First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

OPC UA - large read request is reported as malformed in 4.2.1 but not in 4.0.12

When a client makes a Read request for approximately 7000 nodes of Uint16 Data type at once, the issue arises within the Read Request. In the same OPC UA protocol packet, it has been reported that a Malformed Packet occurs in version 4.2.x, whereas in version 4.0.x, no Malformed Packet occurs.

It seems that the latest version of Wireshark is not properly reassembling the ReadRequest, leading to incorrect interpretation of OPC UA. Despite an array size of 6999 nodes, Wireshark only shows confirmation of requests for 1923 nodes. This appears to be limited to the first message fragment. 4.2.1 https://ibb.co/7GPFmBR https://ibb.co/Tm2GzJC

Using the 4.0.12 version of the same packet, the interpretation could be verified correctly up to 6998 nodes, unlike the issue observed with the latest version. v.4.0.12 https://ibb.co/6PspRdm

I am curious about the occurrence of Malformed Packets based on the version differences. Can you explain why this is happening?

yjchoi4's avatar
1
yjchoi4
asked 2024-01-08 01:22:13 +0000
Guy Harris's avatar
19.9k
Guy Harris
updated 2024-01-09 03:53:22 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

Because the code in 4.0.12 is different from the code in 4.2.1. One or more of one may have a bug (and a fix to a 4.0.12 bug may have introduced a 4.2.1 bug).

Please file an issue on the Wireshark issue list, and attach the raw capture (NOT a screenshot!) to the bug, as a capture file will make it MUCH easier to debug the problem and test a fix for the bug).

Guy Harris's avatar
19.9k
Guy Harris
answered 2024-01-08 07:12:48 +0000, updated 2024-01-08 07:13:14 +0000
edit flag offensive 0 remove flag delete link
more

Comments

This is now Wireshark issue 19581.

Guy Harris's avatar Guy Harris (2024-01-09 03:52:07 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer