# How to see the OPCUA connection with wireshark **URL:** \ **Category:** Ignition\ **Created:** [January 15, 2013, 9:30am UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686 "2013-01-15T09:30:25Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![afasika](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@afasika](https://forum.inductiveautomation.com/u/afasika)\ **Post date:** [January 15, 2013, 9:30am UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/1 "2013-01-15T09:30:25Z")
Hi everyone, I am trying to monitor the OPC UA connection between Ignition and client with wireshark, i set wireshark to check ports 4096 and 8088 but i am only seeing TCP/UDP communications ☹ , i am trying to achieve something like the snapshot in the attached file. Pleaseeee!!! could anyone help? I have been on this for days Thanks Ayodele Fasika ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/6/61d715367831121f35093d69d5bd4cb48af46fbd.jpg) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 15, 2013, 1:10pm UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/2 "2013-01-15T13:10:06Z")
Make sure the connection has no security set up on it. ---
**Author:** ![afasika](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@afasika](https://forum.inductiveautomation.com/u/afasika)\ **Post date:** [January 15, 2013, 1:21pm UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/3 "2013-01-15T13:21:30Z")
Yeah, but I already disabled the firewalls on the client and on the server systems, i am thinking perhaps there’s something i’m missing or something i did not do. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 15, 2013, 1:28pm UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/4 "2013-01-15T13:28:58Z")
I mean in the UA connection settings, you have to turn encryption off. ---
**Author:** ![afasika](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@afasika](https://forum.inductiveautomation.com/u/afasika)\ **Post date:** [January 15, 2013, 1:59pm UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/5 "2013-01-15T13:59:13Z")
Hi, thanks, we tried it already, i changed the setting in the OPC Connections from SIgnandEncrypt to just Sign, but i’m not still getting communications. Also in wireshark i am listening from port 8088 and 4096, could this be the problem? I am still seeing only TCP/UDP communication. DO you perhaps have any more suggestions? Thanks ---
**Author:** ![DennisWomack](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@DennisWomack](https://forum.inductiveautomation.com/u/DennisWomack)\ **Post date:** [January 15, 2013, 2:14pm UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/6 "2013-01-15T14:14:37Z")
Do you have Wireshark running on 3rd machine? ---
**Author:** ![afasika](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@afasika](https://forum.inductiveautomation.com/u/afasika)\ **Post date:** [January 15, 2013, 2:27pm UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/7 "2013-01-15T14:27:05Z")
Ok let me explain the configuration: Ignition server is installed on a system with a PLC connected to it, i connected to the PLC from a client PC through the server, the connection was established and we can see that it is connected. I tried to monitor the communication using wireshark on the server and on the client system, but i have not been successful so far. I need to present this product to my superiors but i want to show them the OPC UA communication with wireshark. Thanks ---
**Author:** ![thechtman](https://avatars.discourse-cdn.com/v4/letter/t/e56c9b/32.png) [@thechtman](https://forum.inductiveautomation.com/u/thechtman)\ **Post date:** [January 15, 2013, 4:24pm UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/8 "2013-01-15T16:24:20Z")
Wireshark must be running on the same computer as the Ignition server. The only way that I know of to get around this is to use port mirroring on your router. If your server has multiple NICs make sure the Wireshark capture is started for the one that Ignition is going through to communicate to the PLC. Keep in mind that Wireshark will show all communications going in and out of the server including non Ignition communications. It can get very confusing trying to narrow down on the packets of interest. You can use the filter but, I find it best to set the capture filter to the PLC’s IP address and not by port as shown in the attached image. Notice in the image behind the dialogs that only packets that involve IP address 10.20.4.55 are shown. ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/3/3f686f687c29b7c8a8423eb9911668013e0dcabe.jpg) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 15, 2013, 5:05pm UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/9 "2013-01-15T17:05:01Z")
You should set both the “Security Policy” and “Message Security Mode” setting to None. ---
**Author:** ![afasika](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@afasika](https://forum.inductiveautomation.com/u/afasika)\ **Post date:** [January 16, 2013, 9:16am UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/10 "2013-01-16T09:16:56Z")
Thanks for the tip, i already tried it, if you see the attached image, 192.168.0.30 is the server and 192.168.0.1 is the PLC, i did everything you asked. It is giving me TCP packets, maybe because i am new to this field but i was expecting to see opcua secure message packets just like the first screenshot at the beginning of this conversation thread or is there a way i can analyze this to prove that it is OPC UA? because i already tried to make some research but i wasn’t successful. I would appreciate anymore suggestions you may have. I just started working in this field 2 weeks ago. Thanks ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/e/e98b4d217b2aaae3b8082cfbf050074980b75740.JPG) ---
**Author:** ![afasika](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@afasika](https://forum.inductiveautomation.com/u/afasika)\ **Post date:** [January 16, 2013, 10:48am UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/11 "2013-01-16T10:48:41Z")
Hi, Thanks, i think i figured it out, when i followed a TCP packet i saw the encrypted information shown in the snapshot, i guess this is the connection. Thanks ![:prayer:](https://us1.discourse-cdn.com/inductiveautomation/original/1X/e5a7e3b63facc151ea73e3b45db7bdb3d4bdc316.gif ":prayer:") ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/7/78742b8d74fa8c39dbb0244dd80baaec7c172776.JPG) ---
**Author:** ![thechtman](https://avatars.discourse-cdn.com/v4/letter/t/e56c9b/32.png) [@thechtman](https://forum.inductiveautomation.com/u/thechtman)\ **Post date:** [January 16, 2013, 4:10pm UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/12 "2013-01-16T16:10:10Z")
No problem, we all had to start at the beginning. What type of PLC are you connecting with? When viewing the communications between the an OPC-UA server and a PLC, you will not see opcUA protocol show up in Wireshark. That is unless the PLC has a built in OPC-UA server (I can only hope this will be the case in the future). Instead, you will see protocols like Modbus, EIP, CIP, in some cases just TCP packets, etc. depending on the brand and model of the PLC you are communicating with. You will see opcUa protocol packets in Wireshark if you configure Ignition to connect to an external OPC-UA server (such as Kepware). ---
**Author:** ![afasika](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@afasika](https://forum.inductiveautomation.com/u/afasika)\ **Post date:** [January 17, 2013, 8:59pm UTC](https://forum.inductiveautomation.com/t/how-to-see-the-opcua-connection-with-wireshark/5686/13 "2013-01-17T20:59:41Z")
Thank you very much!!!