Wireshark-bugs: [Wireshark-bugs] [Bug 10933] "Decode as" don't work well for modbus

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Fri, 06 Feb 2015 07:15:18 +0000

changed bug 10933


What Removed Added
CC   [email protected]

Comment # 3 on bug 10933 from 
As indicated in the source code of the dissector:

    /* XXX Update Oct 2012 - It can be difficult to determine if a packet is a
query or response; some way to track  */
    /* the Modbus/TCP transaction ID for each pair of messages would allow for
detection based on a new seq. number. */
    /* Otherwise, we can stick with this method; a configurable port option has
been added to allow for usage of     */
    /* user ports either than the default of 502.                              
                                     */

So the behavior you see in normal as the code cannot make the difference
between QUERY and RESPONSE packets.
What about an expert info hint suggesting to verify the port configured in
preferences in this case? Would it be an acceptable tradeoff?

You are receiving this mail because:
  • You are watching all bug changes.