70 lines
1.7 KiB
Markdown
70 lines
1.7 KiB
Markdown
# Checker
|
|
|
|
Modbus/TCP traffic checker that validates generated PCAP/PCAPNG traces against
|
|
Modbus rules, request/response pairing, and optional expected fields supplied
|
|
via JSONL sidecar metadata.
|
|
|
|
## What It Does
|
|
|
|
- Parses Ethernet/RAW PCAP packets, extracts TCP payloads
|
|
- Validates MBAP header and basic Modbus/TCP invariants
|
|
- Parses PDU fields using descriptor JSON (request/response)
|
|
- Tracks outstanding requests and flags unmatched responses
|
|
- Compares observed values with optional expected fields in JSONL
|
|
- Emits a JSON report with findings and a summary
|
|
|
|
## Build
|
|
|
|
```bash
|
|
cargo build
|
|
```
|
|
|
|
## Run
|
|
|
|
```bash
|
|
cargo run -- \
|
|
--pcap trace.pcapng \
|
|
--meta trace.meta.jsonl \
|
|
--config modbus.json \
|
|
--report report.json \
|
|
--port 502 \
|
|
--mode mvp
|
|
```
|
|
|
|
Sample CLI with the example files:
|
|
|
|
```bash
|
|
cargo run -- \
|
|
--pcap trace.pcapng \
|
|
--meta docs/examples/trace.meta.jsonl \
|
|
--config docs/examples/modbus.json \
|
|
--report report.json
|
|
```
|
|
|
|
## CLI Options
|
|
|
|
- `--pcap <path>`: PCAP or PCAPNG input file
|
|
- `--meta <path>`: JSONL sidecar metadata (1 line per packet)
|
|
- `--config <path>`: Modbus descriptor JSON
|
|
- `--report <path>`: Report JSON output (default: `report.json`)
|
|
- `--port <u16>`: Modbus/TCP port (default: `502`)
|
|
- `--mode mvp|strict`: Validation mode (default: `mvp`)
|
|
- `--fail-fast`: Stop on first fatal error
|
|
|
|
## Files and Formats
|
|
|
|
See `docs/api.md` for the full schema of:
|
|
- `trace.meta.jsonl` lines
|
|
- Modbus descriptor JSON
|
|
- `report.json` output
|
|
|
|
Example files live in `docs/examples/`:
|
|
- `docs/examples/trace.meta.jsonl`
|
|
- `docs/examples/modbus.json`
|
|
- `docs/examples/report.json`
|
|
|
|
## Notes
|
|
|
|
- This checker assumes one Modbus ADU per TCP payload.
|
|
- TCP reassembly and checksum validation are not implemented.
|