Ask Your Question
0

Dissector IEC-60870-5-103/101 works once

asked 2024-06-21 00:47:07 +0000

Alex Bal gravatar image

In the program I record the exchange using protocol IEC 60870-5-103 or IEC 60870-5-101. When viewing, I select the dissector menu RMB "Protocol preferences - Data - Open data preferences" and choice "IEC 60870-5-103". The data section is displayed correctly. But the next time you start the program, data parsing no longer works.

edit retag flag offensive close merge delete

Comments

The sample captures attached to 2917: packet-iec104.c - Add IEC 60870-5-103 Protocol Dissection use RTAC Serial Line and require the Decode As... setting.
The only preference for IEC 60870-5-103 would be if the packets came in over TCP.
Then the TCP dissector could pass off the payload for dissection.

Chuckc gravatar imageChuckc ( 2024-06-21 02:21:45 +0000 )edit

I use serial port server Moxa NPort, not RTAC. The decoding works correctly the first time, and then it stops. Three computers have this problem, one still decodes correctly. I checked different versions of Wireshark. I can't upload my pсap file.

Alex Bal gravatar imageAlex Bal ( 2024-06-21 17:52:51 +0000 )edit

To switch to another protocol, I disabled the current one (IEC 60870), this was a mistake. You can enable the protocol in the "Enable Protocols" menu

Alex Bal gravatar imageAlex Bal ( 2024-06-21 21:25:47 +0000 )edit

1 Answer

Sort by » oldest newest most voted
0

answered 2024-06-22 13:46:19 +0000

Chuckc gravatar image
edit flag offensive delete link more

Comments

RMB - right mouse button

Chuckc gravatar imageChuckc ( 2024-06-22 15:49:18 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2024-06-21 00:47:07 +0000

Seen: 102 times

Last updated: Jun 22