IEC 60870-5-101/104: Wireshark doesn't decode File Transfer ASDU
Summary
Wireshark doesn't decode all the bytes for the following ASDU:
F_FR_NA_1 - 120 - File ready
F_SR_NA_1 - 121 - Section ready
F_SC_NA_1 - 122 - Call directory - select file - call file - call section
F_LS_NA_1 - 123 - Last section - last segment
F_AF_NA_1 - 124 - Ack file - ack section
Sample capture file
Steps to reproduce
1. Run a Slave device with protocol IEC-104
2. Run a Master device with protocol IEC-104
3. Request a File (upload or download)
What is the current bug behavior?
IEC 60870-5-101/104 ASDU: ASDU=12346 F_FR_NA_1 File IOA=10000 'file ready'
TypeId: F_FR_NA_1 (120)
0... .... = SQ: False
.000 0001 = NumIx: 1
..00 1101 = CauseTx: File (13)
.0.. .... = Negative: False
0... .... = Test: False
OA: 0
Addr: 12346
IOA: 10000
Raw Data: 0c005db60000
What is the expected correct behavior?
IEC 60870-5-101/104 ASDU: ASDU=12346 F_FR_NA_1 File IOA=10000 'file ready'
TypeId: F_FR_NA_1 (120)
0... .... = SQ: False
.000 0001 = NumIx: 1
..00 1101 = CauseTx: File (13)
.0.. .... = Negative: False
0... .... = Test: False
OA: 0
Addr: 12346
IOA: 10000
Raw Data: 0c005db60000
Decode correctly "Raw Data":
File number: 0x0c -> 12
File size: 0x005db6 -> 46685 bytes
RFQ:
0x00 -> OK
0x00 -> False
Build information
Version 4.6.2 (v4.6.2-0-g24d5e2b5a3dc).
Compile-time info:
Bit width: 64-bit
Compiler: Clang 14.0.3 (clang-1403.0.22.14.1)
GLib: 2.84.1
With:
+automatic updates +nghttp2 1.65.0
+brotli +nghttp3 1.9.0
+Gcrypt 1.11.2 +PCRE2 10.45 2025-02-05
+GnuTLS 3.8.11 and PKCS#11 +Qt 6.9.3
+Kerberos (MIT) +QtMultimedia
+libpcap +Snappy 1.2.2
+libsmi 0.4.8 +Sparkle
+libxml2 2.14.2 +xxhash 0.8.3
+Lua 5.4.7 +zlib 1.2.11
+LZ4 1.10.0 +zlib-ng 2.2.4
+MaxMind +Zstandard 1.5.7
+Minizip-ng 4.0.10
Without:
-POSIX capabilities
Runtime info:
OS: macOS 26.1, build 25B78 (Darwin 25.1.0)
CPU: Apple M1
Memory: 8192 MB of physical memory
GLib: 2.84.1
Locale: LC_TYPE=UTF-8
Plugins: supported, 23 loaded
With:
+brotli 1.2.0 +light display mode +Qt 6.9.3
+c-ares 1.34.5 +LZ4 1.10.0 +xxhash 803
+Gcrypt 1.11.2 +nghttp2 1.65.0 +zlib 1.2.12
+GnuTLS 3.8.11 +nghttp3 1.9.0 +Zstandard 1.5.7
+libpcap 1.10.1 +PCRE2 10.45 2025-02-05
+libsmi 0.4.8 +QPA plugin "cocoa"
Without:
-HiDPI