Ask Your Question

Revision history [back]

CIPSafety and Bad CRCs

Hi,

I'm using Wireshark to capture the CIPSafety packets between an Allen-Bradley PLC and a valve control board. After a little while Wireshark shows all of the packets from the PLC as having CRC-S5 incorrect. If the target thought the CRC was bad I would expect it to drop the connection but it doesn't. This makes me think there might be something wrong in the Wireshark CRC verification or maybe I have something configured wrong?

I tried upgrading to the latest release of Wireshark (3.6.1) but I still get the same error.

I have a capture showing the problem but I can't upload due to my newbie karma.

Here's a raw packet dump of one of the messages that shows the CRC error in Wireshark:

0000: 00 a0 91 2f 0d 71 5c 88 16 b9 84 ef 08 00 45 ac

0010: 00 35 96 fc 00 00 40 11 5e 9e c0 a8 01 25 c0 a8

0020: 01 fc 08 ae 08 ae 00 21 eb af 02 00 02 80 08 00

0030: 82 00 ad 80 fc 5b 00 00 b1 00 07 00 01 87 66 44

0040: c2 04 64

Has anyone else seen this? Any idea what's wrong?

Thanks, Phil

CIPSafety and Bad CRCs

Hi,

I'm using Wireshark to capture the CIPSafety packets between an Allen-Bradley PLC and a valve control board. After a little while Wireshark shows all of the packets from the PLC as having CRC-S5 incorrect. If the target thought the CRC was bad I would expect it to drop the connection but it doesn't. This makes me think there might be something wrong in the Wireshark CRC verification or maybe I have something configured wrong?

I tried upgrading to the latest release of Wireshark (3.6.1) but I still get the same error.

I have a capture showing the problem but I can't upload due to my newbie karma. You can download it from here: https://drive.google.com/file/d/1eX3HAZjXpCEmaVAVUXpAta5a1Y5GMush/view?usp=sharing

Here's a raw packet dump of one of the messages that shows the CRC error in Wireshark:

0000: 00 a0 91 2f 0d 71 5c 88 16 b9 84 ef 08 00 45 ac

0010: 00 35 96 fc 00 00 40 11 5e 9e c0 a8 01 25 c0 a8

0020: 01 fc 08 ae 08 ae 00 21 eb af 02 00 02 80 08 00

0030: 82 00 ad 80 fc 5b 00 00 b1 00 07 00 01 87 66 44

0040: c2 04 64

Has anyone else seen this? Any idea what's wrong?

Thanks, Phil