Dissector IEC-60870-5-103/101 works once
In the program I record the exchange using protocol IEC 60870-5-103 or IEC 60870-5-101. When viewing, I select the dissector menu RMB "Protocol preferences - Data - Open data preferences" and choice "IEC 60870-5-103". The data section is displayed correctly. But the next time you start the program, data parsing no longer works.
The sample captures attached to 2917: packet-iec104.c - Add IEC 60870-5-103 Protocol Dissection use
RTAC Serial Lineand require the Decode As... setting.The only preference for
IEC 60870-5-103would be if the packets came in over TCP.Then the TCP dissector could pass off the payload for dissection.
I use serial port server Moxa NPort, not RTAC. The decoding works correctly the first time, and then it stops. Three computers have this problem, one still decodes correctly. I checked different versions of Wireshark. I can't upload my pсap file.
To switch to another protocol, I disabled the current one (IEC 60870), this was a mistake. You can enable the protocol in the "Enable Protocols" menu