Cisco Cisco Firepower Management Center 4000

Admin/Intrusion Admin

On the Create Rule page, select 

 in the drop-down list and click 

The 

modbus_func

 keyword appears.

Specify a single defined decimal value 0 to 255 for the function code, or a single defined string. See the 

 table for values and strings recognized by the system.

You can use the 

modbus_unit

 keyword to match a single decimal value against the Unit ID field in a 

Modbus request or response header.

Admin/Intrusion Admin

On the Create Rule page, select 

 in the drop-down list and click 

The 

modbus_unit

 keyword appears.

Specify a decimal value 0 through 255.

Protection

You can use DNP3 keywords to point to the beginning of application layer fragments, to match against 
DNP3 function codes and objects in DNP3 responses and requests, and to match against internal 
indication flags in DNP3 responses. You can use DNP3 keywords alone or in combination with other 
keywords such as 

content

 and 

byte_jump

.

See the following sections for more information:

23

read_write_multiple_registers

24

read_fifo_queue

43

encapsulated_interface_transport