Ask Your Question

How can I reassemble OPC data PDUs in wireshark? am

asked 2020-10-06 22:24:18 +0000

mlshepherd1 gravatar image

I am trying to analyze flows between an OPC server and a Pi Interface server to see where a specific tag may be getting dropped on the network (or to prove that it isn't), but the OPC data is riding over TCP packets and split between several packets. I have turned on TCP reassembly, but there is no option under OPC to reassemble the PDUs.

edit retag flag offensive close merge delete


There are two pcaps attached to this issue - #8068 Chunking support for OPCUA
They are using ports 4842 and 4845 for OpcUa.
Can you look at one or both to see if the results are different than what you see in your capture?

Chuckc gravatar imageChuckc ( 2020-10-06 22:45:57 +0000 )edit

Wireshark version? And I assume this is indeed OPC UA and not OPC Classic?

grahamb gravatar imagegrahamb ( 2020-10-07 07:41:58 +0000 )edit

This is the first time I have had to work with OPC data so I was not familiar with the different versions. When I saw the OPC UA protocol options, I just assumed that was it. However, after doing a bit more research, this system is actually using OPC Classic and it appears the data is using the DCERPC protocol. Any ideas how to read this data in wireshark? There are also a lot of frames with the error stating malformed packet: length of contained item exceeds the length of containing item.

mlshepherd1 gravatar imagemlshepherd1 ( 2020-10-07 15:05:33 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2020-10-07 15:56:15 +0000

grahamb gravatar image

Dissecting OPC Classic, which as the OP has noted is based on DCERPC, is very difficult.

I would instead use something like the Matrikon OPC Sniffer that sits between the client and the server and dumps out logs of the OPC traffic that can be examined.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2020-10-06 22:24:18 +0000

Seen: 997 times

Last updated: Oct 07 '20