When running as part of your Zeek installation this plugin will produce a bacnet.log file containing metadata extracted from any BACnet traffic observed on UDP port 47808.
zeek-plugin-bacnet is distributed as a Zeek package and is compatible with the zkg command line tool.
This code is made available under the BSD-3-Clause license. Guidelines for contributing are available as well as a pull request template. A Dockerfile has been included in the repository to assist with setting up an environment for testing any changes to the plugin.
- ICSNPP-BACnet - Another BACnet plugin implementation for Zeek
- BACnet - Spicy - An implementation of BACnet in Spicy for Zeek