SCADA Protocols - Decode. Analyze. Master.

Wireshark for Modbus RTU: How to Capture and Decode Serial RS-485 Traffic

Wireshark is known as an Ethernet protocol analyzer. But it can also capture Modbus RTU traffic over RS-485 serial links — using a free extension called WiresharkSerialAdapter. This is not a built-in feature. Wireshark does not natively capture from COM ports. You need a USB-to-RS-485 adapter connected to the bus as a passive listener, plus the WiresharkSerialAdapter extension… Read More: Wireshark for Modbus RTU: How to Capture and Decode Serial… »

Modbus Poll Android App: Read, Write, and Test Modbus Devices From Your Phone

If you work with PLCs, VFDs, sensors, or any Modbus device, you know the pain. You need to check a register value. You need to write a coil. But your laptop is back at the office — or buried in your bag. Modbus Poll for Android solves that problem. It turns your phone into a Modbus master. Connect… Read More: Modbus Poll Android App: Read, Write, and Test Modbus Devices… »

How to Decrypt Encrypted Industrial Protocol Traffic in Wireshark

Industrial protocols are moving to TLS encryption. Modbus/TCP Security uses port 802. IEC 60870-5-104 over TLS uses port 19998. IEC 61850 MMS over TLS uses port 3782. OPC UA encrypts at the application layer. When encryption is enabled, Wireshark shows “Application Data” instead of decoded protocol fields. You can see that packets are flowing, but you cannot read… Read More: How to Decrypt Encrypted Industrial Protocol Traffic in Wireshark »

PROFINET Conformance Classes Explained: CC-A, CC-B, CC-C (IRT), and CC-D (TSN)

PROFINET is one protocol — not three. But it comes in four conformance classes that define what a device can do, how fast it communicates, and what network infrastructure it needs. Engineers often confuse PROFINET RT, PROFINET IRT, and PROFINET IO as separate protocols. They are not. They are all part of PROFINET IO, defined in IEC 61158… Read More: PROFINET Conformance Classes Explained: CC-A, CC-B, CC-C (IRT), and CC-D… »

How to Configure PROFINET in TIA Portal (Step-by-Step Guide)

PROFINET is the default communication protocol on every Siemens S7-1200 and S7-1500 PLC. The PROFINET interface is built into the CPU — no extra modules needed. But setting up a PROFINET network in TIA Portal involves several steps that must happen in the right order. You need to install the GSD file, add the IO-Device to the network,… Read More: How to Configure PROFINET in TIA Portal (Step-by-Step Guide) »

PROFINET vs EtherNet/IP: Complete Comparison for Industrial Engineers

PROFINET and EtherNet/IP are the two largest Industrial Ethernet protocols in the world. Together they account for over 60% of all new industrial Ethernet nodes installed each year. Both run on standard Ethernet hardware — same cables, same connectors, same switches. But the similarity ends at the physical layer. Above Layer 2, they use completely different protocol stacks,… Read More: PROFINET vs EtherNet/IP: Complete Comparison for Industrial Engineers »

Wireshark for PROFINET: How to Capture and Decode RT, DCP, and IO Traffic

PROFINET traffic does not use TCP/IP for cyclic I/O data. It runs directly on Ethernet Layer 2 with EtherType 0x8892. This means you cannot capture it with a TCP port filter — you need to capture all Ethernet traffic on the interface and then filter in Wireshark. Wireshark fully decodes PROFINET using several dissectors: This guide covers how… Read More: Wireshark for PROFINET: How to Capture and Decode RT, DCP,… »

Wireshark for MQTT: How to Capture and Decode Industrial IoT Traffic

MQTT (MQ Telemetry Transport) is the most widely used protocol in industrial IoT. It connects sensors, PLCs, gateways, and edge devices to cloud platforms and SCADA historians using a lightweight publish/subscribe model over TCP. Wireshark fully decodes MQTT — every CONNECT, PUBLISH, SUBSCRIBE, and DISCONNECT message, including topic names, QoS levels, payloads, and client IDs — all in… Read More: Wireshark for MQTT: How to Capture and Decode Industrial IoT… »

Wireshark for OPC UA: How to Capture and Decode Client/Server Traffic

OPC UA (Unified Architecture) is the leading platform-independent protocol for industrial data exchange. It connects SCADA systems, MES platforms, HMI panels, historians, and cloud gateways to PLCs, DCS controllers, and edge devices. OPC UA uses the OPC Binary protocol over TCP on port 4840 (IANA registered as “opc.tcp”). Wireshark decodes every OPC UA service — OpenSecureChannel, CreateSession, Browse,… Read More: Wireshark for OPC UA: How to Capture and Decode Client/Server… »

Wireshark for DNP3: How to Capture, Filter, and Troubleshoot

DNP3 (Distributed Network Protocol 3.0) is the dominant SCADA protocol in North America for electric utilities, water systems, and oil and gas. It runs over TCP or UDP on port 20000. Wireshark fully decodes DNP3 — data link layer, transport layer, and application layer. You can see every function code, object group, data point index, quality flag, and… Read More: Wireshark for DNP3: How to Capture, Filter, and Troubleshoot »