Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 10933] "Decode as" don't work well for modbus

[bugzilla-daemon@xxxxxxxxxxxxx]

Pascal Quantin changed bug 10933

What	Removed	Added
CC		pascal.quantin@gmail.com

Comment # 3 on bug 10933 from Pascal Quantin

As indicated in the source code of the dissector:

    /* XXX Update Oct 2012 - It can be difficult to determine if a packet is a
query or response; some way to track  */
    /* the Modbus/TCP transaction ID for each pair of messages would allow for
detection based on a new seq. number. */
    /* Otherwise, we can stick with this method; a configurable port option has
been added to allow for usage of     */
    /* user ports either than the default of 502.                              
                                     */

So the behavior you see in normal as the code cannot make the difference
between QUERY and RESPONSE packets.
What about an expert info hint suggesting to verify the port configured in
preferences in this case? Would it be an acceptable tradeoff?

---

      You are receiving this mail because:

• You are watching all bug changes.