How CIP request-response packet linkage happened ?

asked 2019-09-30 14:34:28 +0000

vikrant gravatar image

I am trying to parse EtherNET/IP based CIP packets using wireshark.

In CIP response we only gets status but there is no specific information we get for command(request) to which it is providing a status.

That's why it is necessary to link Request with Response. Wireshark implementation already do that. That means it provide request packet number associated with response. From this, dissector get CIP Path (Class, Instance, Attribute) to parse the data present in response.

How wireshark does this ? Is there any roll of seq. & ack. no. present in TCP ?

Thanks !!

edit retag flag offensive close merge delete