<font size="4"><font face="times new roman,serif">Hi, <br></font></font><div><font class="Apple-style-span" face="'times new roman', serif" size="4"><br></font></div><div><font class="Apple-style-span" face="'times new roman', serif" size="4">I have been working on modbus protocol analyzer by Binpac, which is an application-level protocol used in SCADA network. The protocol itself is not complex and it is not hard to express it in Binpac. However, this protocol in application level does not contain the information which can tell whether the parsing packet is a "request" or a "response". For example, in HTTP protocol, the http header will include such information. But for this protocol, the headers for both the request and response are the same. </font></div>
<div><font class="Apple-style-span" face="'times new roman', serif" size="4"><br></font></div><div><font class="Apple-style-span" face="'times new roman', serif" size="4">So if the traffic dump that I am using for the testing starts with the request, then the analyzer can properly parse it. However, if the traffic dump starts with the response, then the analyzer will not be properly parsing the packet. So I am wondering how to resolve this problem in my protocol analyzer. </font></div>
<div><font class="Apple-style-span" face="'times new roman', serif" size="4"><br></font></div><div><font class="Apple-style-span" face="'times new roman', serif" size="4"> </font></div><div><font class="Apple-style-span" face="'times new roman', serif" size="4">Best,</font></div>
<div><font class="Apple-style-span" face="'times new roman', serif" size="4"><br></font></div><div><font class="Apple-style-span" face="'times new roman', serif" size="4">Hui <br clear="all"></font><br>-- <br>
Hui Lin<br>Research Assistant<br>DEPEND Research Group, ECE Department<br>University of Illinois at Urbana-Champaign<br><a href="mailto:hlin33@illinois.edu" target="_blank">hlin33@illinois.edu</a><br>
</div>