{"id":291,"date":"2021-04-12T10:34:46","date_gmt":"2021-04-12T07:34:46","guid":{"rendered":"https:\/\/zerontek.com\/zt\/?p=291"},"modified":"2021-04-12T19:21:12","modified_gmt":"2021-04-12T16:21:12","slug":"wireshark-filters-for-ics-protocols","status":"publish","type":"post","link":"https:\/\/zerontek.com\/zt\/2021\/04\/12\/wireshark-filters-for-ics-protocols\/","title":{"rendered":"Wireshark filters for ICS protocols"},"content":{"rendered":"\n

Wireshark is a powerful tool for analyzing network packets. I did a search on the web in order to assemble a list of ICS protocols. Then I tried to look them up in Wireshark. There is a “filter expression” feature in Wireshark that enables you to filter out packets and find specific information [passwords, port number, function code …etc] . Luckily I found 32 ICS protocols in Wireshark. Most of them are the major and mainstream protocols such as Modbus, DNP3 and IEC60870. I also discovered ICS protocols that I never heard of because they are not publicized in the ICS community much. I noticed that Wireshark don’t support all ICS protocols filters, for example GE-SRTP, ICCP or Pcworx and others . I have added this list to my github<\/a>. My github project<\/a> includes ICS security resources that are useful for ICS security researchers. Having ICS filters in Wireshark is a major contribution in ICS network security. I hope there will be more ICS protocols in the coming releases.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
  1. BSAP<\/li>
  2. Bacnet<\/li>
  3. C12.22<\/li>
  4. CANopen<\/li>
  5. CIP<\/li>
  6. DeviceNet<\/li>
  7. Dnp3<\/li>
  8. EGD<\/li>
  9. EtherNetIP<\/li>
  10. Ethercat<\/li>
  11. Ethernet PowerLink<\/li>
  12. Fieldbus<\/li>
  13. Goose<\/li>
  14. HartIP<\/li>
  15. IEC60870_101<\/li>
  16. IEC60870_104<\/li>
  17. IEC60870_asdu<\/li>
  18. KNX<\/li>
  19. Modbus<\/li>
  20. Modbus \/ TCP<\/li>
  21. Modbus \/ UDP<\/li>
  22. Modbus RTU<\/li>
  23. OPC UA<\/li>
  24. Omron FINS<\/li>
  25. Profibus<\/li>
  26. Profinet<\/li>
  27. S7comm<\/li>
  28. Sercos<\/li>
  29. Sinec H1<\/li>
  30. TTEthernet<\/li>
  31. Tristation<\/li>
  32. Zigbee<\/li><\/ol>\n","protected":false},"excerpt":{"rendered":"

    Wireshark is a powerful tool for analyzing network packets. I did a search on the web in order to assemble a list of ICS protocols. Then I tried to look them up in Wireshark. There is a “filter expression” feature in Wireshark that enables you to filter out packets and find specific information [passwords, port […]<\/p>\n","protected":false},"author":2,"featured_media":293,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,45,3,46,48,5],"tags":[7,42,6,44,47,43],"class_list":["post-291","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security","category-ics-protocols","category-ics-security","category-ics-tools","category-ot-security","category-vendors","tag-cyber-security","tag-ics-protocols","tag-ics-security","tag-ics-tools","tag-ot-security","tag-wireshark"],"_links":{"self":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/291","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/comments?post=291"}],"version-history":[{"count":9,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/291\/revisions"}],"predecessor-version":[{"id":306,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/291\/revisions\/306"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/media\/293"}],"wp:attachment":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/media?parent=291"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/categories?post=291"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/tags?post=291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}