在工控系統(tǒng)中通信協(xié)議存在眾多標(biāo)準(zhǔn)，也存在眾多私有協(xié)議，如果你有過使用組態(tài)軟件的經(jīng)歷，你便會發(fā)現(xiàn)，在第一步連接設(shè)備時除連接設(shè)備的方式有以太網(wǎng)/串行等方式外，各家基本上都存在自己的私有通信協(xié)議。
上圖為，某SCADA軟件驅(qū)動配置界面
大家都知道普遍的工控協(xié)議在傳輸?shù)倪^程不加密、協(xié)議上無認(rèn)證，往往可以通過協(xié)議分析，并形成一些測試用例針對特定運行環(huán)境下支持該協(xié)議的設(shè)備達(dá)到異常運行的效果。如之前提到過的強制操作物理輸出（使用FINS協(xié)議攻擊歐姆龍（Omron）PLC的物理（I/O）輸出）、程序的上傳下載、重置設(shè)備狀態(tài)等。而這個過程中除官方提供的一些協(xié)議文檔外，像wireshark也支持了大量的工控協(xié)議，可以很方便的了解協(xié)議中的一些字段的功能、命令等。
私有協(xié)議分類
在眾多公開或私有協(xié)議中可分為如下幾類：
標(biāo)準(zhǔn)協(xié)議：國際標(biāo)準(zhǔn)或公認(rèn)的標(biāo)準(zhǔn)協(xié)議，如Modbus、DNP3、IEC104等
私有公開：只有廠商自己設(shè)備支持并提供官方協(xié)議文檔，如Omron FINS協(xié)議、三菱Melsec協(xié)議等
私有不公開：只有廠商自己設(shè)備支持且官方不提供協(xié)議文檔，如S7、西門子PPI協(xié)議、GE SRTP等
使用Wireshark分析常見工控協(xié)議
Wireshark是一個強大開源流量與協(xié)議分析工具，除了傳統(tǒng)網(wǎng)絡(luò)協(xié)議解碼外，還支持眾多主流和標(biāo)準(zhǔn)工控協(xié)議的分析與解碼。為此我整理了Wireshark源碼中涉及與自控有關(guān)的協(xié)議的packet dissection實現(xiàn)代碼路徑，供大家參考和自己留存。
| 序號 | 協(xié)議類型 | 源碼下載 | 簡介 |
| 1 | Siemens S7 | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-s7comm.c | 西門子PLC支持的通訊協(xié)議 |
| 2 | MMS(IEC61850) | https://github.com/wireshark/wireshark/tree/master/asn1/mms | 輸配電通訊協(xié)議 |
| 3 | GOOSE(IEC61850) | https://github.com/wireshark/wireshark/tree/master/asn1/goose | 輸配電通訊協(xié)議 |
| 4 | SV(IEC61850) | https://github.com/wireshark/wireshark/tree/master/asn1/sv | 輸配電通訊協(xié)議 |
| 5 | Modbus | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-mbtcp.c | 工控標(biāo)準(zhǔn)協(xié)議 |
| 6 | OPC DA | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-dcom.c | 工控標(biāo)準(zhǔn)協(xié)議 |
| 7 | FF HSE | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-ff.c | 基金會現(xiàn)場總線以太網(wǎng)通信協(xié)定 |
| 8 | IEC 104 | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-iec104.c | 輸配電通訊協(xié)議 |
| 9 | Ethernet POWERLINK | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-epl.c | 開放式實時以太網(wǎng)通信 |
| 10 | OPC UA | https://github.com/wireshark/wireshark/tree/master/plugins/opcua/opcua.c | OPC新一代標(biāo)準(zhǔn) |
| 11 | HART-IP | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-hartip.c | 高速可尋址遠(yuǎn)程傳感器協(xié)議 |
| 12 | CoAP | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-coap.c | 輕量應(yīng)用層協(xié)議 |
| 13 | Omron FINS | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-omron-fins.c | 歐姆龍PLC支持的通訊協(xié)定 |
| 14 | openSAFETY | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-opensafety.c | 開源安全應(yīng)用協(xié)議 |
| 15 | EGD(Ethernet Global Data) | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-egd.c | GE Fanuc為PLC開發(fā)的通訊協(xié)定 |
| 16 | DNP3 | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-dnp.c | 分布式網(wǎng)絡(luò)協(xié)議，主要用于電力行業(yè) |
| 17 | Sinec H1 | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-h1.c | 西門子PLC支持的通訊協(xié)議 |
| 18 | Profinet | https://github.com/wireshark/wireshark/tree/master/plugins/profinet/ | 開放式的工業(yè)以太網(wǎng)通訊協(xié)定 |
| 19 | EtherCAT | https://github.com/wireshark/wireshark/tree/master/plugins/ethercat/ | 德國Beckhoff公司推動的開放式實時以太網(wǎng)通訊協(xié)定 |
| 20 | SERCOS III | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-sercosiii.c | 實時以太網(wǎng)通訊協(xié)定 |
| 21 | RTPS | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-rtps.c | 實時流傳輸協(xié)議 |
| 22 | TTEthernet | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-tte.c | 實時以太網(wǎng)通訊協(xié)定 |
| 23 | CDT | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-cdt.c | 遠(yuǎn)動規(guī)約 |
| 24 | EtherNet/IP | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-etherip.c | 工業(yè)通訊協(xié)定（Industrial Protocol），是一種CIP的實現(xiàn)方式，由羅克韋爾自動化公司所設(shè)計 |
| 25 | CIP | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-cip.c | 通用工業(yè)協(xié)定 |
| 26 | CIP Safety | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-cipsafety.c | 安全通用工業(yè)協(xié)定 |
| 27 | DeviceNet | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-devicenet.c | 一種CIP的實現(xiàn)方式，由Allen-Bradley公司所設(shè)計 |
| 28 | BACnet | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-bacnet.c | 樓宇自動控制網(wǎng)絡(luò)數(shù)據(jù)通訊協(xié)議 |
| 29 | KNXnet/IP | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-knxnetip.c | 住宅和樓宇控制標(biāo)準(zhǔn) |
| 30 | Lontalk | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-lon.c | 埃施朗公司的LonWorks技術(shù)所使用的通訊協(xié)議 |
| 31 | CANopen | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-canopen.c | 控制局域網(wǎng)通訊協(xié)定 |
| 32 | SAE J1939 | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-j1939.c | 一種CAN的變種，適用在農(nóng)業(yè)車輛及商用車輛 |
| 33 | USITT DMX512-A | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-dmx.c | 燈光控制數(shù)據(jù)傳輸協(xié)議 |
| 34 | BSSAP/BSAP | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-bssap.c | 由Bristol Babcock Inc發(fā)展的通訊協(xié)定 |
| 35 | Gryphon | https://github.com/wireshark/wireshark/tree/master/plugins/gryphon | 車用通訊協(xié)定 |
| 36 | ZigBee | https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-zbee.h | 開放式的無線通訊協(xié)定 |
