Clarification regarding opcua protocol display filter
Hello,
I am writing to ask about the underlying query used to apply the display filter of opcua protocol in wireshark GUI. I wish to replicate the same functionality via Python using pyshark i.e I wish to use the display filter as it is in wireshark but pyshark doesn't support opcua protocol display filter out of the box. Thus, I want to know how wireshark applies this filter so that I can do the same programmatically.
works -> data = pyshark.FileCapture(pcap_file, display_filter="tcp")
does not work -> data = pyshark.FileCapture(pcap_file, display_filter="opcua")
Comments
Please update the question with the output of
tshark -v. (pysharkis a "Python wrapper for tshark")If there is an error message from the "does not work" please include it also.
Is it possible the
opcuatraffic is not on the default port or that theopcuaport preference has been changed in the profile you are using?9744: OPCUA Filter Doesn't Work
OPC UA is a C plugin and is loaded in a default Wireshark install, is it possible that pyshark isn't loading that plugin? Probably a question for pyshark support.