amzn/zeek-plugin-bacnet

Reject-Message-To-Network single octet as uint8, then the network number parameters as uint16

duffy-ocraven opened this issue · 1 comments

Reject-Message-To-Network differs from the other Network Layer messages, that it has as its parameters first: a reject reason single octet as uint8. Then the network number parameters (each is uint16) until the UDP/BVLC-Length.

http://www.bacnet.org/Addenda/Add-135-2010ao.pdf page 5 documents the 7 defined values of the reject reason single octet. Don't worry about understanding code value 5: "source message was rejected due to a BACnet security error and that error cannot be forwarded to the source device. See Clause 24.12.1.1 for more details on the generation of Reject-Message-To-Network messages indicating this reason." The entirety of clause 24 has subsequently been removed from the standard.

@duffy-corelight, latest update addresses this issue. Like the others, I'll let the customer close the issue if deemed as satisfied.