osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity
wireshark/epan/dissectors/packet-mbtcp.h

102 lines
3.2 KiB
C
Raw Normal View History

From Michael Mann: I made the following improvements to the Modbus/TCP dissector: 1. Implemented protocol to the latest specification (v1.1b). See http://www.modbus.org/specs.php. 2. Upgraded to "tcp_dissect_pdus" instead of having the dissector do it manually. This also provides TCP packet reassembly support. 3. Removed support for UDP port 502 because it's not supported by the protocol specification. I believe "Decode As..." could be used in its place. 4. Added dissector support for the following function codes: a) 8 - Diagnostics b) 11 - Event Counter c) 12 - Event Log d) 43 - Encapsulation Transport (mostly for 43/14) 5. Removed support for function codes not in the protocol specification. None of them were really being parsed, they just offered a "name" for the function code. 6. Moved protocol #defines to header file for access from other dissectors. I plan to have other dissectors use this, but one patch at a time. 7. Created "modbus" dissector that is accessible to other dissectors. 8. Renamed base "display filter name" to reflect PROTOABBREV. I removed defines for value_strings, I think it's better to export the vaöue strings if needed. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5923 svn path=/trunk/; revision=37539
2011-06-04 15:45:50 +00:00
/* packet-mbtcp.h
* $Id$
* Routines for Modbus/TCP dissection
* By Riaan Swart <rswart@cs.sun.ac.za>
* Copyright 2001, Institute for Applied Computer Science
* University of Stellenbosch
*
* See
*
* http://www.modbus.org/
*
* for information on Modbus/TCP.
*
* $Id$
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
Update FSF address - part II. svn path=/trunk/; revision=43538
2012-06-28 23:18:38 +00:00
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
From Michael Mann: I made the following improvements to the Modbus/TCP dissector: 1. Implemented protocol to the latest specification (v1.1b). See http://www.modbus.org/specs.php. 2. Upgraded to "tcp_dissect_pdus" instead of having the dissector do it manually. This also provides TCP packet reassembly support. 3. Removed support for UDP port 502 because it's not supported by the protocol specification. I believe "Decode As..." could be used in its place. 4. Added dissector support for the following function codes: a) 8 - Diagnostics b) 11 - Event Counter c) 12 - Event Log d) 43 - Encapsulation Transport (mostly for 43/14) 5. Removed support for function codes not in the protocol specification. None of them were really being parsed, they just offered a "name" for the function code. 6. Moved protocol #defines to header file for access from other dissectors. I plan to have other dissectors use this, but one patch at a time. 7. Created "modbus" dissector that is accessible to other dissectors. 8. Renamed base "display filter name" to reflect PROTOABBREV. I removed defines for value_strings, I think it's better to export the vaöue strings if needed. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5923 svn path=/trunk/; revision=37539
2011-06-04 15:45:50 +00:00
*/
#define PORT_MBTCP 502 /* Modbus/TCP located on port 502 */
/* Modbus protocol function codes */
#define READ_COILS 1
#define READ_INPUT_DISCRETES 2
#define READ_MULT_REGS 3
#define READ_INPUT_REGS 4
#define WRITE_COIL 5
#define WRITE_SINGLE_REG 6
#define READ_EXCEPT_STAT 7
#define DIAGNOSTICS 8
#define GET_COMM_EVENT_CTRS 11
#define GET_COMM_EVENT_LOG 12
#define WRITE_MULT_COILS 15
#define WRITE_MULT_REGS 16
#define REPORT_SLAVE_ID 17
#define READ_FILE_RECORD 20
#define WRITE_FILE_RECORD 21
#define MASK_WRITE_REG 22
#define READ_WRITE_REG 23
#define READ_FIFO_QUEUE 24
#define ENCAP_INTERFACE_TRANSP 43
/* Modbus protocol exception codes */
#define ILLEGAL_FUNCTION 0x01
#define ILLEGAL_ADDRESS 0x02
#define ILLEGAL_VALUE 0x03
From Michael Mann via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6697 Modbus object support for CIP dissector Support for the Modbus object within the CIP dissector. Essentially wraps the Modbus protocol within a CIP object. Also included update to Modbus error code per http://www.wireshark.org/lists/wireshark-dev/201111/msg00187.html svn path=/trunk/; revision=40371
2012-01-04 13:29:48 +00:00
#define SLAVE_FAILURE 0x04
From Michael Mann: I made the following improvements to the Modbus/TCP dissector: 1. Implemented protocol to the latest specification (v1.1b). See http://www.modbus.org/specs.php. 2. Upgraded to "tcp_dissect_pdus" instead of having the dissector do it manually. This also provides TCP packet reassembly support. 3. Removed support for UDP port 502 because it's not supported by the protocol specification. I believe "Decode As..." could be used in its place. 4. Added dissector support for the following function codes: a) 8 - Diagnostics b) 11 - Event Counter c) 12 - Event Log d) 43 - Encapsulation Transport (mostly for 43/14) 5. Removed support for function codes not in the protocol specification. None of them were really being parsed, they just offered a "name" for the function code. 6. Moved protocol #defines to header file for access from other dissectors. I plan to have other dissectors use this, but one patch at a time. 7. Created "modbus" dissector that is accessible to other dissectors. 8. Renamed base "display filter name" to reflect PROTOABBREV. I removed defines for value_strings, I think it's better to export the vaöue strings if needed. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5923 svn path=/trunk/; revision=37539
2011-06-04 15:45:50 +00:00
#define ACKNOWLEDGE 0x05
#define SLAVE_BUSY 0x06
#define MEMORY_ERR 0x08
#define GATEWAY_UNAVAILABLE 0x0a
#define GATEWAY_TRGT_FAIL 0x0b
/* Modbus diagnostic subfunction codes */
#define RETURN_QUERY_DATA 0x00
#define RESTART_COMMUNICATION_OPTION 0x01
#define RETURN_DIAGNOSTIC_REGISTER 0x02
#define CHANGE_ASCII_INPUT_DELIMITER 0x03
#define FORCE_LISTEN_ONLY_MODE 0x04
#define CLEAR_COUNTERS_AND_DIAG_REG 0x0A
#define RETURN_BUS_MESSAGE_COUNT 0x0B
#define RETURN_BUS_COMM_ERROR_COUNT 0x0C
#define RETURN_BUS_EXCEPTION_ERROR_COUNT 0x0D
#define RETURN_SLAVE_MESSAGE_COUNT 0x0E
#define RETURN_SLAVE_NO_RESPONSE_COUNT 0x0F
#define RETURN_SLAVE_NAK_COUNT 0x10
#define RETURN_SLAVE_BUSY_COUNT 0x11
#define RETURN_BUS_CHAR_OVERRUN_COUNT 0x12
#define CLEAR_OVERRUN_COUNTER_AND_FLAG 0x14
/* Encapsulation Interface codes */
#define CANOPEN_REQ_RESP 0x0D
#define READ_DEVICE_ID 0x0E
/* Event byte codes */
#define REMOTE_DEVICE_RECV_EVENT_MASK 0x80
#define REMOTE_DEVICE_SEND_EVENT_MASK 0xc0
#define REMOTE_DEVICE_SEND_EVENT_VALUE 0x40
/* return codes of function classifying packets as query/response */
#define QUERY_PACKET 0
#define RESPONSE_PACKET 1
#define CANNOT_CLASSIFY 2
Avoid no-newline-at-end-of-file warning. svn path=/trunk/; revision=37565
2011-06-06 09:40:30 +00:00
#define MODBUS_PROTOCOL_ID 0