From e7efdf623bc1744070d8414f3fdae0cd0ea0b579 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Fri, 10 Jul 2020 16:29:53 -0600 Subject: [PATCH] dnp3: new test with more detail Also rename to make it clear its an dnp3/eve test. --- tests/{dnp3 => dnp3-eve}/input.pcap | Bin tests/dnp3-eve/suricata.yaml | 19 + tests/dnp3-eve/test.yaml | 2707 +++++++++++++++++++++++++++ tests/dnp3/check.sh | 9 - tests/dnp3/suricata.yaml | 30 - tests/dnp3/test.yaml | 3 - 6 files changed, 2726 insertions(+), 42 deletions(-) rename tests/{dnp3 => dnp3-eve}/input.pcap (100%) create mode 100644 tests/dnp3-eve/suricata.yaml create mode 100644 tests/dnp3-eve/test.yaml delete mode 100755 tests/dnp3/check.sh delete mode 100644 tests/dnp3/suricata.yaml delete mode 100644 tests/dnp3/test.yaml diff --git a/tests/dnp3/input.pcap b/tests/dnp3-eve/input.pcap similarity index 100% rename from tests/dnp3/input.pcap rename to tests/dnp3-eve/input.pcap diff --git a/tests/dnp3-eve/suricata.yaml b/tests/dnp3-eve/suricata.yaml new file mode 100644 index 000000000..9b0aa5f59 --- /dev/null +++ b/tests/dnp3-eve/suricata.yaml @@ -0,0 +1,19 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - dnp3 + - flow + +app-layer: + protocols: + dnp3: + enabled: yes + detection-ports: + dp: 20000 diff --git a/tests/dnp3-eve/test.yaml b/tests/dnp3-eve/test.yaml new file mode 100644 index 000000000..dbd97315f --- /dev/null +++ b/tests/dnp3-eve/test.yaml @@ -0,0 +1,2707 @@ +# *** Add configuration here *** + +checks: +- filter: + count: 55 + match: + event_type: dnp3 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 0 + dnp3.application.control.uns: false + dnp3.application.function_code: 21 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.application.objects[1].count: 0 + dnp3.application.objects[1].group: 60 + dnp3.application.objects[1].prefix_code: 0 + dnp3.application.objects[1].qualifier: 6 + dnp3.application.objects[1].range_code: 6 + dnp3.application.objects[1].start: 0 + dnp3.application.objects[1].stop: 0 + dnp3.application.objects[1].variation: 3 + dnp3.application.objects[2].count: 0 + dnp3.application.objects[2].group: 60 + dnp3.application.objects[2].prefix_code: 0 + dnp3.application.objects[2].qualifier: 6 + dnp3.application.objects[2].range_code: 6 + dnp3.application.objects[2].start: 0 + dnp3.application.objects[2].stop: 0 + dnp3.application.objects[2].variation: 4 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 5 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 0 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.iin.indicators[0]: device_restart + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 7 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 0 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.iin.indicators[0]: device_restart + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 11 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 1 + dnp3.application.control.uns: false + dnp3.application.function_code: 2 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 80 + dnp3.application.objects[0].points[0].index: 7 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].state: 0 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 0 + dnp3.application.objects[0].range_code: 0 + dnp3.application.objects[0].start: 7 + dnp3.application.objects[0].stop: 7 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 13 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 1 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 14 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 2 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.application.objects[1].count: 0 + dnp3.application.objects[1].group: 60 + dnp3.application.objects[1].prefix_code: 0 + dnp3.application.objects[1].qualifier: 6 + dnp3.application.objects[1].range_code: 6 + dnp3.application.objects[1].start: 0 + dnp3.application.objects[1].stop: 0 + dnp3.application.objects[1].variation: 3 + dnp3.application.objects[2].count: 0 + dnp3.application.objects[2].group: 60 + dnp3.application.objects[2].prefix_code: 0 + dnp3.application.objects[2].qualifier: 6 + dnp3.application.objects[2].range_code: 6 + dnp3.application.objects[2].start: 0 + dnp3.application.objects[2].stop: 0 + dnp3.application.objects[2].variation: 4 + dnp3.application.objects[3].count: 0 + dnp3.application.objects[3].group: 60 + dnp3.application.objects[3].prefix_code: 0 + dnp3.application.objects[3].qualifier: 6 + dnp3.application.objects[3].range_code: 6 + dnp3.application.objects[3].start: 0 + dnp3.application.objects[3].stop: 0 + dnp3.application.objects[3].variation: 1 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 16 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 2 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.application.objects[0].count: 10 + dnp3.application.objects[0].group: 1 + dnp3.application.objects[0].points[0].chatter_filter: 0 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 0 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].reserved: 0 + dnp3.application.objects[0].points[0].restart: 1 + dnp3.application.objects[0].points[0].state: 0 + dnp3.application.objects[0].points[1].chatter_filter: 0 + dnp3.application.objects[0].points[1].comm_lost: 0 + dnp3.application.objects[0].points[1].index: 1 + dnp3.application.objects[0].points[1].local_forced: 0 + dnp3.application.objects[0].points[1].online: 0 + dnp3.application.objects[0].points[1].prefix: 0 + dnp3.application.objects[0].points[1].remote_forced: 0 + dnp3.application.objects[0].points[1].reserved: 0 + dnp3.application.objects[0].points[1].restart: 1 + dnp3.application.objects[0].points[1].state: 0 + dnp3.application.objects[0].points[2].chatter_filter: 0 + dnp3.application.objects[0].points[2].comm_lost: 0 + dnp3.application.objects[0].points[2].index: 2 + dnp3.application.objects[0].points[2].local_forced: 0 + dnp3.application.objects[0].points[2].online: 0 + dnp3.application.objects[0].points[2].prefix: 0 + dnp3.application.objects[0].points[2].remote_forced: 0 + dnp3.application.objects[0].points[2].reserved: 0 + dnp3.application.objects[0].points[2].restart: 1 + dnp3.application.objects[0].points[2].state: 0 + dnp3.application.objects[0].points[3].chatter_filter: 0 + dnp3.application.objects[0].points[3].comm_lost: 0 + dnp3.application.objects[0].points[3].index: 3 + dnp3.application.objects[0].points[3].local_forced: 0 + dnp3.application.objects[0].points[3].online: 0 + dnp3.application.objects[0].points[3].prefix: 0 + dnp3.application.objects[0].points[3].remote_forced: 0 + dnp3.application.objects[0].points[3].reserved: 0 + dnp3.application.objects[0].points[3].restart: 1 + dnp3.application.objects[0].points[3].state: 0 + dnp3.application.objects[0].points[4].chatter_filter: 0 + dnp3.application.objects[0].points[4].comm_lost: 0 + dnp3.application.objects[0].points[4].index: 4 + dnp3.application.objects[0].points[4].local_forced: 0 + dnp3.application.objects[0].points[4].online: 0 + dnp3.application.objects[0].points[4].prefix: 0 + dnp3.application.objects[0].points[4].remote_forced: 0 + dnp3.application.objects[0].points[4].reserved: 0 + dnp3.application.objects[0].points[4].restart: 1 + dnp3.application.objects[0].points[4].state: 0 + dnp3.application.objects[0].points[5].chatter_filter: 0 + dnp3.application.objects[0].points[5].comm_lost: 0 + dnp3.application.objects[0].points[5].index: 5 + dnp3.application.objects[0].points[5].local_forced: 0 + dnp3.application.objects[0].points[5].online: 0 + dnp3.application.objects[0].points[5].prefix: 0 + dnp3.application.objects[0].points[5].remote_forced: 0 + dnp3.application.objects[0].points[5].reserved: 0 + dnp3.application.objects[0].points[5].restart: 1 + dnp3.application.objects[0].points[5].state: 0 + dnp3.application.objects[0].points[6].chatter_filter: 0 + dnp3.application.objects[0].points[6].comm_lost: 0 + dnp3.application.objects[0].points[6].index: 6 + dnp3.application.objects[0].points[6].local_forced: 0 + dnp3.application.objects[0].points[6].online: 0 + dnp3.application.objects[0].points[6].prefix: 0 + dnp3.application.objects[0].points[6].remote_forced: 0 + dnp3.application.objects[0].points[6].reserved: 0 + dnp3.application.objects[0].points[6].restart: 1 + dnp3.application.objects[0].points[6].state: 0 + dnp3.application.objects[0].points[7].chatter_filter: 0 + dnp3.application.objects[0].points[7].comm_lost: 0 + dnp3.application.objects[0].points[7].index: 7 + dnp3.application.objects[0].points[7].local_forced: 0 + dnp3.application.objects[0].points[7].online: 0 + dnp3.application.objects[0].points[7].prefix: 0 + dnp3.application.objects[0].points[7].remote_forced: 0 + dnp3.application.objects[0].points[7].reserved: 0 + dnp3.application.objects[0].points[7].restart: 1 + dnp3.application.objects[0].points[7].state: 0 + dnp3.application.objects[0].points[8].chatter_filter: 0 + dnp3.application.objects[0].points[8].comm_lost: 0 + dnp3.application.objects[0].points[8].index: 8 + dnp3.application.objects[0].points[8].local_forced: 0 + dnp3.application.objects[0].points[8].online: 0 + dnp3.application.objects[0].points[8].prefix: 0 + dnp3.application.objects[0].points[8].remote_forced: 0 + dnp3.application.objects[0].points[8].reserved: 0 + dnp3.application.objects[0].points[8].restart: 1 + dnp3.application.objects[0].points[8].state: 0 + dnp3.application.objects[0].points[9].chatter_filter: 0 + dnp3.application.objects[0].points[9].comm_lost: 0 + dnp3.application.objects[0].points[9].index: 9 + dnp3.application.objects[0].points[9].local_forced: 0 + dnp3.application.objects[0].points[9].online: 0 + dnp3.application.objects[0].points[9].prefix: 0 + dnp3.application.objects[0].points[9].remote_forced: 0 + dnp3.application.objects[0].points[9].reserved: 0 + dnp3.application.objects[0].points[9].restart: 1 + dnp3.application.objects[0].points[9].state: 0 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 0 + dnp3.application.objects[0].range_code: 0 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 9 + dnp3.application.objects[0].variation: 2 + dnp3.application.objects[1].count: 10 + dnp3.application.objects[1].group: 3 + dnp3.application.objects[1].points[0].chatter_filter: 0 + dnp3.application.objects[1].points[0].comm_lost: 0 + dnp3.application.objects[1].points[0].index: 0 + dnp3.application.objects[1].points[0].local_forced: 0 + dnp3.application.objects[1].points[0].online: 0 + dnp3.application.objects[1].points[0].prefix: 0 + dnp3.application.objects[1].points[0].remote_forced: 0 + dnp3.application.objects[1].points[0].restart: 1 + dnp3.application.objects[1].points[0].state: 0 + dnp3.application.objects[1].points[1].chatter_filter: 0 + dnp3.application.objects[1].points[1].comm_lost: 0 + dnp3.application.objects[1].points[1].index: 1 + dnp3.application.objects[1].points[1].local_forced: 0 + dnp3.application.objects[1].points[1].online: 0 + dnp3.application.objects[1].points[1].prefix: 0 + dnp3.application.objects[1].points[1].remote_forced: 0 + dnp3.application.objects[1].points[1].restart: 1 + dnp3.application.objects[1].points[1].state: 0 + dnp3.application.objects[1].points[2].chatter_filter: 0 + dnp3.application.objects[1].points[2].comm_lost: 0 + dnp3.application.objects[1].points[2].index: 2 + dnp3.application.objects[1].points[2].local_forced: 0 + dnp3.application.objects[1].points[2].online: 0 + dnp3.application.objects[1].points[2].prefix: 0 + dnp3.application.objects[1].points[2].remote_forced: 0 + dnp3.application.objects[1].points[2].restart: 1 + dnp3.application.objects[1].points[2].state: 0 + dnp3.application.objects[1].points[3].chatter_filter: 0 + dnp3.application.objects[1].points[3].comm_lost: 0 + dnp3.application.objects[1].points[3].index: 3 + dnp3.application.objects[1].points[3].local_forced: 0 + dnp3.application.objects[1].points[3].online: 0 + dnp3.application.objects[1].points[3].prefix: 0 + dnp3.application.objects[1].points[3].remote_forced: 0 + dnp3.application.objects[1].points[3].restart: 1 + dnp3.application.objects[1].points[3].state: 0 + dnp3.application.objects[1].points[4].chatter_filter: 0 + dnp3.application.objects[1].points[4].comm_lost: 0 + dnp3.application.objects[1].points[4].index: 4 + dnp3.application.objects[1].points[4].local_forced: 0 + dnp3.application.objects[1].points[4].online: 0 + dnp3.application.objects[1].points[4].prefix: 0 + dnp3.application.objects[1].points[4].remote_forced: 0 + dnp3.application.objects[1].points[4].restart: 1 + dnp3.application.objects[1].points[4].state: 0 + dnp3.application.objects[1].points[5].chatter_filter: 0 + dnp3.application.objects[1].points[5].comm_lost: 0 + dnp3.application.objects[1].points[5].index: 5 + dnp3.application.objects[1].points[5].local_forced: 0 + dnp3.application.objects[1].points[5].online: 0 + dnp3.application.objects[1].points[5].prefix: 0 + dnp3.application.objects[1].points[5].remote_forced: 0 + dnp3.application.objects[1].points[5].restart: 1 + dnp3.application.objects[1].points[5].state: 0 + dnp3.application.objects[1].points[6].chatter_filter: 0 + dnp3.application.objects[1].points[6].comm_lost: 0 + dnp3.application.objects[1].points[6].index: 6 + dnp3.application.objects[1].points[6].local_forced: 0 + dnp3.application.objects[1].points[6].online: 0 + dnp3.application.objects[1].points[6].prefix: 0 + dnp3.application.objects[1].points[6].remote_forced: 0 + dnp3.application.objects[1].points[6].restart: 1 + dnp3.application.objects[1].points[6].state: 0 + dnp3.application.objects[1].points[7].chatter_filter: 0 + dnp3.application.objects[1].points[7].comm_lost: 0 + dnp3.application.objects[1].points[7].index: 7 + dnp3.application.objects[1].points[7].local_forced: 0 + dnp3.application.objects[1].points[7].online: 0 + dnp3.application.objects[1].points[7].prefix: 0 + dnp3.application.objects[1].points[7].remote_forced: 0 + dnp3.application.objects[1].points[7].restart: 1 + dnp3.application.objects[1].points[7].state: 0 + dnp3.application.objects[1].points[8].chatter_filter: 0 + dnp3.application.objects[1].points[8].comm_lost: 0 + dnp3.application.objects[1].points[8].index: 8 + dnp3.application.objects[1].points[8].local_forced: 0 + dnp3.application.objects[1].points[8].online: 0 + dnp3.application.objects[1].points[8].prefix: 0 + dnp3.application.objects[1].points[8].remote_forced: 0 + dnp3.application.objects[1].points[8].restart: 1 + dnp3.application.objects[1].points[8].state: 0 + dnp3.application.objects[1].points[9].chatter_filter: 0 + dnp3.application.objects[1].points[9].comm_lost: 0 + dnp3.application.objects[1].points[9].index: 9 + dnp3.application.objects[1].points[9].local_forced: 0 + dnp3.application.objects[1].points[9].online: 0 + dnp3.application.objects[1].points[9].prefix: 0 + dnp3.application.objects[1].points[9].remote_forced: 0 + dnp3.application.objects[1].points[9].restart: 1 + dnp3.application.objects[1].points[9].state: 0 + dnp3.application.objects[1].prefix_code: 0 + dnp3.application.objects[1].qualifier: 0 + dnp3.application.objects[1].range_code: 0 + dnp3.application.objects[1].start: 0 + dnp3.application.objects[1].stop: 9 + dnp3.application.objects[1].variation: 2 + dnp3.application.objects[2].count: 10 + dnp3.application.objects[2].group: 20 + dnp3.application.objects[2].points[0].comm_lost: 0 + dnp3.application.objects[2].points[0].count: 0 + dnp3.application.objects[2].points[0].discontinuity: 0 + dnp3.application.objects[2].points[0].index: 0 + dnp3.application.objects[2].points[0].local_forced: 0 + dnp3.application.objects[2].points[0].online: 0 + dnp3.application.objects[2].points[0].prefix: 0 + dnp3.application.objects[2].points[0].remote_forced: 0 + dnp3.application.objects[2].points[0].reserved0: 0 + dnp3.application.objects[2].points[0].restart: 1 + dnp3.application.objects[2].points[0].rollover: 0 + dnp3.application.objects[2].points[1].comm_lost: 0 + dnp3.application.objects[2].points[1].count: 0 + dnp3.application.objects[2].points[1].discontinuity: 0 + dnp3.application.objects[2].points[1].index: 1 + dnp3.application.objects[2].points[1].local_forced: 0 + dnp3.application.objects[2].points[1].online: 0 + dnp3.application.objects[2].points[1].prefix: 0 + dnp3.application.objects[2].points[1].remote_forced: 0 + dnp3.application.objects[2].points[1].reserved0: 0 + dnp3.application.objects[2].points[1].restart: 1 + dnp3.application.objects[2].points[1].rollover: 0 + dnp3.application.objects[2].points[2].comm_lost: 0 + dnp3.application.objects[2].points[2].count: 0 + dnp3.application.objects[2].points[2].discontinuity: 0 + dnp3.application.objects[2].points[2].index: 2 + dnp3.application.objects[2].points[2].local_forced: 0 + dnp3.application.objects[2].points[2].online: 0 + dnp3.application.objects[2].points[2].prefix: 0 + dnp3.application.objects[2].points[2].remote_forced: 0 + dnp3.application.objects[2].points[2].reserved0: 0 + dnp3.application.objects[2].points[2].restart: 1 + dnp3.application.objects[2].points[2].rollover: 0 + dnp3.application.objects[2].points[3].comm_lost: 0 + dnp3.application.objects[2].points[3].count: 0 + dnp3.application.objects[2].points[3].discontinuity: 0 + dnp3.application.objects[2].points[3].index: 3 + dnp3.application.objects[2].points[3].local_forced: 0 + dnp3.application.objects[2].points[3].online: 0 + dnp3.application.objects[2].points[3].prefix: 0 + dnp3.application.objects[2].points[3].remote_forced: 0 + dnp3.application.objects[2].points[3].reserved0: 0 + dnp3.application.objects[2].points[3].restart: 1 + dnp3.application.objects[2].points[3].rollover: 0 + dnp3.application.objects[2].points[4].comm_lost: 0 + dnp3.application.objects[2].points[4].count: 0 + dnp3.application.objects[2].points[4].discontinuity: 0 + dnp3.application.objects[2].points[4].index: 4 + dnp3.application.objects[2].points[4].local_forced: 0 + dnp3.application.objects[2].points[4].online: 0 + dnp3.application.objects[2].points[4].prefix: 0 + dnp3.application.objects[2].points[4].remote_forced: 0 + dnp3.application.objects[2].points[4].reserved0: 0 + dnp3.application.objects[2].points[4].restart: 1 + dnp3.application.objects[2].points[4].rollover: 0 + dnp3.application.objects[2].points[5].comm_lost: 0 + dnp3.application.objects[2].points[5].count: 0 + dnp3.application.objects[2].points[5].discontinuity: 0 + dnp3.application.objects[2].points[5].index: 5 + dnp3.application.objects[2].points[5].local_forced: 0 + dnp3.application.objects[2].points[5].online: 0 + dnp3.application.objects[2].points[5].prefix: 0 + dnp3.application.objects[2].points[5].remote_forced: 0 + dnp3.application.objects[2].points[5].reserved0: 0 + dnp3.application.objects[2].points[5].restart: 1 + dnp3.application.objects[2].points[5].rollover: 0 + dnp3.application.objects[2].points[6].comm_lost: 0 + dnp3.application.objects[2].points[6].count: 0 + dnp3.application.objects[2].points[6].discontinuity: 0 + dnp3.application.objects[2].points[6].index: 6 + dnp3.application.objects[2].points[6].local_forced: 0 + dnp3.application.objects[2].points[6].online: 0 + dnp3.application.objects[2].points[6].prefix: 0 + dnp3.application.objects[2].points[6].remote_forced: 0 + dnp3.application.objects[2].points[6].reserved0: 0 + dnp3.application.objects[2].points[6].restart: 1 + dnp3.application.objects[2].points[6].rollover: 0 + dnp3.application.objects[2].points[7].comm_lost: 0 + dnp3.application.objects[2].points[7].count: 0 + dnp3.application.objects[2].points[7].discontinuity: 0 + dnp3.application.objects[2].points[7].index: 7 + dnp3.application.objects[2].points[7].local_forced: 0 + dnp3.application.objects[2].points[7].online: 0 + dnp3.application.objects[2].points[7].prefix: 0 + dnp3.application.objects[2].points[7].remote_forced: 0 + dnp3.application.objects[2].points[7].reserved0: 0 + dnp3.application.objects[2].points[7].restart: 1 + dnp3.application.objects[2].points[7].rollover: 0 + dnp3.application.objects[2].points[8].comm_lost: 0 + dnp3.application.objects[2].points[8].count: 0 + dnp3.application.objects[2].points[8].discontinuity: 0 + dnp3.application.objects[2].points[8].index: 8 + dnp3.application.objects[2].points[8].local_forced: 0 + dnp3.application.objects[2].points[8].online: 0 + dnp3.application.objects[2].points[8].prefix: 0 + dnp3.application.objects[2].points[8].remote_forced: 0 + dnp3.application.objects[2].points[8].reserved0: 0 + dnp3.application.objects[2].points[8].restart: 1 + dnp3.application.objects[2].points[8].rollover: 0 + dnp3.application.objects[2].points[9].comm_lost: 0 + dnp3.application.objects[2].points[9].count: 0 + dnp3.application.objects[2].points[9].discontinuity: 0 + dnp3.application.objects[2].points[9].index: 9 + dnp3.application.objects[2].points[9].local_forced: 0 + dnp3.application.objects[2].points[9].online: 0 + dnp3.application.objects[2].points[9].prefix: 0 + dnp3.application.objects[2].points[9].remote_forced: 0 + dnp3.application.objects[2].points[9].reserved0: 0 + dnp3.application.objects[2].points[9].restart: 1 + dnp3.application.objects[2].points[9].rollover: 0 + dnp3.application.objects[2].prefix_code: 0 + dnp3.application.objects[2].qualifier: 0 + dnp3.application.objects[2].range_code: 0 + dnp3.application.objects[2].start: 0 + dnp3.application.objects[2].stop: 9 + dnp3.application.objects[2].variation: 1 + dnp3.application.objects[3].count: 10 + dnp3.application.objects[3].group: 21 + dnp3.application.objects[3].points[0].comm_lost: 0 + dnp3.application.objects[3].points[0].count: 0 + dnp3.application.objects[3].points[0].discontinuity: 0 + dnp3.application.objects[3].points[0].index: 0 + dnp3.application.objects[3].points[0].local_forced: 0 + dnp3.application.objects[3].points[0].online: 0 + dnp3.application.objects[3].points[0].prefix: 0 + dnp3.application.objects[3].points[0].remote_forced: 0 + dnp3.application.objects[3].points[0].reserved0: 0 + dnp3.application.objects[3].points[0].restart: 1 + dnp3.application.objects[3].points[0].rollover: 0 + dnp3.application.objects[3].points[1].comm_lost: 0 + dnp3.application.objects[3].points[1].count: 0 + dnp3.application.objects[3].points[1].discontinuity: 0 + dnp3.application.objects[3].points[1].index: 1 + dnp3.application.objects[3].points[1].local_forced: 0 + dnp3.application.objects[3].points[1].online: 0 + dnp3.application.objects[3].points[1].prefix: 0 + dnp3.application.objects[3].points[1].remote_forced: 0 + dnp3.application.objects[3].points[1].reserved0: 0 + dnp3.application.objects[3].points[1].restart: 1 + dnp3.application.objects[3].points[1].rollover: 0 + dnp3.application.objects[3].points[2].comm_lost: 0 + dnp3.application.objects[3].points[2].count: 0 + dnp3.application.objects[3].points[2].discontinuity: 0 + dnp3.application.objects[3].points[2].index: 2 + dnp3.application.objects[3].points[2].local_forced: 0 + dnp3.application.objects[3].points[2].online: 0 + dnp3.application.objects[3].points[2].prefix: 0 + dnp3.application.objects[3].points[2].remote_forced: 0 + dnp3.application.objects[3].points[2].reserved0: 0 + dnp3.application.objects[3].points[2].restart: 1 + dnp3.application.objects[3].points[2].rollover: 0 + dnp3.application.objects[3].points[3].comm_lost: 0 + dnp3.application.objects[3].points[3].count: 0 + dnp3.application.objects[3].points[3].discontinuity: 0 + dnp3.application.objects[3].points[3].index: 3 + dnp3.application.objects[3].points[3].local_forced: 0 + dnp3.application.objects[3].points[3].online: 0 + dnp3.application.objects[3].points[3].prefix: 0 + dnp3.application.objects[3].points[3].remote_forced: 0 + dnp3.application.objects[3].points[3].reserved0: 0 + dnp3.application.objects[3].points[3].restart: 1 + dnp3.application.objects[3].points[3].rollover: 0 + dnp3.application.objects[3].points[4].comm_lost: 0 + dnp3.application.objects[3].points[4].count: 0 + dnp3.application.objects[3].points[4].discontinuity: 0 + dnp3.application.objects[3].points[4].index: 4 + dnp3.application.objects[3].points[4].local_forced: 0 + dnp3.application.objects[3].points[4].online: 0 + dnp3.application.objects[3].points[4].prefix: 0 + dnp3.application.objects[3].points[4].remote_forced: 0 + dnp3.application.objects[3].points[4].reserved0: 0 + dnp3.application.objects[3].points[4].restart: 1 + dnp3.application.objects[3].points[4].rollover: 0 + dnp3.application.objects[3].points[5].comm_lost: 0 + dnp3.application.objects[3].points[5].count: 0 + dnp3.application.objects[3].points[5].discontinuity: 0 + dnp3.application.objects[3].points[5].index: 5 + dnp3.application.objects[3].points[5].local_forced: 0 + dnp3.application.objects[3].points[5].online: 0 + dnp3.application.objects[3].points[5].prefix: 0 + dnp3.application.objects[3].points[5].remote_forced: 0 + dnp3.application.objects[3].points[5].reserved0: 0 + dnp3.application.objects[3].points[5].restart: 1 + dnp3.application.objects[3].points[5].rollover: 0 + dnp3.application.objects[3].points[6].comm_lost: 0 + dnp3.application.objects[3].points[6].count: 0 + dnp3.application.objects[3].points[6].discontinuity: 0 + dnp3.application.objects[3].points[6].index: 6 + dnp3.application.objects[3].points[6].local_forced: 0 + dnp3.application.objects[3].points[6].online: 0 + dnp3.application.objects[3].points[6].prefix: 0 + dnp3.application.objects[3].points[6].remote_forced: 0 + dnp3.application.objects[3].points[6].reserved0: 0 + dnp3.application.objects[3].points[6].restart: 1 + dnp3.application.objects[3].points[6].rollover: 0 + dnp3.application.objects[3].points[7].comm_lost: 0 + dnp3.application.objects[3].points[7].count: 0 + dnp3.application.objects[3].points[7].discontinuity: 0 + dnp3.application.objects[3].points[7].index: 7 + dnp3.application.objects[3].points[7].local_forced: 0 + dnp3.application.objects[3].points[7].online: 0 + dnp3.application.objects[3].points[7].prefix: 0 + dnp3.application.objects[3].points[7].remote_forced: 0 + dnp3.application.objects[3].points[7].reserved0: 0 + dnp3.application.objects[3].points[7].restart: 1 + dnp3.application.objects[3].points[7].rollover: 0 + dnp3.application.objects[3].points[8].comm_lost: 0 + dnp3.application.objects[3].points[8].count: 0 + dnp3.application.objects[3].points[8].discontinuity: 0 + dnp3.application.objects[3].points[8].index: 8 + dnp3.application.objects[3].points[8].local_forced: 0 + dnp3.application.objects[3].points[8].online: 0 + dnp3.application.objects[3].points[8].prefix: 0 + dnp3.application.objects[3].points[8].remote_forced: 0 + dnp3.application.objects[3].points[8].reserved0: 0 + dnp3.application.objects[3].points[8].restart: 1 + dnp3.application.objects[3].points[8].rollover: 0 + dnp3.application.objects[3].points[9].comm_lost: 0 + dnp3.application.objects[3].points[9].count: 0 + dnp3.application.objects[3].points[9].discontinuity: 0 + dnp3.application.objects[3].points[9].index: 9 + dnp3.application.objects[3].points[9].local_forced: 0 + dnp3.application.objects[3].points[9].online: 0 + dnp3.application.objects[3].points[9].prefix: 0 + dnp3.application.objects[3].points[9].remote_forced: 0 + dnp3.application.objects[3].points[9].reserved0: 0 + dnp3.application.objects[3].points[9].restart: 1 + dnp3.application.objects[3].points[9].rollover: 0 + dnp3.application.objects[3].prefix_code: 0 + dnp3.application.objects[3].qualifier: 0 + dnp3.application.objects[3].range_code: 0 + dnp3.application.objects[3].start: 0 + dnp3.application.objects[3].stop: 9 + dnp3.application.objects[3].variation: 1 + dnp3.application.objects[4].count: 1 + dnp3.application.objects[4].group: 30 + dnp3.application.objects[4].points[0].comm_lost: 0 + dnp3.application.objects[4].points[0].index: 0 + dnp3.application.objects[4].points[0].local_forced: 0 + dnp3.application.objects[4].points[0].online: 0 + dnp3.application.objects[4].points[0].over_range: 0 + dnp3.application.objects[4].points[0].prefix: 0 + dnp3.application.objects[4].points[0].reference_err: 0 + dnp3.application.objects[4].points[0].remote_forced: 0 + dnp3.application.objects[4].points[0].reserved0: 0 + dnp3.application.objects[4].points[0].restart: 1 + dnp3.application.objects[4].points[0].value: 0.0 + dnp3.application.objects[4].prefix_code: 0 + dnp3.application.objects[4].qualifier: 0 + dnp3.application.objects[4].range_code: 0 + dnp3.application.objects[4].start: 0 + dnp3.application.objects[4].stop: 0 + dnp3.application.objects[4].variation: 5 + dnp3.application.objects[5].count: 9 + dnp3.application.objects[5].group: 30 + dnp3.application.objects[5].points[0].comm_lost: 0 + dnp3.application.objects[5].points[0].index: 1 + dnp3.application.objects[5].points[0].local_forced: 0 + dnp3.application.objects[5].points[0].online: 0 + dnp3.application.objects[5].points[0].over_range: 0 + dnp3.application.objects[5].points[0].prefix: 0 + dnp3.application.objects[5].points[0].reference_err: 0 + dnp3.application.objects[5].points[0].remote_forced: 0 + dnp3.application.objects[5].points[0].reserved0: 0 + dnp3.application.objects[5].points[0].restart: 1 + dnp3.application.objects[5].points[0].value: 0 + dnp3.application.objects[5].points[1].comm_lost: 0 + dnp3.application.objects[5].points[1].index: 2 + dnp3.application.objects[5].points[1].local_forced: 0 + dnp3.application.objects[5].points[1].online: 0 + dnp3.application.objects[5].points[1].over_range: 0 + dnp3.application.objects[5].points[1].prefix: 0 + dnp3.application.objects[5].points[1].reference_err: 0 + dnp3.application.objects[5].points[1].remote_forced: 0 + dnp3.application.objects[5].points[1].reserved0: 0 + dnp3.application.objects[5].points[1].restart: 1 + dnp3.application.objects[5].points[1].value: 0 + dnp3.application.objects[5].points[2].comm_lost: 0 + dnp3.application.objects[5].points[2].index: 3 + dnp3.application.objects[5].points[2].local_forced: 0 + dnp3.application.objects[5].points[2].online: 0 + dnp3.application.objects[5].points[2].over_range: 0 + dnp3.application.objects[5].points[2].prefix: 0 + dnp3.application.objects[5].points[2].reference_err: 0 + dnp3.application.objects[5].points[2].remote_forced: 0 + dnp3.application.objects[5].points[2].reserved0: 0 + dnp3.application.objects[5].points[2].restart: 1 + dnp3.application.objects[5].points[2].value: 0 + dnp3.application.objects[5].points[3].comm_lost: 0 + dnp3.application.objects[5].points[3].index: 4 + dnp3.application.objects[5].points[3].local_forced: 0 + dnp3.application.objects[5].points[3].online: 0 + dnp3.application.objects[5].points[3].over_range: 0 + dnp3.application.objects[5].points[3].prefix: 0 + dnp3.application.objects[5].points[3].reference_err: 0 + dnp3.application.objects[5].points[3].remote_forced: 0 + dnp3.application.objects[5].points[3].reserved0: 0 + dnp3.application.objects[5].points[3].restart: 1 + dnp3.application.objects[5].points[3].value: 0 + dnp3.application.objects[5].points[4].comm_lost: 0 + dnp3.application.objects[5].points[4].index: 5 + dnp3.application.objects[5].points[4].local_forced: 0 + dnp3.application.objects[5].points[4].online: 0 + dnp3.application.objects[5].points[4].over_range: 0 + dnp3.application.objects[5].points[4].prefix: 0 + dnp3.application.objects[5].points[4].reference_err: 0 + dnp3.application.objects[5].points[4].remote_forced: 0 + dnp3.application.objects[5].points[4].reserved0: 0 + dnp3.application.objects[5].points[4].restart: 1 + dnp3.application.objects[5].points[4].value: 0 + dnp3.application.objects[5].points[5].comm_lost: 0 + dnp3.application.objects[5].points[5].index: 6 + dnp3.application.objects[5].points[5].local_forced: 0 + dnp3.application.objects[5].points[5].online: 0 + dnp3.application.objects[5].points[5].over_range: 0 + dnp3.application.objects[5].points[5].prefix: 0 + dnp3.application.objects[5].points[5].reference_err: 0 + dnp3.application.objects[5].points[5].remote_forced: 0 + dnp3.application.objects[5].points[5].reserved0: 0 + dnp3.application.objects[5].points[5].restart: 1 + dnp3.application.objects[5].points[5].value: 0 + dnp3.application.objects[5].points[6].comm_lost: 0 + dnp3.application.objects[5].points[6].index: 7 + dnp3.application.objects[5].points[6].local_forced: 0 + dnp3.application.objects[5].points[6].online: 0 + dnp3.application.objects[5].points[6].over_range: 0 + dnp3.application.objects[5].points[6].prefix: 0 + dnp3.application.objects[5].points[6].reference_err: 0 + dnp3.application.objects[5].points[6].remote_forced: 0 + dnp3.application.objects[5].points[6].reserved0: 0 + dnp3.application.objects[5].points[6].restart: 1 + dnp3.application.objects[5].points[6].value: 0 + dnp3.application.objects[5].points[7].comm_lost: 0 + dnp3.application.objects[5].points[7].index: 8 + dnp3.application.objects[5].points[7].local_forced: 0 + dnp3.application.objects[5].points[7].online: 0 + dnp3.application.objects[5].points[7].over_range: 0 + dnp3.application.objects[5].points[7].prefix: 0 + dnp3.application.objects[5].points[7].reference_err: 0 + dnp3.application.objects[5].points[7].remote_forced: 0 + dnp3.application.objects[5].points[7].reserved0: 0 + dnp3.application.objects[5].points[7].restart: 1 + dnp3.application.objects[5].points[7].value: 0 + dnp3.application.objects[5].points[8].comm_lost: 0 + dnp3.application.objects[5].points[8].index: 9 + dnp3.application.objects[5].points[8].local_forced: 0 + dnp3.application.objects[5].points[8].online: 0 + dnp3.application.objects[5].points[8].over_range: 0 + dnp3.application.objects[5].points[8].prefix: 0 + dnp3.application.objects[5].points[8].reference_err: 0 + dnp3.application.objects[5].points[8].remote_forced: 0 + dnp3.application.objects[5].points[8].reserved0: 0 + dnp3.application.objects[5].points[8].restart: 1 + dnp3.application.objects[5].points[8].value: 0 + dnp3.application.objects[5].prefix_code: 0 + dnp3.application.objects[5].qualifier: 0 + dnp3.application.objects[5].range_code: 0 + dnp3.application.objects[5].start: 1 + dnp3.application.objects[5].stop: 9 + dnp3.application.objects[5].variation: 1 + dnp3.application.objects[6].count: 10 + dnp3.application.objects[6].group: 10 + dnp3.application.objects[6].points[0].comm_lost: 0 + dnp3.application.objects[6].points[0].index: 0 + dnp3.application.objects[6].points[0].local_forced: 0 + dnp3.application.objects[6].points[0].online: 0 + dnp3.application.objects[6].points[0].prefix: 0 + dnp3.application.objects[6].points[0].remote_forced: 0 + dnp3.application.objects[6].points[0].reserved0: 0 + dnp3.application.objects[6].points[0].reserved1: 0 + dnp3.application.objects[6].points[0].restart: 1 + dnp3.application.objects[6].points[0].state: 0 + dnp3.application.objects[6].points[1].comm_lost: 0 + dnp3.application.objects[6].points[1].index: 1 + dnp3.application.objects[6].points[1].local_forced: 0 + dnp3.application.objects[6].points[1].online: 0 + dnp3.application.objects[6].points[1].prefix: 0 + dnp3.application.objects[6].points[1].remote_forced: 0 + dnp3.application.objects[6].points[1].reserved0: 0 + dnp3.application.objects[6].points[1].reserved1: 0 + dnp3.application.objects[6].points[1].restart: 1 + dnp3.application.objects[6].points[1].state: 0 + dnp3.application.objects[6].points[2].comm_lost: 0 + dnp3.application.objects[6].points[2].index: 2 + dnp3.application.objects[6].points[2].local_forced: 0 + dnp3.application.objects[6].points[2].online: 0 + dnp3.application.objects[6].points[2].prefix: 0 + dnp3.application.objects[6].points[2].remote_forced: 0 + dnp3.application.objects[6].points[2].reserved0: 0 + dnp3.application.objects[6].points[2].reserved1: 0 + dnp3.application.objects[6].points[2].restart: 1 + dnp3.application.objects[6].points[2].state: 0 + dnp3.application.objects[6].points[3].comm_lost: 0 + dnp3.application.objects[6].points[3].index: 3 + dnp3.application.objects[6].points[3].local_forced: 0 + dnp3.application.objects[6].points[3].online: 0 + dnp3.application.objects[6].points[3].prefix: 0 + dnp3.application.objects[6].points[3].remote_forced: 0 + dnp3.application.objects[6].points[3].reserved0: 0 + dnp3.application.objects[6].points[3].reserved1: 0 + dnp3.application.objects[6].points[3].restart: 1 + dnp3.application.objects[6].points[3].state: 0 + dnp3.application.objects[6].points[4].comm_lost: 0 + dnp3.application.objects[6].points[4].index: 4 + dnp3.application.objects[6].points[4].local_forced: 0 + dnp3.application.objects[6].points[4].online: 0 + dnp3.application.objects[6].points[4].prefix: 0 + dnp3.application.objects[6].points[4].remote_forced: 0 + dnp3.application.objects[6].points[4].reserved0: 0 + dnp3.application.objects[6].points[4].reserved1: 0 + dnp3.application.objects[6].points[4].restart: 1 + dnp3.application.objects[6].points[4].state: 0 + dnp3.application.objects[6].points[5].comm_lost: 0 + dnp3.application.objects[6].points[5].index: 5 + dnp3.application.objects[6].points[5].local_forced: 0 + dnp3.application.objects[6].points[5].online: 0 + dnp3.application.objects[6].points[5].prefix: 0 + dnp3.application.objects[6].points[5].remote_forced: 0 + dnp3.application.objects[6].points[5].reserved0: 0 + dnp3.application.objects[6].points[5].reserved1: 0 + dnp3.application.objects[6].points[5].restart: 1 + dnp3.application.objects[6].points[5].state: 0 + dnp3.application.objects[6].points[6].comm_lost: 0 + dnp3.application.objects[6].points[6].index: 6 + dnp3.application.objects[6].points[6].local_forced: 0 + dnp3.application.objects[6].points[6].online: 0 + dnp3.application.objects[6].points[6].prefix: 0 + dnp3.application.objects[6].points[6].remote_forced: 0 + dnp3.application.objects[6].points[6].reserved0: 0 + dnp3.application.objects[6].points[6].reserved1: 0 + dnp3.application.objects[6].points[6].restart: 1 + dnp3.application.objects[6].points[6].state: 0 + dnp3.application.objects[6].points[7].comm_lost: 0 + dnp3.application.objects[6].points[7].index: 7 + dnp3.application.objects[6].points[7].local_forced: 0 + dnp3.application.objects[6].points[7].online: 0 + dnp3.application.objects[6].points[7].prefix: 0 + dnp3.application.objects[6].points[7].remote_forced: 0 + dnp3.application.objects[6].points[7].reserved0: 0 + dnp3.application.objects[6].points[7].reserved1: 0 + dnp3.application.objects[6].points[7].restart: 1 + dnp3.application.objects[6].points[7].state: 0 + dnp3.application.objects[6].points[8].comm_lost: 0 + dnp3.application.objects[6].points[8].index: 8 + dnp3.application.objects[6].points[8].local_forced: 0 + dnp3.application.objects[6].points[8].online: 0 + dnp3.application.objects[6].points[8].prefix: 0 + dnp3.application.objects[6].points[8].remote_forced: 0 + dnp3.application.objects[6].points[8].reserved0: 0 + dnp3.application.objects[6].points[8].reserved1: 0 + dnp3.application.objects[6].points[8].restart: 1 + dnp3.application.objects[6].points[8].state: 0 + dnp3.application.objects[6].points[9].comm_lost: 0 + dnp3.application.objects[6].points[9].index: 9 + dnp3.application.objects[6].points[9].local_forced: 0 + dnp3.application.objects[6].points[9].online: 0 + dnp3.application.objects[6].points[9].prefix: 0 + dnp3.application.objects[6].points[9].remote_forced: 0 + dnp3.application.objects[6].points[9].reserved0: 0 + dnp3.application.objects[6].points[9].reserved1: 0 + dnp3.application.objects[6].points[9].restart: 1 + dnp3.application.objects[6].points[9].state: 0 + dnp3.application.objects[6].prefix_code: 0 + dnp3.application.objects[6].qualifier: 0 + dnp3.application.objects[6].range_code: 0 + dnp3.application.objects[6].start: 0 + dnp3.application.objects[6].stop: 9 + dnp3.application.objects[6].variation: 2 + dnp3.application.objects[7].count: 10 + dnp3.application.objects[7].group: 40 + dnp3.application.objects[7].points[0].comm_lost: 0 + dnp3.application.objects[7].points[0].index: 0 + dnp3.application.objects[7].points[0].local_forced: 0 + dnp3.application.objects[7].points[0].online: 0 + dnp3.application.objects[7].points[0].over_range: 0 + dnp3.application.objects[7].points[0].prefix: 0 + dnp3.application.objects[7].points[0].reference_err: 0 + dnp3.application.objects[7].points[0].remote_forced: 0 + dnp3.application.objects[7].points[0].reserved0: 0 + dnp3.application.objects[7].points[0].restart: 1 + dnp3.application.objects[7].points[0].value: 0 + dnp3.application.objects[7].points[1].comm_lost: 0 + dnp3.application.objects[7].points[1].index: 1 + dnp3.application.objects[7].points[1].local_forced: 0 + dnp3.application.objects[7].points[1].online: 0 + dnp3.application.objects[7].points[1].over_range: 0 + dnp3.application.objects[7].points[1].prefix: 0 + dnp3.application.objects[7].points[1].reference_err: 0 + dnp3.application.objects[7].points[1].remote_forced: 0 + dnp3.application.objects[7].points[1].reserved0: 0 + dnp3.application.objects[7].points[1].restart: 1 + dnp3.application.objects[7].points[1].value: 0 + dnp3.application.objects[7].points[2].comm_lost: 0 + dnp3.application.objects[7].points[2].index: 2 + dnp3.application.objects[7].points[2].local_forced: 0 + dnp3.application.objects[7].points[2].online: 0 + dnp3.application.objects[7].points[2].over_range: 0 + dnp3.application.objects[7].points[2].prefix: 0 + dnp3.application.objects[7].points[2].reference_err: 0 + dnp3.application.objects[7].points[2].remote_forced: 0 + dnp3.application.objects[7].points[2].reserved0: 0 + dnp3.application.objects[7].points[2].restart: 1 + dnp3.application.objects[7].points[2].value: 0 + dnp3.application.objects[7].points[3].comm_lost: 0 + dnp3.application.objects[7].points[3].index: 3 + dnp3.application.objects[7].points[3].local_forced: 0 + dnp3.application.objects[7].points[3].online: 0 + dnp3.application.objects[7].points[3].over_range: 0 + dnp3.application.objects[7].points[3].prefix: 0 + dnp3.application.objects[7].points[3].reference_err: 0 + dnp3.application.objects[7].points[3].remote_forced: 0 + dnp3.application.objects[7].points[3].reserved0: 0 + dnp3.application.objects[7].points[3].restart: 1 + dnp3.application.objects[7].points[3].value: 0 + dnp3.application.objects[7].points[4].comm_lost: 0 + dnp3.application.objects[7].points[4].index: 4 + dnp3.application.objects[7].points[4].local_forced: 0 + dnp3.application.objects[7].points[4].online: 0 + dnp3.application.objects[7].points[4].over_range: 0 + dnp3.application.objects[7].points[4].prefix: 0 + dnp3.application.objects[7].points[4].reference_err: 0 + dnp3.application.objects[7].points[4].remote_forced: 0 + dnp3.application.objects[7].points[4].reserved0: 0 + dnp3.application.objects[7].points[4].restart: 1 + dnp3.application.objects[7].points[4].value: 0 + dnp3.application.objects[7].points[5].comm_lost: 0 + dnp3.application.objects[7].points[5].index: 5 + dnp3.application.objects[7].points[5].local_forced: 0 + dnp3.application.objects[7].points[5].online: 0 + dnp3.application.objects[7].points[5].over_range: 0 + dnp3.application.objects[7].points[5].prefix: 0 + dnp3.application.objects[7].points[5].reference_err: 0 + dnp3.application.objects[7].points[5].remote_forced: 0 + dnp3.application.objects[7].points[5].reserved0: 0 + dnp3.application.objects[7].points[5].restart: 1 + dnp3.application.objects[7].points[5].value: 0 + dnp3.application.objects[7].points[6].comm_lost: 0 + dnp3.application.objects[7].points[6].index: 6 + dnp3.application.objects[7].points[6].local_forced: 0 + dnp3.application.objects[7].points[6].online: 0 + dnp3.application.objects[7].points[6].over_range: 0 + dnp3.application.objects[7].points[6].prefix: 0 + dnp3.application.objects[7].points[6].reference_err: 0 + dnp3.application.objects[7].points[6].remote_forced: 0 + dnp3.application.objects[7].points[6].reserved0: 0 + dnp3.application.objects[7].points[6].restart: 1 + dnp3.application.objects[7].points[6].value: 0 + dnp3.application.objects[7].points[7].comm_lost: 0 + dnp3.application.objects[7].points[7].index: 7 + dnp3.application.objects[7].points[7].local_forced: 0 + dnp3.application.objects[7].points[7].online: 0 + dnp3.application.objects[7].points[7].over_range: 0 + dnp3.application.objects[7].points[7].prefix: 0 + dnp3.application.objects[7].points[7].reference_err: 0 + dnp3.application.objects[7].points[7].remote_forced: 0 + dnp3.application.objects[7].points[7].reserved0: 0 + dnp3.application.objects[7].points[7].restart: 1 + dnp3.application.objects[7].points[7].value: 0 + dnp3.application.objects[7].points[8].comm_lost: 0 + dnp3.application.objects[7].points[8].index: 8 + dnp3.application.objects[7].points[8].local_forced: 0 + dnp3.application.objects[7].points[8].online: 0 + dnp3.application.objects[7].points[8].over_range: 0 + dnp3.application.objects[7].points[8].prefix: 0 + dnp3.application.objects[7].points[8].reference_err: 0 + dnp3.application.objects[7].points[8].remote_forced: 0 + dnp3.application.objects[7].points[8].reserved0: 0 + dnp3.application.objects[7].points[8].restart: 1 + dnp3.application.objects[7].points[8].value: 0 + dnp3.application.objects[7].points[9].comm_lost: 0 + dnp3.application.objects[7].points[9].index: 9 + dnp3.application.objects[7].points[9].local_forced: 0 + dnp3.application.objects[7].points[9].online: 0 + dnp3.application.objects[7].points[9].over_range: 0 + dnp3.application.objects[7].points[9].prefix: 0 + dnp3.application.objects[7].points[9].reference_err: 0 + dnp3.application.objects[7].points[9].remote_forced: 0 + dnp3.application.objects[7].points[9].reserved0: 0 + dnp3.application.objects[7].points[9].restart: 1 + dnp3.application.objects[7].points[9].value: 0 + dnp3.application.objects[7].prefix_code: 0 + dnp3.application.objects[7].qualifier: 0 + dnp3.application.objects[7].range_code: 0 + dnp3.application.objects[7].start: 0 + dnp3.application.objects[7].stop: 9 + dnp3.application.objects[7].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 19 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 3 + dnp3.application.control.uns: false + dnp3.application.function_code: 20 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.application.objects[1].count: 0 + dnp3.application.objects[1].group: 60 + dnp3.application.objects[1].prefix_code: 0 + dnp3.application.objects[1].qualifier: 6 + dnp3.application.objects[1].range_code: 6 + dnp3.application.objects[1].start: 0 + dnp3.application.objects[1].stop: 0 + dnp3.application.objects[1].variation: 3 + dnp3.application.objects[2].count: 0 + dnp3.application.objects[2].group: 60 + dnp3.application.objects[2].prefix_code: 0 + dnp3.application.objects[2].qualifier: 6 + dnp3.application.objects[2].range_code: 6 + dnp3.application.objects[2].start: 0 + dnp3.application.objects[2].stop: 0 + dnp3.application.objects[2].variation: 4 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 21 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 3 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 22 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 4 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 23 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 4 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 24 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 5 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 26 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 5 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 27 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 1 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 22 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].count: 0 + dnp3.application.objects[0].points[0].discontinuity: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].reserved0: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].rollover: 0 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 29 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 6 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 33 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 6 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 35 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 7 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 37 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 7 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 38 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 8 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 40 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 8 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 41 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 2 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 22 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].count: 1 + dnp3.application.objects[0].points[0].discontinuity: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].reserved0: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].rollover: 0 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 43 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 9 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 47 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 9 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 49 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 3 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 22 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].count: 2 + dnp3.application.objects[0].points[0].discontinuity: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].reserved0: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].rollover: 0 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 51 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 10 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 55 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 10 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 57 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 4 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 22 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].count: 3 + dnp3.application.objects[0].points[0].discontinuity: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].reserved0: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].rollover: 0 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 59 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 5 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 2 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].state: 1 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 63 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 11 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 66 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 11 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 68 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 6 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 2 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].state: 129 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 70 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 12 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 74 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 12 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 76 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 7 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 2 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].state: 1 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 78 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 8 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 2 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].state: 129 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 82 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 13 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 85 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 13 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 87 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 9 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 4 + dnp3.application.objects[0].points[0].chatter_filter: 0 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].state: 1 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 89 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 10 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 4 + dnp3.application.objects[0].points[0].chatter_filter: 0 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].state: 2 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 93 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 14 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 96 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 14 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 98 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 11 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 4 + dnp3.application.objects[0].points[0].chatter_filter: 0 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].state: 1 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 100 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 15 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 104 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 15 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 106 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 12 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 4 + dnp3.application.objects[0].points[0].chatter_filter: 0 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].state: 2 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 1 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 108 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 0 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 112 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 0 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 114 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 13 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 32 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].over_range: 0 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].reference_err: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].reserved0: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].timestamp: 0 + dnp3.application.objects[0].points[0].value: 0.0 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 7 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 116 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 14 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 32 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].over_range: 0 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].reference_err: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].reserved0: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].timestamp: 0 + dnp3.application.objects[0].points[0].value: 1.0 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 7 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 120 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 1 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 123 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 1 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 125 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 15 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 32 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].over_range: 0 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].reference_err: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].reserved0: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].timestamp: 0 + dnp3.application.objects[0].points[0].value: 2.0 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 7 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 127 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: true + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 0 + dnp3.application.control.uns: true + dnp3.application.function_code: 130 + dnp3.application.objects[0].count: 1 + dnp3.application.objects[0].group: 32 + dnp3.application.objects[0].points[0].comm_lost: 0 + dnp3.application.objects[0].points[0].index: 0 + dnp3.application.objects[0].points[0].local_forced: 0 + dnp3.application.objects[0].points[0].online: 1 + dnp3.application.objects[0].points[0].over_range: 0 + dnp3.application.objects[0].points[0].prefix: 0 + dnp3.application.objects[0].points[0].reference_err: 0 + dnp3.application.objects[0].points[0].remote_forced: 0 + dnp3.application.objects[0].points[0].reserved0: 0 + dnp3.application.objects[0].points[0].restart: 0 + dnp3.application.objects[0].points[0].timestamp: 0 + dnp3.application.objects[0].points[0].value: 3.0 + dnp3.application.objects[0].prefix_code: 2 + dnp3.application.objects[0].qualifier: 40 + dnp3.application.objects[0].range_code: 8 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 7 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: unsolicited_response + event_type: dnp3 + pcap_cnt: 131 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 2 + dnp3.application.control.uns: false + dnp3.application.function_code: 1 + dnp3.application.objects[0].count: 0 + dnp3.application.objects[0].group: 60 + dnp3.application.objects[0].prefix_code: 0 + dnp3.application.objects[0].qualifier: 6 + dnp3.application.objects[0].range_code: 6 + dnp3.application.objects[0].start: 0 + dnp3.application.objects[0].stop: 0 + dnp3.application.objects[0].variation: 2 + dnp3.control.dir: true + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 10 + dnp3.src: 1 + dnp3.type: request + event_type: dnp3 + pcap_cnt: 134 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + dnp3.application.complete: true + dnp3.application.control.con: false + dnp3.application.control.fin: true + dnp3.application.control.fir: true + dnp3.application.control.sequence: 2 + dnp3.application.control.uns: false + dnp3.application.function_code: 129 + dnp3.control.dir: false + dnp3.control.fcb: false + dnp3.control.fcv: false + dnp3.control.function_code: 4 + dnp3.control.pri: true + dnp3.dst: 1 + dnp3.src: 10 + dnp3.type: response + event_type: dnp3 + pcap_cnt: 136 + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 +- filter: + count: 1 + match: + dest_ip: 127.0.0.1 + dest_port: 20000 + event_type: flow + flow.age: 0 + flow.alerted: false + flow.bytes_toclient: 54 + flow.bytes_toserver: 74 + flow.pkts_toclient: 1 + flow.pkts_toserver: 1 + flow.reason: shutdown + flow.state: closed + proto: TCP + src_ip: 127.0.0.1 + src_port: 45112 + tcp.ack: true + tcp.rst: true + tcp.state: closed + tcp.syn: true + tcp.tcp_flags: '16' + tcp.tcp_flags_tc: '14' + tcp.tcp_flags_ts: '02' +- filter: + count: 1 + match: + app_proto: dnp3 + dest_ip: 127.0.0.1 + dest_port: 20000 + event_type: flow + flow.age: 29 + flow.alerted: false + flow.bytes_toclient: 5689 + flow.bytes_toserver: 5249 + flow.pkts_toclient: 69 + flow.pkts_toserver: 70 + flow.reason: shutdown + flow.state: closed + proto: TCP + src_ip: 127.0.0.1 + src_port: 59602 + tcp.ack: true + tcp.fin: true + tcp.psh: true + tcp.state: closed + tcp.syn: true + tcp.tcp_flags: 1b + tcp.tcp_flags_tc: 1b + tcp.tcp_flags_ts: 1b diff --git a/tests/dnp3/check.sh b/tests/dnp3/check.sh deleted file mode 100755 index baff318ec..000000000 --- a/tests/dnp3/check.sh +++ /dev/null @@ -1,9 +0,0 @@ -#! /bin/sh - -. ${TOPDIR}/util/functions.sh - -n=$(jq_count eve.json 'select(.event_type == "dnp3")') -assert_eq 55 "$n" "bad dnp3 event count" - -exit 0 - diff --git a/tests/dnp3/suricata.yaml b/tests/dnp3/suricata.yaml deleted file mode 100644 index de9d78cea..000000000 --- a/tests/dnp3/suricata.yaml +++ /dev/null @@ -1,30 +0,0 @@ -%YAML 1.1 ---- - -include: ../../etc/suricata-3.1.2.yaml - -outputs: - - eve-log: - enabled: yes - filetype: regular - filename: eve.json - types: - - alert: - http: yes # enable dumping of http fields - tls: yes # enable dumping of tls fields - ssh: yes # enable dumping of ssh fields - smtp: yes # enable dumping of smtp fields - tagged-packets: yes - xff: - enabled: no - mode: extra-data - deployment: reverse - header: X-Forwarded-For - - dnp3 - -app-layer: - protocols: - dnp3: - enabled: yes - detection-ports: - dp: 20000 diff --git a/tests/dnp3/test.yaml b/tests/dnp3/test.yaml deleted file mode 100644 index 56ea9b0d5..000000000 --- a/tests/dnp3/test.yaml +++ /dev/null @@ -1,3 +0,0 @@ -requires: - features: - - HAVE_LIBJANSSON -- 2.47.2