.zeek
æå¾ã«Zeekãã©ã°ã¤ã³ãã¤ã³ãã¼ããã¾ãã
~$ tail /usr/local/zeek/share/zeek/site/local.zeek
...çç¥...
@load cc_link_basic
æ¬ãã©ã°ã¤ã³ã使ããã¨ã§ cclink-ief-basic.log
ãçæããã¾ãã
~$ cd ~/zeek-parser-CCLinkFieldBasic/testing/Traces
~$ zeek -Cr cclink_ief_basic_only.pcap /usr/local/zeek/share/zeek/site/cc_link_basic.zeek
ãã°ã®ã¿ã¤ãã¨èª¬æ
æ¬ãã©ã°ã¤ã³ã¯CC-Link IE Field Basicã®å
¨ã¦ã®é¢æ°ãç£è¦ãã¦cclink-ief-basic.log
ã¨ãã¦åºåãã¾ãã
ãã£ã¼ã«ã | ã¿ã¤ã | 説æ |
---|---|---|
ts | time | æåã«éä¿¡ããæã®ã¿ã¤ã ã¹ã¿ã³ã |
uid | string | ã¦ãã¼ã¯ID |
id.orig_h | addr | éä¿¡å IPã¢ãã¬ã¹ |
id.orig_p | port | éä¿¡å ãã¼ãçªå· |
id.resp_h | addr | å®å IPã¢ãã¬ã¹ |
id.resp_p | port | å®å ãã¼ãçªå· |
pdu | string | ãããã³ã«ã®é¢æ°å |
cmd | string | cyclic ã¾ã㯠- |
number | int | ãã±ããåºç¾åæ° |
ts_end | time | æå¾ã«éä¿¡ããæã®ã¿ã¤ã ã¹ã¿ã³ã |
cclink-ief-basic.log
ã®ä¾ã¯ä»¥ä¸ã®ã¨ããã§ãã
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path cclink-ief-basic
#open 2023-05-27-00-52-06
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p pdu cmd number ts_end
#types time string addr port addr port string string int time
1655284124.953994 CIAp8bugKIZRVpAYk 172.16.134.129 61450 172.16.134.128 61450 cyclicDataRes - 222 1655284149.499713
1655284124.859924 Ckkc3929guO41BnpSa 172.16.134.128 61450 172.16.134.255 61450 cyclicDataReq cyclic 222 1655284149.392238
#close 2023-05-27-00-52-06
é¢é£ã½ããã¦ã§ã¢
æ¬ãã©ã°ã¤ã³ã¯OsecTã§å©ç¨ããã¦ãã¾ãã