PCAP Analyzer

The PCAP Analyzer replays captured protocol traffic through the PLC4X codecs and reports what goes wrong.

For every packet it feeds the application payload into a real PLC4X codec, re-serializes the parsed message and compares the result against the original bytes. A mismatch means the reader and the writer of that message disagree, which makes the tool a regression harness for the codecs themselves - and a good way to find out why a driver fails on a particular device.

It is written in Go and lives in the plc4x-extras repository.

If you want to feed a capture back into a running driver instead of into the codecs, have a look at Capture Replay and at the PCAP Replay transport.

Building and running

cd plc4go
go run ./tools/plc4xpcapanalyzer ui --demo

Or build a standalone binary:

go build -o plc4xpcapanalyzer ./tools/plc4xpcapanalyzer

The analyzer reads captures through gopacket/pcap and therefore requires cgo and libpcap. Building with CGO_ENABLED=0 fails.

Commands

plc4xpcapanalyzer analyze <protocol> <capture>   # parse, reserialize and compare
plc4xpcapanalyzer extract <protocol> <capture>   # dump the application payloads
plc4xpcapanalyzer ui [capture]                   # the interactive terminal interface

The supported protocols are bacnetip and c-bus; bacnet and cbus are accepted as aliases.

extract only prints payloads at verbosity 2 and above, so pass -vv.

Configuration

Settings come from three places, in the usual order: a built-in default is overridden by the persisted session configuration, which is in turn overridden by a flag on the command line. conf set writes to the persisted layer, so a stored setting survives a restart without ever overriding a flag that was passed explicitly.

A flag passed with exactly its default value cannot be distinguished from an unset one, so for that field the persisted value wins.