in case if someone can help dump from wireshark
Frame 261: 112 bytes on wire (896 bits), 112 bytes captured (896 bits) on interface \Device\NPF_{165D06FF-C4E7-4291-A605-668718CC24C6}, id 0
Interface id: 0 (\Device\NPF_{165D06FF-C4E7-4291-A605-668718CC24C6})
Interface name: \Device\NPF_{165D06FF-C4E7-4291-A605-668718CC24C6}
Interface description: LOCAL
Encapsulation type: Ethernet (1)
Arrival Time: Aug 23, 2020 17:31:34.371012000 Тихоокеанское время США (лето)
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1598229094.371012000 seconds
[Time delta from previous captured frame: 0.000481000 seconds]
[Time delta from previous displayed frame: 0.000481000 seconds]
[Time since reference or first frame: 13.539428000 seconds]
Frame Number: 261
Frame Length: 112 bytes (896 bits)
Capture Length: 112 bytes (896 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:tcp:enip:cip:cipcm]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: ASUSTekC_48:10:25 (74:d0:2b:48:10:25), Dst: Micro-St_21:fc:53 (30:9c:23:21:fc:53)
Destination: Micro-St_21:fc:53 (30:9c:23:21:fc:53)
Address: Micro-St_21:fc:53 (30:9c:23:21:fc:53)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: ASUSTekC_48:10:25 (74:d0:2b:48:10:25)
Address: ASUSTekC_48:10:25 (74:d0:2b:48:10:25)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.1.155, Dst: 192.168.1.3
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 98
Identification: 0x018c (396)
Flags: 0x0000
0... .... .... .... = Reserved bit: Not set
.0.. .... .... .... = Don't fragment: Not set
..0. .... .... .... = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: TCP (6)
Header checksum: 0x361b [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.1.155
Destination: 192.168.1.3
Transmission Control Protocol, Src Port: 44818, Dst Port: 3922, Seq: 1, Ack: 91, Len: 58
Source Port: 44818
Destination Port: 3922
[Stream index: 14]
[TCP Segment Len: 58]
Sequence number: 1 (relative sequence number)
Sequence number (raw): 10351
[Next sequence number: 59 (relative sequence number)]
Acknowledgment number: 91 (relative ack number)
Acknowledgment number (raw): 1629615151
0101 .... = Header Length: 20 bytes (5)
Flags: 0x018 (PSH, ACK)
000. .... .... = Reserved: Not set
...0 .... .... = Nonce: Not set
.... 0... .... = Congestion Window Reduced (CWR): Not set
.... .0.. .... = ECN-Echo: Not set
.... ..0. .... = Urgent: Not set
.... ...1 .... = Acknowledgment: Set
.... .... 1... = Push: Set
.... .... .0.. = Reset: Not set
.... .... ..0. = Syn: Not set
.... .... ...0 = Fin: Not set
[TCP Flags: ·······AP···]
Window size value: 2326
[Calculated window size: 2326]
[Window size scaling factor: -1 (unknown)]
Checksum: 0x876d [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 260]
[The RTT to ACK the segment was: 0.000481000 seconds]
[Bytes in flight: 58]
[Bytes sent since last PSH flag: 58]
[Timestamps]
[Time since first frame in this TCP stream: 0.000481000 seconds]
[Time since previous frame in this TCP stream: 0.000481000 seconds]
TCP payload (58 bytes)
[PDU Size: 58]
EtherNet/IP (Industrial Protocol), Session: 0x00000001, Send RR Data
Encapsulation Header
Command: Send RR Data (0x006f)
Length: 34
Session Handle: 0x00000001
Status: Success (0x00000000)
Sender Context: 0000000000000000
Options: 0x00000000
Command Specific Data
Interface Handle: CIP (0x00000000)
Timeout: 0
Item Count: 2
Type ID: Null Address Item (0x0000)
Length: 0
Type ID: Unconnected Data Item (0x00b2)
Length: 18
[Request In: 260]
[Time: 0.000481000 seconds]
Common Industrial Protocol
Service: Unknown Service (0x54) (Response)
1... .... = Request/Response: Response (0x1)
.101 0100 = Service: Unknown (0x54)
Status: Connection failure:
General Status: Connection failure (0x01)
Additional Status Size: 2 words
Additional Status
Additional Status: 0x0127
Additional Status: 0x0022
[Request Path Size: 2 words]
[Request Path: Connection Manager, Instance: 0x01]
[Path Segment: 0x20 (8-Bit Class Segment)]
[001. .... = Path Segment Type: Logical Segment (1)]
[...0 00.. = Logical Segment Type: Class ID (0)]
[.... ..00 = Logical Segment Format: 8-bit Logical Segment (0)]
[Class: Connection Manager (0x06)]
[Path Segment: 0x24 (8-Bit Instance Segment)]
[001. .... = Path Segment Type: Logical Segment (1)]
[...0 01.. = Logical Segment Type: Instance ID (1)]
[.... ..00 = Logical Segment Format: 8-bit Logical Segment (0)]
[Instance: 0x01]
CIP Connection Manager
Service: Forward Open (Response)
1... .... = Request/Response: Response (0x1)
.101 0100 = Service: Forward Open (0x54)
Status: Connection failure, Extended: Invalid O->T size
General Status: Connection failure (0x01)
Additional Status Size: 2 words
Extended Status: Invalid O->T size (0x0127)
Maximum Size: 34
Command Specific Data
Connection Serial Number: 0x7f52
Originator Vendor ID: Unknown (0xfada)
Originator Serial Number: 0x8badf00d
Remaining Path Size: 0 words
Reserved: 0x00