icsnpp-profinet-io-cm

https://github.com/cisagov/icsnpp-profinet-io-cm
5 10 3 0 Last Push 10/17/24, 3:47 PM

ICSNPP-PROFINET-IO-CM

Industrial Control Systems Network Protocol Parsers (ICSNPP) - PROFINET-IO-CM (Profinet I/O Context Manager) using DCE/RPC over UDP.

Overview

ICSNPP-PROFINET-IO-CM is a Zeek plugin (written in Spicy) for parsing and logging fields used by the Profinet I/O Context Manager protocol from Real Automation, (as defined in Profinet Fieldbus Specification IEC 61158-6-10:2019) defining the configuration of Application Relations (AR) and Communication Relations (CR) between a controller and an I/O device.

This parser produces the following log files, defined in analyzer/main.zeek:

  • profinet_io_cm.log

For additional information on this log file, see the Logging Capabilities section below.

Installation

Package Manager

This script is available as a package for Zeek Package Manager. It requires Spicy and the Zeek Spicy plugin.

$ zkg refresh
$ zkg install icsnpp-profinet-io-cm

If this package is installed from ZKG, it will be added to the available plugins. This can be tested by running zeek -NN. If installed correctly, users will see ANALYZER_SPICY_PROFINET_IO_CM under the list of Zeek::Spicy analyzers.

If users have ZKG configured to load packages (see @load packages in the ZKG Quickstart Guide), this plugin and these scripts will automatically be loaded and ready to go.

Logging Capabilities

Profinet I/O CM DCE/RPC Log (profinet_io_cm.log)

Overview

This log summarizes, by connection, DCE/RPC frames transmitted using version 4 to profinet_io_cm.log.

Fields Captured

FieldTypeDescription
tstimeTimestamp (network time)
uidstringUinque ID for this connection
idconn_idDefault Zeek connection info (IP Addresses, Ports, etc.)
source_haddressSource IP address (see Source and Destination Fields)
source_pportSource Port (see Source and Destination Fields)
destination_haddressDestination IP address (see Source and Destination Fields)
destination_pportDestination Port (see Source and Destination Fields)
protostringTransport protocol
rpc_versioncountUsed RPC version
packet_typestringPacket Type: Request, Response, Fault, etc.
reserved_for_impl_1boolFlag 1 Bit 0 Reserved for implementation
last_fragmentboolFlag 1 Bit 1 Last Fragment
fragmentboolFlag 1 Bit 2 Fragment
no_fragment_requestedboolFlag 1 Bit 3 No fragment acknowledge requested
maybeboolFlag 1 Bit 4 Maybe
idempotentboolFlag 1 Bit 5 Idempotent
broadcastboolFlag 1 Bit 6 Broadcast
reserved_for_impl_2boolFlag 1 Bit 7 Reserved for implementation
cancel_was_pending_at_call_endboolFlag 2 Bit 1 Cancel was pending at call end
integer_encodingstringInteger encoding: Big Endian or Little Endian
character_encodingstringCharacter encoding: ASCII, EBCDIC
floating_point_encodingstringFloating point representations: IEEE, VAX, CRAY, etc.
serial_highcountThe high octet of the fragment number of the call
object_uuidstringObject instance within a physical device
interface_uuidstringIdentifies the interface of an IO device, controller, etc.
activity_uuidstringIdentifies communication relationships
server_boot_timecountServer boot time
interface_vers_majorcountInterface version major
interface_vers_minorcountInterface version minor
sequence_numcountUsed with activity_UUID to uniquely identify a RPC call.
operation_numstringOperation number identifies the PNIO service supported by the PNIO interfaces.
interface_hintcountInterface hint
activity_hintcountActivity hint
len_of_bodycountLength of body set to the number of octets of NDRDdata in the current frame.
fragment_numcountFragment number set to the number of the current fragment.
auth_protocolcountAuthentication protocol - set to 0 for no authentication
serial_lowcountThe low octet of the fragment number of the call
vers_fackstringVersion Fack
window_sizecountWindow size
max_tsducountMaximum Tsdu
max_frag_sizecountMaximum fragment size
serial_numbercountSerial number
sel_ack_lencountSelective ACK length
array_of_sel_ackvector of countArray of selective ACK

Source and Destination Fields

Zeek's typical behavior is to focus on and log packets from the originator and not log packets from the responder. However, most ICS protocols contain useful information in the responses, so the ICSNPP parsers log both originator and responses packets. Zeek's default behavior, defined in its id struct, is to never switch these originator/responder roles which leads to inconsistencies and inaccuracies when looking at ICS traffic that logs responses.

The default Zeek id struct contains the following logged fields:

  • id.orig_h (Original Originator/Source Host)
  • id.orig_p (Original Originator/Source Port)
  • id.resp_h (Original Responder/Destination Host)
  • id.resp_p (Original Responder/Destination Port)

To not break existing platforms that utilize the default id struct functionality, the ICSNPP team has added four new fields to each log file instead of changing Zeek's default behavior. These four new fields provide the accurate information regarding source and destination IP addresses and ports:

  • source_h (True Originator/Source Host)
  • source_p (True Originator/Source Port)
  • destination_h (True Responder/Destination Host)
  • destination_p (True Responder/Destination Port)

Coverage

Roughly 10% of the defined protocol specification is covered by this parser. The intent of the parser is to provide an intiial implementation that covers primarily header information to inlucde the transport protocol, RPC version, packet type, etc. See the Logging Capabilities section for detailed information of the parser coverage.

ICSNPP Packages

All ICSNPP Packages:

Full ICS Protocol Parsers:

  • BACnet
    • Full Zeek protocol parser for BACnet (Building Control and Automation)
  • BSAP
    • Full Zeek protocol parser for BSAP (Bristol Standard Asynchronous Protocol) over IP
    • Full Zeek protocol parser for BSAP Serial comm converted using serial tap device
  • Ethercat
    • Full Zeek protocol parser for Ethercat
  • Ethernet/IP and CIP
    • Full Zeek protocol parser for Ethernet/IP and CIP
  • GE SRTP
    • Full Zeek protocol parser for GE SRTP
  • Genisys
    • Full Zeek protocol parser for Genisys
  • OPCUA-Binary
    • Full Zeek protocol parser for OPC UA (OPC Unified Architecture) - Binary
  • S7Comm
    • Full Zeek protocol parser for S7comm, S7comm-plus, and COTP
  • Synchrophasor
    • Full Zeek protocol parser for Synchrophasor Data Transfer for Power Systems (C37.118)
  • Profinet IO CM
    • Full Zeek protocol parser for Profinet I/O Context Manager

Updates to Zeek ICS Protocol Parsers:

  • DNP3
    • DNP3 Zeek script extending logging capabilities of Zeek's default DNP3 protocol parser
  • Modbus
    • Modbus Zeek script extending logging capabilities of Zeek's default Modbus protocol parser

License

Copyright 2024 Battelle Energy Alliance, LLC. Released under the terms of the 3-Clause BSD License (see LICENSE.txt).

Package Version :

Description :

Profinet I/O Context Manager uses traditional Ethernet hardware and software to define a network that
structures the task of exchanging data, alarms and diagnostics with programmable controllers
and other automation controllers

Script Dir :

analyzer

Plugin Dir :

build/spicy-modules

Build Command :

mkdir -p build && cd build && SPICYZ=$(command -v spicyz || echo %(package_base)s/spicy-plugin/build/bin/spicyz) cmake -DCMAKE_BUILD_TYPE=Debug .. && cmake --build .

Test Command :

cd testing && btest -c btest.cfg

Depends :

zeek >=6.0.3

Tags :

profinet io cm, pn_io, power, SCADA, zeek plugin, protocol analyzer, log writer, ics, profinet, CISA, INL, ICSNPP