# ICSNPP-MMS

Industrial Control Systems Network Protocol Parsers (ICSNPP) - Manufacturing Message Specification (MMS)

## Overview

This plugin provides a protocol analyzer for the Manufacturing Message
Specification (MMS) protocol (IEC 61850) for use within Zeek. The analyzer
enables Zeek to parse MMS messages.

## Dependencies

As MMS is an application protocol based on the OSI stack, the underlying ISO
protocol layers must also be processed. The following plugins must therefore
also be installed:

- [TPKT](https://github.com/DINA-community/icsnpp-tpkt)
- [COTP](https://github.com/DINA-community/icsnpp-iso-cotp)
- [SESS](https://github.com/DINA-community/icsnpp-sess)
- [PRES](https://github.com/DINA-community/icsnpp-pres)
- [ACSE](https://github.com/DINA-community/icsnpp-acse)

## Installation

### Package Manager

This script is available as a package for [Zeek Package Manager](https://docs.zeek.org/projects/package-manager/en/stable/index.html).

```bash
zkg refresh
zkg install mms
```

If this package is installed from ZKG, it will be added to the available plugins. This can be tested by running `zeek -NN`. If installed correctly, users will see `ANALYZER_MMS` under the list of plugins.

If users have ZKG configured to load packages (see `@load packages` in the [ZKG Quickstart Guide](https://docs.zeek.org/projects/package-manager/en/stable/quickstart.html)), this plugin and these scripts will automatically be loaded and ready to go.

## License

The software was developed on behalf of the BSI (Federal Office for Information Security)

Copyright (c) 2025 by DINA-Community BSD 3-Clause. [See License](/COPYING)