ICSTrace: A Malicious IP Traceback Model for Attacking Data of the Industrial Control System

Table 2

When the function code is 0 × 00, it is system function and further divided into 7 groups.

Function group code	Function	Subfunction code	Subfunction
1	Programmer commands	1	Request diag data
		2	VarTab
2	Cyclic data	1	Memory
3	Block function	1	List blocks
		2	List blocks of type
		3	Get block info
4	CPU function	1	Read SZL
		2	Message service
5	Security	1	PLC password
6	PBC BSEND/BRECV	None	None
7	Time function	1	Read clock
		2, 3	Set clock
		4	Read clock (following)