|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Main menu:
BLOG CATEGORIES:
|
DNP3 IDS SignaturesDNP3 is a very simple client/server protocol that was originally designed for very low speed serial communication in process control networks. DNP3 is most commonly used in electric utilities, but there is nothing specific to the electric industry in the protocol. The client, also referred to as the master, is typically a HMI or control server that issues DNP3 requests to a PLC, RTU, or other field device acting as a DNP3 server, also called the slave. Common request types include read requests, write requests, starting and stopping applications, freezing values to buffers, and a variety of administrative and diagnostic requests. DNP3 also supports unsolicited response – - communication initiated by the DNP3 server without a request packet. Unsolicited response is often used to immediately notify the Control Center of significant events or changes in the field. Many systems decrease the polling interval and enable unsolicited responses to reduce communications without losing time sensitive information. All unsolicited responses use function code 82. All of the DNP3 Snort rules are applicable only to DNP3. You will need to add a few items to your Snort setup:
Digital Bond has also developed a DNP3 preprocessor. The DNP3 preprocessor prevents false negatives due to DNP3 fragmentation. It also has plugins that adds new keyword capabilities for easier Snort signature writing. The DNP3 preprocessor patch must be applied to the Snort application and the following line must be added to the config file:
The preprocessor column should be read as follows:
The rules and links to the documentation are including in the table below.
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||