Yes, but in this case you have captured something else, not the OPC UA communication between the OPC client and the server. In your capture, all sources and destinations are 127.0.0.1.

Regards

Hello.

Actually, even better way to do this is to set "permanently" which ports are to be decoded as OpcUa. It is described here: opcconnect.opcfoundation.org/2017/02/analyzing-opc-ua-communications-with-wireshark/ , right at the beginning.

I should say, however, that this is just about how the information is *displayed* - in order to be able to check it. It does not affect what is captured, or what you then send to us.

But, I think that in your case, you have not captured the right thing in the first place. In your original posts, the server was addressed using a specific IP address, different from 127.0.0.1. I suppose that it means that the server is on a device different from the client PC? Is so, why then have you captured the traffic between two applications on the local machine? Or maybe the numerical IP was just the address of the same box, so in fact you *do* have both the client and the server on the same computer? Please clarify.

Best regards

Hello.As far as I can tell, what you have captured is not the OPC UA communication. When decoded as OpcUa in Wireshark, it gives "Invalid messages" every time.You must be able to see truly decoded OpcUa messages in Wireshark yourself - do you? Otherwise it doesn't make sense to send them over.

(you need to set "Decode As" to OpcUa for affected ports or IP addresses)

Example of what I see with your captures:



Example of how it (roughly) can look like when it is correct:



Regards

wiki.wireshark.org/CaptureSetup/CaptureSupport

Thank you.

Can you please collect the Wireshark trace a) with the client that does not work, and b) with the client that works, and send them to us?

Instructions: kb.opclabs.com/Collecting_information_for_troubleshooting .
In this particular case, the Wireshark capture will probably suffice (i.e. no need to enable the extended tracing and collect LogEntry-s, at least for the initial pass).

Best regards