Wireshark-users: Re: [Wireshark-users] IEC 60870-5-101 Dissector
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Graham Bloice <graham.bloice@xxxxxxxxxxxxx>
Date: Thu, 29 Jan 2009 09:27:32 +0000
Decio Tomasulo de Vicente wrote:

 

Hi,

 

We need to decode the IEC 101 protocol. I already found the 104 dissector.

 

Could someone help us to find the IEC 60870-5-101 Dissector ?

 

-104 is run over TCP, hence the dissector, -101 is generally run over serial links so it's a bit more difficult to capture.

Some folks, including me do run -101 via a terminal server (tcp <==> serial) so the data can be captured and inspected over the TCP leg.  IIRC the framing info is different for the variants so parts of the existing dissector could be used, but there would need to be new code to remove the serial framing and checksum info.
-- 
Regards,

Graham Bloice