Ask Your Question

OPC UA - large read request is reported as malformed in 4.2.1 but not in 4.0.12

asked 2024-01-08 01:22:13 +0000

yjchoi4 gravatar image

updated 2024-01-09 03:53:22 +0000

Guy Harris gravatar image

When a client makes a Read request for approximately 7000 nodes of Uint16 Data type at once, the issue arises within the Read Request. In the same OPC UA protocol packet, it has been reported that a Malformed Packet occurs in version 4.2.x, whereas in version 4.0.x, no Malformed Packet occurs.

It seems that the latest version of Wireshark is not properly reassembling the ReadRequest, leading to incorrect interpretation of OPC UA. Despite an array size of 6999 nodes, Wireshark only shows confirmation of requests for 1923 nodes. This appears to be limited to the first message fragment. 4.2.1

Using the 4.0.12 version of the same packet, the interpretation could be verified correctly up to 6998 nodes, unlike the issue observed with the latest version. v.4.0.12

I am curious about the occurrence of Malformed Packets based on the version differences. Can you explain why this is happening?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2024-01-08 07:12:48 +0000

Guy Harris gravatar image

updated 2024-01-08 07:13:14 +0000

Because the code in 4.0.12 is different from the code in 4.2.1. One or more of one may have a bug (and a fix to a 4.0.12 bug may have introduced a 4.2.1 bug).

Please file an issue on the Wireshark issue list, and attach the raw capture (NOT a screenshot!) to the bug, as a capture file will make it MUCH easier to debug the problem and test a fix for the bug).

edit flag offensive delete link more


Guy Harris gravatar imageGuy Harris ( 2024-01-09 03:52:07 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2024-01-08 01:22:13 +0000

Seen: 89 times

Last updated: Jan 09