Industrial Control Systems Network Protocol Parsers (ICSNPP) - PROFINET-IO-CM (Profinet I/O Context Manager) using DCE/RPC over UDP.


ICSNPP-PROFINET-IO-CM is a Zeek plugin (written in Spicy) for parsing and logging fields used by the Profinet I/O Context Manager protocol from Real Automation, (as defined in Profinet Fieldbus Specification IEC 61158-6-10:2019) defining the configuration of Application Relations (AR) and Communication Relations (CR) between a controller and an I/O device.

This parser produces the following log files, defined in analyzer/main.zeek:

  • profinet_io_cm.log

For additional information on this log file, see the Logging Capabilities section below.


Package Manager

This script is available as a package for Zeek Package Manager. It requires Spicy and the Zeek Spicy plugin.

$ zkg refresh
$ zkg install icsnpp-profinet-io-cm

If this package is installed from ZKG, it will be added to the available plugins. This can be tested by running zeek -NN. If installed correctly, users will see ANALYZER_SPICY_PROFINET_IO_CM under the list of Zeek::Spicy analyzers.

If users have ZKG configured to load packages (see @load packages in the ZKG Quickstart Guide), this plugin and these scripts will automatically be loaded and ready to go.

Logging Capabilities

Profinet I/O CM DCE/RPC Log (profinet_io_cm.log)


This log summarizes, by connection, DCE/RPC frames transmitted using version 4 to profinet_io_cm.log.

Fields Captured

tstimeTimestamp (network time)
uidstringUinque ID for this connection
idconn_idDefault Zeek connection info (IP Addresses, Ports, etc.)
source_haddressSource IP address (see Source and Destination Fields)
source_pportSource Port (see Source and Destination Fields)
destination_haddressDestination IP address (see Source and Destination Fields)
destination_pportDestination Port (see Source and Destination Fields)
protostringTransport protocol
rpc_versioncountUsed RPC version
packet_typestringPacket Type: Request, Response, Fault, etc.
reserved_for_impl_1boolFlag 1 Bit 0 Reserved for implementation
last_fragmentboolFlag 1 Bit 1 Last Fragment
fragmentboolFlag 1 Bit 2 Fragment
no_fragment_requestedboolFlag 1 Bit 3 No fragment acknowledge requested
maybeboolFlag 1 Bit 4 Maybe
idempotentboolFlag 1 Bit 5 Idempotent
broadcastboolFlag 1 Bit 6 Broadcast
reserved_for_impl_2boolFlag 1 Bit 7 Reserved for implementation
cancel_was_pending_at_call_endboolFlag 2 Bit 1 Cancel was pending at call end
integer_encodingstringInteger encoding: Big Endian or Little Endian
character_encodingstringCharacter encoding: ASCII, EBCDIC
floating_point_encodingstringFloating point representations: IEEE, VAX, CRAY, etc.
serial_highcountThe high octet of the fragment number of the call
object_uuidstringObject instance within a physical device
interface_uuidstringIdentifies the interface of an IO device, controller, etc.
activity_uuidstringIdentifies communication relationships
server_boot_timecountServer boot time
interface_vers_majorcountInterface version major
interface_vers_minorcountInterface version minor
sequence_numcountUsed with activity_UUID to uniquely identify a RPC call.
operation_numstringOperation number identifies the PNIO service supported by the PNIO interfaces.
interface_hintcountInterface hint
activity_hintcountActivity hint
len_of_bodycountLength of body set to the number of octets of NDRDdata in the current frame.
fragment_numcountFragment number set to the number of the current fragment.
auth_protocolcountAuthentication protocol - set to 0 for no authentication
serial_lowcountThe low octet of the fragment number of the call
vers_fackstringVersion Fack
window_sizecountWindow size
max_tsducountMaximum Tsdu
max_frag_sizecountMaximum fragment size
serial_numbercountSerial number
sel_ack_lencountSelective ACK length
array_of_sel_ackvector of countArray of selective ACK

Source and Destination Fields

Zeek's typical behavior is to focus on and log packets from the originator and not log packets from the responder. However, most ICS protocols contain useful information in the responses, so the ICSNPP parsers log both originator and responses packets. Zeek's default behavior, defined in its id struct, is to never switch these originator/responder roles which leads to inconsistencies and inaccuracies when looking at ICS traffic that logs responses.

The default Zeek id struct contains the following logged fields:

  • id.orig_h (Original Originator/Source Host)
  • id.orig_p (Original Originator/Source Port)
  • id.resp_h (Original Responder/Destination Host)
  • id.resp_p (Original Responder/Destination Port)

To not break existing platforms that utilize the default id struct functionality, the ICSNPP team has added four new fields to each log file instead of changing Zeek's default behavior. These four new fields provide the accurate information regarding source and destination IP addresses and ports:

  • source_h (True Originator/Source Host)
  • source_p (True Originator/Source Port)
  • destination_h (True Responder/Destination Host)
  • destination_p (True Responder/Destination Port)


Roughly 10% of the defined protocol specification is covered by this parser. The intent of the parser is to provide an intiial implementation that covers primarily header information to inlucde the transport protocol, RPC version, packet type, etc. See the Logging Capabilities section for detailed information of the parser coverage.

Package Version :