zeek-plugin-bacnet
zeek-plugin-bacnet copied to clipboard
enumerated treatment beyond case 2: action, 25: limit enable, 107: segmentation support, 112: system status
Curious that current code has confined the Read-Property-Response enumerated treatment to solely:
switch(property_identifier) {
case 2: ##! action
data[data_index] = fmt("value=%s", action[value]);
break;
case 25: ##! limit enable
data[data_index] = fmt("value=%s", limit_enable[value]);
break;
case 107: ##! segmentation support
data[data_index] = fmt("value=%s", segmentation_supports[value]);
break;
case 112: ##! system status
data[data_index] = fmt("value=%s", system_statuses[value]);
break;
default:
data[data_index] = fmt("value=%d", value);
break;
Those are all good choices. But I wonder by what criteria those were selected, and why only those?