Modbus Preprocessor Rules
You must enable the Modbus preprocessor rules in the following table if you want these rules to generate events and, in an inline deployment, drop offending packets.
|
Preprocessor Rule GID:SID |
Description |
|---|---|
|
144:1 |
Generates an event when the length in the Modbus header does not match the length required by the Modbus function code. Each Modbus function has an expected format for requests and responses. If the length of the message does not match the expected format, this event is generated. |
|
144:2 |
Generates an event when the Modbus protocol ID is non-zero. The protocol ID field is used for multiplexing other protocols with Modbus. Because the preprocessor does not process these other protocols, this event is generated instead. |
|
144:3 |
Generates an event when the preprocessor detects a reserved Modbus function code. |