This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Capturing messaged from a PLC

0

My laptop is wired to a switch which is also wired to 2 Micrologix 1400 plc's. About every 1/2 second one plc is getting data from the other via a message instruction over the ethernet/ip connection and I have verified that this is working properly online with the plc. I was trying to detect this information with wireshark but I'm not having any luck. I even tried a filter for the specific static plc address 10.250.0.130. I would be grateful for any suggestions to get me going in the proper direction.

asked 09 Feb '15, 08:16

wdfiller's gravatar image

wdfiller
6112
accept rate: 0%


One Answer:

0

You might want to have a look at http://wiki.wireshark.org/CaptureSetup/Ethernet

(switches only forward frames to the port on which the destination mac address has been seen, so you need to take special action to see the frames in Wireshark)

answered 09 Feb '15, 08:50

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Thanks, that makes sense. I do have a managed switch so I will look into that solution.

(09 Feb '15, 08:56) wdfiller