Using OpcCmd Utility as OPC UA PubSub Sniffer

This article assumes that you have basic knowledge of the OPC UA PubSub Sniffing concepts; please read the corresponding article first.

Accessing the OPC UA PubSub Sniffer

In the OpcCmd utility, the OPC UA PubSub Sniffer is accessible as a service under the uaSubscriber command. For interactive usage, you can access it as follows:

uaSubscriber getService uaPubSubSniffer

(shortened: uas gs uapss). You can also use the above command text as a prefix, and append the desired uaPubSubSniffer command at the end, for a "one-shot" execution of the OPC UA PubSub Sniffer.

uaPubSubSniffer subscribeCapture command

The subscribeCapture command (shortened: sc) subscribes to traffic captures and displays them. Its arguments, and vast majority of its options, are identical with the uaSubscriber subscribeDataSet command, so we are not going to repeat them here.

Limiting the capture types

If you are not interested in all messages that appear on the specified PubSub connection, but only in some message types, use the --CaptureTypes (shortened: -ct) command option. With it, you can specify the capture type either as an individual capture type, a specific combination of them, or a predefined capture type grouping.

Selecting distinct headers

If you are not interested in every message, but only in knowing what kinds of messages appear on the network (PubSub connection), use the --DistinctHeadersOnly option (shortened: -dho). With this option, the capture header of every new incoming capture notification is compared with the already recorder headers, and the notification is displayed only if the capture header has not been encountered before.

Capturing message data

In order to display the data captured with each transport message, use the --ShowCaptureData option (shortened: -scd). More information: Data capture with sniffing.

Binary data (UADP) are shown in hexadecimal format, textual data (JSON) are decoded first, and shown as strings.

Typical usage scenarios

Show all communication

(TBD)

Show all communication with UDP transport mapping:

subscribeCapture opc.udp://239.0.0.1:4840

Show all communication with MQTT transport mapping:

subscribeCapture mqtt://opcua-pubsub.demo-this.com #

(TBD)

Discover who communicates what

(TBD)

Discover who communicates what with UDP transport mapping:

subscribeCapture opc.udp://239.0.0.1:4840 --CaptureTypes AllPubSubMessages --DistinctHeadersOnly !wait Infinite

Discover who communicates what with MQTT transport mapping:

subscribeCapture mqtt://opcua-pubsub.demo-this.com # --CaptureTypes AllPubSubMessages --DistinctHeadersOnly !wait Infinite

(TBD)

Capture and show message data

In order to view the original messages as they are being communicated on the specified PubSub connection, use the --ShowCaptureData option. In our example, we are not interested in further analysis of the received messages, and we therefore limit the capture to the TransportMessage type, by using the --CaptureTypes option. By removing this option, you can view the captured data together with their analysis as OPC UA PubSub messages.

Capture and show message data with UDP transport mapping:

subscribeCapture opc.udp://239.0.0.1:4840 --CaptureTypes TransportMessage --ShowCaptureData

Capture and show message data with MQTT transport mapping:

subscribeCapture mqtt://opcua-pubsub.demo-this.com # --CaptureTypes TransportMessage --ShowCaptureData

Example output:

Executing for 00:01:00 (press 'X' to stop)...
Subscribing capture...
[0] IUAPubSubSniffer.Capture: None
Capture handle: 13000001
[1] IUAPubSubSniffer.Capture: TransportMessage; origin=opcuademo/uadp/none, mapping=Uadp
Byte[]: D1 0C 02 00 00 00 33 32 94 97 E7 EA F7 1A 96 4F 84 01 40 96 CD 1D 89 08 01 01 00 01 04 00 01 00 06 66 1F 00 00 06 E7 06 00 00 0D C0 FF 94 44 96 B0 D8 01
...

See also

OPC UA PubSub Sniffing concepts

Using OpcCmd Utility as OPC UA PubSub Subscriber