spm: single pattern match
mpm: multi pattern matcher
bm: boyer moore
hs: hyperscan
ppt: packet processing thread
cidr: classless inter-domain routing, such as a.b.c.d/x
tsap: transport service access point
scada: supervisory control and data acquisition
協議：
opc: ole for process control/Microsoft opcua/tcp/started bytes/ opcda/dcerpc/started bytes/modbus: /port 502/Schneider rtu: remote terminal unit ascii tcps7comm: /port 102/*(base + 7) == 0x32/Siemens tpkt: cotp: connection-oriented transport protocol ed: 0x1, expedited data ea: 0x2, expedited data acknowledgement ud: 0x4, user data rj: 0x5, reject dr: 0x8, disconnect request dc: 0xC, disconnect confirm cc: 0xD, connect confirm cr: 0xE, connect request dt: 0xF, data rosctr: remote operating service controlbacnet/ip: building automation and control networks/udp/port 47808/ISO standards bvlc: bacnet virtual link control npdu: bacnet network layer apdu: bacnet application layer bbmd: bacnet/ip broadcast management deviceethernet-ip: /ODVA cip: common industrial protocol/tcp/port 44818 cip i/o: /udp/port 2222iec: International Electrotechnical Commission iec60870-5: 101: basic telecontrol tasks 104: network access for iec60870-5-101 iec104: /tcp/port 2404/*base == 0x68/ apdu: application protocol data unit apci: application protocol control information cf1: first control field i-format: information transfer format/cf1 == 0/variable length s-format: numbered supervisory functions/cf1 == 01/fixed length u-format: unnumbered control functions/cf1 == 11/fixed length asdu: application service data unit sq: structure qualifier cot: cause of transmission oa: originator address ioa: information object address siq: single point of information diq: double point information sco: single command dco: double command rco: regulating step command vti: value with transient state indication sva: scaled value coa: common address of asdu 102/電量 103/保護 iec61850: smv: iec61850-9-2 goose: 通用變電站事件 sntp: 時間同步 acsi: abstract service communication interface mms: manufacturing message specification/port 102/ tpkt cotp vmd: virtual manufacturing device gsse: 通用變站狀態事件dnp3: distributed network protocol/port 20000/resembles iec60870-5 FT3 rtu: remote terminal unit ied: intelligent electronic device iccp: inter-control center communications protocol data link layer prm: primary fcb: frame count bit fcv: frame count valid bit dfc: data flow control bit application layer apci: application protocol control information fir: first fragment fin: final fragment con: expect a confirmationfins: /tcp/port 9600/
分析pcap文件
#--runmode singlesuricata -c /path/to/suricata.yaml -r /path/to/sample.pcap --runmode autofp
plc protocol in https://github.com/wireshark/wireshark/tree/master
Siemens S7 /epan/dissectors/packet-s7comm.c 西門子PLC支持的通訊協議 MMS(IEC61850) /asn1/mms 輸配電通訊協議 GOOSE(IEC61850) /asn1/goose 輸配電通訊協議 SV(IEC61850) /asn1/sv 輸配電通訊協議 Modbus /epan/dissectors/packet-mbtcp.c 工控標準協議 OPC DA /epan/dissectors/packet-dcom.c 工控標準協議 FF HSE /epan/dissectors/packet-ff.c 基金會現場總線以太網通信協定 IEC 104 /epan/dissectors/packet-iec104.c 輸配電通訊協議 Ethernet POWERLINK /epan/dissectors/packet-epl.c 開放式實時以太網通信 OPC UA /plugins/opcua/opcua.c OPC新一代標準 HART-IP /epan/dissectors/packet-hartip.c 高速可尋址遠程傳感器協議 CoAP /epan/dissectors/packet-coap.c 輕量應用層協議 Omron FINS /epan/dissectors/packet-omron-fins.c 歐姆龍PLC支持的通訊協定 openSAFETY /epan/dissectors/packet-opensafety.c 開源安全應用協議 EGD(Ethernet Global Data) /epan/dissectors/packet-egd.c GE Fanuc爲PLC開發的通訊協定 DNP3 /epan/dissectors/packet-dnp.c 分佈式網絡協議，主要用於電力行業 Sinec H1 /epan/dissectors/packet-h1.c 西門子PLC支持的通訊協議 Profinet /plugins/profinet/ 開放式的工業以太網通訊協定 EtherCAT /plugins/ethercat/ 德國Beckhoff公司推動的開放式實時以太網通訊協定 SERCOS III /epan/dissectors/packet-sercosiii.c 實時以太網通訊協定 RTPS /epan/dissectors/packet-rtps.c 實時流傳輸協議 TTEthernet /epan/dissectors/packet-tte.c 實時以太網通訊協定 CDT /dissectors/packet-cdt.c 遠動規約 EtherNet/IP /epan/dissectors/packet-etherip.c 工業通訊協定（Industrial Protocol），是一種CIP的實現方式，由羅克韋爾自動化公司所設計 CIP /epan/dissectors/packet-cip.c 通用工業協定 CIP Safety /epan/dissectors/packet-cipsafety.c 安全通用工業協定 DeviceNet /epan/dissectors/ packet-devicenet.c 一種CIP的實現方式，由Allen-Bradley公司所設計 BACnet /epan/dissectors/packet-bacnet.c 樓宇自動控制網絡數據通訊協議 KNXnet/IP /epan/dissectors/packet-knxnetip.c 住宅和樓宇控制標準 Lontalk /epan/dissectors/packet-lon.c 埃施朗公司的LonWorks技術所使用的通訊協議 CANopen /epan/dissectors/packet-canopen.c 控制局域網通訊協定 SAE J1939 /epan/dissectors/packet-j1939.c 一種CAN的變種，適用在農業車輛及商用車輛 USITT DMX512-A /epan/dissectors/packet-dmx.c 燈光控制數據傳輸協議 BSSAP/BSAP /epan/dissectors/packet-bssap.c 由Bristol Babcock Inc發展的通訊協定 Gryphon /plugins/gryphon 車用通訊協定 ZigBee /epan/dissectors/packet-zbee.h 開放式的無線通訊協定
摘自：http://euhat.com/wp/2021/08/05/suricata%E5%A4%87%E5%BF%98%E5%BD%95/