Application level protocol options

dnp3.function_code, dnp3.group, dnp3.variation

Checks specific fields in the DNP3 protocol.

Syntax:

--dnp3.[Decorations] <operator> <value>

The following fields are current supported: function_code, group, and variation.

Valid operators: =, !, >=, <=, &, |, ^, and in.

Example:

--dnp3.function_code in {0x81,0x82};

--dnp3.group = 0x33;

--dnp3.variation = 1;

ssl.fingerprint

Checks the fingerprint of SSL clients.

Syntax:

--ssl.fingerprint <operator> <value>

Valid operators: =, and in.

Example:

--ssl.fingerprint 0x1581DE884A87803B;

--ssl.fingerprint in {0x188A9C4DE686DD8,0x3B3C90A2C4571BA4};

dns.query_type

Checks the DNS query type.

Syntax:

--dns.query_type <operator> <value>

Valid optional operator: =.

Example:

--dns.query_type 16;