Duffy O'Craven

Also a long-standing situation in enums for Notice:: and Weird:: https://github.com/zeek/zeek/issues/1250

In the absence of any countervaling indications from other real-world examples, then when we're freshly looking at conn_id, not constrained to be the 5-tuple, Zeek's concept of conn_id could be...

The "broadcast" part is problematic on real-world networks, for BACnet as for any protocol. The BACnet industry is migrating towards using the unicast versions of what were initially always-broadcast Who-Is...

So in summary, BACnet uses broadcast not to get a lot of responses, but rather to say "who knows the address for this guy?"

https://www.qacafe.com/analysis-tools/cloudshark/tech-integrations/pcapdaemon is an example of an OEM partnership, where Cloudshark/qacafe.com had done the heavy-lifting for this problem domain. Maybe the 85% solution is to Partner/OEM program with them?