On Nov 13, 2012, at 11:09 AM, "Siwek, Jonathan Luke" <[email protected]> wrote:
> I can add a protocol violation and not generate the event in these cases… but > do you care whether the extra parameter is provided to the events in the > valid cases (I don't think it's hurting anything) ? You're right, it's not hurting anything, but I think the events are redundant if they include those lengths since it's implicitly included in the number of registers included. As I've changed events and added new ones, I try not include length fields that are implicit in other fields. This case is a little weird because the protocol itself is a little weird, but I still think it makes sense to leave the length out. > And really I'm just trying fix stuff that results in a crash... there's also > a bunch of &check attributes in modbus-protocol.pac that seem to indicate > protocol violations, but they don't do anything since that attribute is a > no-op in binpac. Yeah, I left those there as place holders so that we didn't need to refer back to the standard for those values when we port this to binpac++. Feel free to ignore those. .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro-ids.org/ _______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
