Unable to access data in second IOA
Dear all I'm using pyshark(python) to process dissected IEC 60870-5-104 packets. I'm able to access first IOA in the captured data but unable to access second/third IOA if NumIx >1. I'm using the following code:
cap=pyshark.LiveCapture(interface='Ethernet',display_filter="104apci and 104asdu");
IOA_Val = ((cap[4].IOA));
print(IOA_VAL)
Layer 4 of Pcap
Layer 104ASDU:
TypeId: M_SP_NA_1 (1)
0... .... = SQ: False
.000 0010 = NumIx: 2
..01 0100 = CauseTx: Inrogen (20)
.0.. .... = Negative: False
0... .... = Test: False
OA: 2
Addr: 1
IOA: 345
IOA: 345
SIQ: 0x00
.... ...0 = SPI: Off
...0 .... = BL: Not blocked
..0. .... = SB: Not Substituted
.0.. .... = NT: Topical
0... .... = IV: Valid
IOA: 57756
IOA: 57756
SIQ: 0x00
.... ...0 = SPI: Off
...0 .... = BL: Not blocked
..0. .... = SB: Not Substituted
.0.. .... = NT: Topical
0... .... = IV: Valid
This works if NumIx=1 but doesn't work if NumIx>1
How to access second IOA in same same packet
In simple words, I'm able to access IOA data of IOA Valu:345 but unable to access IOA data of IOA:57756
Pcap file: https://drive.google.com/open?id=1Z3c...
Can you upload the capture to a publicly accessible location, e.g. CloudShark, Google Drive, DropBox etc. and then post a link to the capture by amending your question.
I Have shared tthe pcap file