This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Modbus TCP working on original device but not new

0

We have a datalogic barcode scanner communicating with a momentum PLC which transmits data correctly. It is failing and we need to replace it with a new scanner which is the same model but has 10 years worth of device upgrades. The new device is showing a lot of TCP [Ethernet frame check sequence incorrect] errors and the packet size is different (110 original and 107 new). The only difference that I can see is that in the original scanner the Ethernet II frame in the "Modbus TCP" packet at the bottom below the "Type: IP(0X0800)" shows "Trailer: 200000". The new scanner Ethernet II frame does not have this. From what I've read on the internet "Trailer" increases the packet size to the minimum allowable without the need of padding. This makes sense as on the original scanner padding is 0 whereas the new scanner is always >0. Am I correct in assuming this and it is a hardware/firmware issue that needs to be addressed by the device supplier?

Updated link for public viewing. I've attached a link to the 2 file captures. https://drive.google.com/folderview?id=0B_wXYpDae4NcZi03QUJFYmZFUDA&usp=sharing

Brief description of events to make sense of file below.

FILE: ORIGINAL SCANNER.
1-6     Hand Held     1183648 (part of barcode that can be seen in packet)
7-12     No Read     Main scanner failed to read (sends NO READ to 10.240.119.201 to halt line)
13-20     Hand Held     1184494
21-24     Main Scanner Unit     1184676

FILE: NEW SCANNER. 1-6 Hand Held Failed read (Appears to be writing 0000… to the PLC registers on each failed read) 7-13 Hand Held Failed read 14-21 Hand Held Failed read 22-30 Hand Held Failed read 31-40 Hand Held Successful read 41-47 Main Scanner Failed read 48-56 Hand Held Failed read 57-63 Hand Held Failed read 64-70 Hand Held Failed read 71-75 Hand Held Failed read 75-79 Hand Held Successful read

asked 19 Nov ‘14, 11:18

Getrick's gravatar image

Getrick
11113
accept rate: 0%

edited 20 Nov ‘14, 08:29

Could you post the capture file somewhere so folks could actually look at it rather than relying on your interpretation? Try Cloudshark, Drop Box or Google Drive etc. As it’s only modbus traffic it won’t be sensitive.

(19 Nov ‘14, 13:31) grahamb ♦

Google Drive says the files aren’t shared publicly and I need permission.

(20 Nov ‘14, 02:50) grahamb ♦