Duffy O'Craven

The conditionals ``` else if (control == 0x08 || control == 0x0c || control == 0x20 || control == 0x24 || control == 0x28 ) { ``` and ``` if...

I had mentioned `if (control & 0x80) {` in https://github.com/amzn/zeek-plugin-bacnet/commit/4f91d6a9fd1ec24b2e10216cbbab8081774d4686#commitcomment-42241394 but I should be more effusive, since that change cannot proceed in isolation to parse all the possible network layer...

when negative-ack is TRUE, representing BACnet-SegmentACK-PDU would be usefully diagnostic

3

When negative-ack is FALSE, which is the overwhelmingly frequent case, it is fine to output nothing, as code currently does. But when negative-ack is TRUE, representing that would be usefully...

incorrect error enum strings, [57] = "Invalid Tag" , [58] = "Network Down"

1

Two incorrect error enum strings in scripts/consts.zeek: ``` [57] = "Reject Invalid Tag" , [58] = "Reject Network Down" , ``` should not include the `Reject `. They are correctly:...

Reject-Message-To-Network as 'Rorschach'

1

This ticket raises a conceptual enhancement entirely distinct from #12. Resolution there will successfully implement a loop construct as the proper way to capture what is in the actual packet...

Initialize-Router-Table message X'06' and Initialize-Router-Table-Ack message X'07'

1

Initialize-Router-Table message is indicated by a network_layer_message_type of X'06' followed by a "Number of Ports". Valid entries in this field are 0-255. Figure 6-11 specifies that Number of Ports is...

Establish-Connection-To-Network message is indicated by a network_layer_message_type of X'08' followed by a 2-octet network number, then a 1-octet "Termination Time Value" in seconds, that the connection shall remain established in...

``` BACnetUnconfirmedServiceChoice ::= ENUMERATED { ... who-Am-I (13), you-Are (14) ``` The packet structures are: ``` Who-Am-I-Request ::= SEQUENCE { vendorID Unsigned, modelName CharacterString, serialNumber CharacterString } You-Are-Request ::= SEQUENCE...

six Network Layer messages should be implemented

8

There are six Network Layer messages: X'00': Who-Is-Router-To-Network X'01': I-Am-Router-To-Network X'02': I-Could-Be-Router-To-Network X'03': Reject-Message-To-Network X'04': Router-Busy-To-Network X'05': Router-Available-To-Network which are in common use, and two more defined, which are deprecated:...

Network Layer Message Types X'12': What-Is-Network-Number and X'13': Network-Number-Is

4

Clause 6.2.4 Network Layer Message Types X'12' and X'13' are seeing adoption. What seeing them should tell a protocol parser to do, is a subject worthy of its own ticket....