Re: Live capture configuration

--===============1966106864==
Content-Type: multipart/alternative; boundary="0000000000005b1b62059a9be022"

--0000000000005b1b62059a9be022
Content-Type: text/plain; charset="UTF-8"

On Wed, Dec 25, 2019 at 10:34 AM mxd6 <[email protected]> wrote:

> I'm trying to setup my ZEEK system to do both MODBUS and DNP3 live capture
> on the network. When I include the following statements into my local.zeek
> file it fails on deployment with the error "fatal error in
> ../../../local.zeek. Can't find protocols/modbus/software"
>
> Here is my load statements in local.zeek:
>
> @load protocols/modbus/software
> @load protocols/dnp3/software
>
> Any suggestion or examples on configurations for live capture for these
> two protocols?
>
> Any help would be greatly appreciated!
>

Those scripts don't actually exist, only a few protocols have the
'software' scripts;

scripts/policy/protocols/ftp/software.zeek
scripts/policy/protocols/ssh/software.zeek
scripts/policy/protocols/http/software-browser-plugins.zeek
scripts/policy/protocols/http/software.zeek
scripts/policy/protocols/smtp/software.zeek
scripts/policy/protocols/mysql/software.zeek
scripts/policy/protocols/dhcp/software.zeek

The default scripts/base/init-default.zeek already contains the @load
statements for the base dnp3 and modbus scripts;

@load base/protocols/dnp3
@load base/protocols/modbus

so you shouldn't have to do any configuration to analyze these protocols.




-- 
Justin

--0000000000005b1b62059a9be022
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote">=
<div dir=3D"ltr" class=3D"gmail_attr">On Wed, Dec 25, 2019 at 10:34 AM mxd6=
 &lt;<a href=3D"mailto:[email protected]">[email protected]</a>&gt; wrote:<br=
></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;=
border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"auto">=
<div dir=3D"auto">I&#39;m trying to setup my ZEEK system to do both MODBUS =
and DNP3 live capture on the network. When I include the following statemen=
ts into my local.zeek file it fails on deployment with the error &quot;fata=
l error in ../../../local.zeek. Can&#39;t find protocols/modbus/software&qu=
ot;</div><div dir=3D"auto"><br>Here is my load statements in local.zeek:<br=
><br>@load protocols/modbus/software<br>@load protocols/dnp3/software</div>=
<div dir=3D"auto"><br></div><div dir=3D"auto">Any suggestion or examples on=
 configurations for live capture for these two protocols?<br><br>Any help w=
ould be greatly appreciated!<br></div></div></blockquote><div><br></div><di=
v>Those scripts don&#39;t actually exist, only a few protocols have the &#3=
9;software&#39; scripts;</div><div><br></div><div>scripts/policy/protocols/=
ftp/software.zeek<br>scripts/policy/protocols/ssh/software.zeek<br>scripts/=
policy/protocols/http/software-browser-plugins.zeek<br>scripts/policy/proto=
cols/http/software.zeek<br>scripts/policy/protocols/smtp/software.zeek<br>s=
cripts/policy/protocols/mysql/software.zeek<br>scripts/policy/protocols/dhc=
p/software.zeek<br></div><div><br></div><div>The default scripts/base/init-=
default.zeek already contains the=C2=A0@load statements for the base dnp3 a=
nd modbus scripts;<br></div><div><br></div><div>@load base/protocols/dnp3<b=
r>@load base/protocols/modbus<br></div><div><br></div><div>so you shouldn&#=
39;t have to do any configuration to analyze these protocols.</div><div><br=
></div><div><br></div><div>=C2=A0</div></div><div><br></div>-- <br><div dir=
=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr">Justin</div></div></div=
>

--0000000000005b1b62059a9be022--

--===============1966106864==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1966106864==--