PROFINET packets

Jun 15, 2010 at 2:53 PM
I'm thinking about analyzing PROFINET packets that are sent over TCP/IP. According to Wikipedia: "Wireshark/Ethereal are able to decode PROFINET message frames." Is this somehow usefull for me ? I mean, could Pcap.Net return something more than just a raw TCP layer ?
Jun 15, 2010 at 4:05 PM
Edited Jun 15, 2010 at 4:06 PM
Currently, Pcap.Net doesn't parse anything under TCP layer. It can give you the different TCP fields and the raw TCP payload. HTTP over TCP parsing will be available soon. I don't know the PROFINET protocol over TCP. It could be parsed over a TCP packet. However, you might need to reconstruct the TCP stream before parsing PROFINET. I suggest you investigate this protocol a bit, find out how it works packet wise. Then, you can do one of the following: 1. If parsing every packet separately is enough you can: 1.a. Open a new issue in the issue tracker, which describes what kind of parsing you want. A link to a formal definition of the packet structure can be helpful to understand how to parse it. 1.b. Write your own code to parse a PROFINET packet over TCP. If you write it in the way Pcap.Net packet parsing is designed, you can suggest it as a patch to Pcap.Net. 2. If parsing every packet separately is not enough, you can: 2.a. Vote on the TCP reconstruction issue, after its done, you can do 1.a. or 1.b but for TCP streams instead of packets. 2.b. Write or use a TCP reconstruction library/application to reconstruct the TCP stream and then parse the protocol over the stream yourself. Boaz.