Revision history [back]

I have two packets in the same capture. One shows details within the Common Industrial Protocol, I/O section and one does not.

I think maybe they are being dissected differently? How do I confirm? Then, why are packets of the same type displaying different?

I'm reviewing a capture I was sent recently. I have two packets in the same capture. capture of the same protocol (CIP I/O) which are displaying differently. One shows details within and separates out the Common Industrial Protocol, I/O section 32-bit header and one does not.

I think maybe they are being dissected differently? How do I confirm? Then, why are packets of the same type displaying different?protocol dissecting differently?

CIP Sequence Count: 2
32-bit Header: 0x00000021, Run/Idle: Run
    .... .... .... .... .... .... .... 00.. = ROO: 0x0
    .... .... .... .... .... .... .... ..0. = COO: 0x0
    .... .... .... .... .... .... .... ...1 = Run/Idle: Run (0x1)
Data: 0000

CIP Sequence Count: 0
Data: 210000000000