<![CDATA[Capturing IEC 60870-5-101 traffic with serial tap]]>I'm trying out my newly purchased serial tap. It works fine and it captures the traffic in a serial line. But the protocol IEC 60870-5-101 is not supported by the IO Ninja software so I can only see Hex information.

So I thought of two ways to translate this protocol

  1. I have a software that can translate this protocol but it can only listen to com ports. Is there a way to get the serial tap to act like a com port in windows?

  2. Wireshark can translate this protocol as well. Is there a way to listen to a serial tap in Wireshark? I saw that it was possible to do that with the ethernet tap using pipes.

]]>http://64.23.185.212/forum/topic/88/capturing-iec-60870-5-101-traffic-with-serial-tapRSS for NodeWed, 13 May 2026 15:28:38 GMTThu, 16 Mar 2023 18:12:01 GMT60<![CDATA[Reply to Capturing IEC 60870-5-101 traffic with serial tap on Sun, 19 Mar 2023 12:41:08 GMT]]>If this is a half-duplex link, you can utilize a regular 3rd-party USB-to-Serial adapter from this application of yours that you say can decode 60870-5-101.

It's also theoretically possible to post-process an .njlog captured with a Serial Tap and convert it into a .pcap for further analysis in Wireshark. However, it looks like Wireshark can only decode IEC-60870-5-103:

46768dab-7f64-4da7-9f52-cce87ef2f6f6-image.png

]]>http://64.23.185.212/forum/post/304http://64.23.185.212/forum/post/304Sun, 19 Mar 2023 12:41:08 GMT<![CDATA[Reply to Capturing IEC 60870-5-101 traffic with serial tap on Fri, 17 Mar 2023 14:45:06 GMT]]>@vladimir

Half duplex.

More information about the protocol:
https://en.wikipedia.org/wiki/IEC_60870-5
https://www.ensotest.com/iec-60870-5-104/introduction-to-the-iec-60870-5-104-standard/

d1d5d207-e243-424c-ad66-10c39b16f570-image.png

]]>http://64.23.185.212/forum/post/301http://64.23.185.212/forum/post/301Fri, 17 Mar 2023 14:45:06 GMT<![CDATA[Reply to Capturing IEC 60870-5-101 traffic with serial tap on Fri, 17 Mar 2023 10:55:38 GMT]]>Which is the underlying link you are sniffing with your Serial Tap? Is it half-duplex or full-duplex?

]]>http://64.23.185.212/forum/post/298http://64.23.185.212/forum/post/298Fri, 17 Mar 2023 10:55:38 GMT