This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

We have a datalogic barcode scanner communicating with a momentum PLC which transmits data correctly. It is failing and we need to replace it with a new scanner which is the same model but has 10 years worth of device upgrades. The new device is showing a lot of TCP [Ethernet frame check sequence incorrect] errors and the packet size is different (110 original and 107 new). The only difference that I can see is that in the original scanner the Ethernet II frame in the "Modbus TCP" packet at the bottom below the "Type: IP(0X0800)" shows "Trailer: 200000". The new scanner Ethernet II frame does not have this. From what I've read on the internet "Trailer" increases the packet size to the minimum allowable without the need of padding. This makes sense as on the original scanner padding is 0 whereas the new scanner is always >0. Am I correct in assuming this and it is a hardware/firmware issue that needs to be addressed by the device supplier?

Updated link for public viewing. I've attached a link to the 2 file captures. https://drive.google.com/folderview?id=0B_wXYpDae4NcZi03QUJFYmZFUDA&usp=sharing

Brief description of events to make sense of file below.

FILE: ORIGINAL SCANNER.
1-6     Hand Held     1183648 (part of barcode that can be seen in packet)
7-12     No Read     Main scanner failed to read (sends NO READ to 10.240.119.201 to halt line)
13-20     Hand Held     1184494
21-24     Main Scanner Unit     1184676

FILE: NEW SCANNER.
1-6     Hand Held     Failed read (Appears to be writing 0000... to the PLC registers on each failed read)
7-13     Hand Held     Failed read
14-21     Hand Held     Failed read
22-30     Hand Held     Failed read
31-40     Hand Held     Successful read
41-47     Main Scanner     Failed read
48-56    Hand Held     Failed read
57-63     Hand Held     Failed read
64-70     Hand Held     Failed read
71-75     Hand Held     Failed read
75-79     Hand Held     Successful read

asked 19 Nov '14, 11:18

Getrick's gravatar image

Getrick
11113
accept rate: 0%

edited 20 Nov '14, 08:29

Could you post the capture file somewhere so folks could actually look at it rather than relying on your interpretation? Try Cloudshark, Drop Box or Google Drive etc. As it's only modbus traffic it won't be sensitive.

(19 Nov '14, 13:31) grahamb ♦

Google Drive says the files aren't shared publicly and I need permission.

(20 Nov '14, 02:50) grahamb ♦
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×32

question asked: 19 Nov '14, 11:18

question was seen: 1,945 times

last updated: 20 Nov '14, 08:29

p​o​w​e​r​e​d by O​S​Q​A