Wireshark - access to PLC ?

EICS

Member

Join Date

Dec 2008

Location

Melbourne, Australia

Posts

323

• Jul 14, 2022

• #1

if this thread contravenes this sites rules i will delete it.

has anyone used Wireshark to access a password-ed PLC via a serial port or know if this is at all "technically" possible?

i am not asking for a "how to" just simply if it is at all possible.

Machine is Chinese built and only 5 years old, the OEM does not have the password as they had another company do the automation, that other company will not supply it due to what they term as "secret business"

 

goghie

Lifetime Supporting Member

G

Join Date

Jan 2008

Location

Belgrade

Posts

800

• Jul 14, 2022

• #2

Depending on PLC, but mostly you can do it.

 

parky

Member

P

Join Date

Oct 2004

Location

Midlands

Posts

5,744

• Jul 14, 2022

• #3

See your private messages.

 

mad4x4

Member

Join Date

Mar 2009

Location

ST CYrus

Posts

362

• Jul 14, 2022

• #4

Wire shark is for ethernet, not serial. You will need to look at multidrop serial and a Telnet type application.


What brand of PLC?

 

parky

Member

P

Join Date

Oct 2004

Location

Midlands

Posts

5,744

• Jul 14, 2022

• #5

There are a number of serial sniffers that when run can see the send/recieve traffic & log it. they even work on USB to serial cables.

 

ArcReactorKC

Member

A

Join Date

Jun 2021

Location

Midwest

Posts

70

• Jul 14, 2022

• #6

mad4x4 said:

Wire shark is for ethernet, not serial. You will need to look at multidrop serial and a Telnet type application.


What brand of PLC?

Click to expand...

Wireshark can if the comm is on a USB dongle. It would use the USBPCAP driver to do so.

I have had success with Micrologix processors when the previous engineer passed away unexpectedly with every single processor in the building password locked.

 

jschulze

Member

J

Join Date

Apr 2022

Location

WI

Posts

46

• Jul 14, 2022

• #7

You can use this program to capture serial traffic on a COM port and it will save it as a Wireshark PCAP file
https://github.com/j123b567/SerialPCAP


I just tested it with Modbus RTU traffic, and it seems to work. I did have to increase the gap time though (the default is 10ms) because it was splitting up packets incorrectly at 10ms.

 

EICS

Member

OP

Join Date

Dec 2008

Location

Melbourne, Australia

Posts

323

• Jul 14, 2022

• #8

mad4x4 said:

Wire shark is for ethernet, not serial. You will need to look at multidrop serial and a Telnet type application.


What brand of PLC?

Click to expand...

its a Mitsubishi FX3