If your network does not contain an enabled S7CommPlus device, you should not enable the s7commplus inspector in a network analysis policy that you apply to traffic.

S7CommPlus TCP port configuration

The binder inspector defines the S7CommPlus TCP port configuration. For more information, see the Binder Inspector Overview.

[
    {
        "when": {
            "role": "server",
            "proto": "tcp",
            "ports": "102"
        },
        "use": {
            "type": "s7commplus"
        }
    },
    {
        "when": {
            "role": "any",
            "service": "s7commplus"
        },
        "use": {
            "type": "s7commplus"
        }
    }
]

Note	The s7commplus inspector does not provide any parameters.

Enable the s7commplus inspector rules to generate events and, in an inline deployment, drop offending packets.

You can use the s7commplus keywords alone or in combination to create custom intrusion rules that identify attacks against traffic detected by the s7commplus inspector. For configurable keywords, specify a single known value or a single integer within the allowed range.

Note the following:

• Multiple s7commplus keywords in the same rule are AND-ed.

• Using multiple s7commplus_func or s7commplus_opcode keywords in the same rule negates the rule. The negated rule cannot match traffic. To search for multiple values with these keywords, create multiple rules.

s7commplus_content

Use the s7commplus_content keyword to position the detection cursor to the beginning of the S7CommPlus packet payload. We recommend that you set this keyword before you use a content or protected_content keyword in an S7CommPlus intrusion rule.

Syntax: s7commplus_content;

Examples: s7commplus_content;

s7commplus_func

Use the s7commplus_func keyword to match against one of the specified S7CommPlus header parameters. You can specify the S7CommPlus parameter name or the corresponding hexadecimal code.

Type: string

Syntax: s7commplus_func: <header_parameter>;

Valid values:

Examples: s7commplus_func: createobject;

s7commplus_opcode

Use the s7commplus_opcode keyword to match against one of the specified S7CommPlus header parameters. You can specify the S7CommPlus parameter name or the corresponding hexadecimal code.

Type: string

Syntax: s7commplus_opcode: <header_parameter>

Valid values:

Examples: s7commplus_opcode: 0x31;