Ask Your Question
0

Questions about the opcua protocol

asked 2020-03-12 07:17:39 +0000

Db2k gravatar image

updated 2020-03-15 18:13:04 +0000

grahamb gravatar image

Hello there. I come from China. Your company often uses Wireshark at work. Currently there is a problem. I can't parse the opcua using Wireshark. I can only parse to the tcp layer. I confirm that the messages I grabbed are fine. How to solve this?

edit retag flag offensive close merge delete

Comments

What port is your OPC UA traffic running on? You might have to set the OpcUa dissector preferences for the port(s) in use.

grahamb gravatar imagegrahamb ( 2020-03-12 10:44:35 +0000 )edit

Thank you for your answer. I tried it as you said. But it has no effect. Thanks again.

Db2k gravatar imageDb2k ( 2020-03-13 03:21:24 +0000 )edit

Can you share the capture file, using a public share such as Google Drive, DropBox etc? Post a link to the file back here.

grahamb gravatar imagegrahamb ( 2020-03-13 11:08:12 +0000 )edit

Hello. I packaged the captured files into zip format. There are three pcap files in the compressed package. link:https://1drv.ms/u/s!AvrRhClm17ZIgmz8WcSKxln4fp-G?e=XfbLGw

Db2k gravatar imageDb2k ( 2020-03-15 07:16:43 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-03-15 17:49:46 +0000

grahamb gravatar image

The OPC UA traffic is running on port 51234. Use either Analyze -> Decode As... to add a TCP Port entry for port 51234 with the decoding set to "OpcUa" or set the OpcUa port preferences to include 51234 (the file can support multiple ports, comma separated).

Unfortunately there is also MongoDB traffic using 51234 as a source port for the client which may be confusing things. The OPC UA traffic appears to be between hosts 10.0.20.114 and .115 so you can use a display filter of "ip.addr == 10.0.20.114" to see all the relevant traffic or "OpcUa" once you have set the "Decode As ..."

edit flag offensive delete link more

Comments

Ok. Thank you. The problem has been solved. I wish you a happy life.

Db2k gravatar imageDb2k ( 2020-03-16 04:12:01 +0000 )edit

By the way. Is it true that you have herd immunity in the UK?

Db2k gravatar imageDb2k ( 2020-03-16 04:15:15 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-03-12 07:17:39 +0000

Seen: 822 times

Last updated: Mar 15 '20