Wireshark OPC UA dissector

What you actually use it for

• Deciding whether a request ever left the client, which no client-side log can tell you reliably.
• Reading the Hello and acknowledge exchange to see the negotiated message sizes and chunk counts before blaming the application.
• Watching GetEndpoints and the returned endpoint URLs, which is the fastest way to catch a server advertising a hostname nobody can resolve.
• Seeing the actual error response when a client library reports a generic failure.
• Confirming reverse-connect behaviour: whether the ReverseHello arrived, and what the client did next.
• Measuring real publish cadence against the interval you think you configured.

Walkthrough

1. Capture on the right interface, at the right endCapture where the traffic actually passes. If the client is in a container, capture in its network namespace or on the host bridge, not on an unrelated interface. Getting this wrong produces an empty capture and a wrong conclusion.
2. Apply the opcua display filterType opcua in the display filter. The dissector is built in, so there is nothing to install. If nothing matches, check whether the traffic is on a non-standard port and use Decode As to map that port to OPC UA.
3. Read the connection handshake firstFind the Hello and acknowledge messages and note the negotiated buffer sizes and chunk limits. A large-message failure often shows up here as a limit far lower than the application expects.
4. Follow the secure channel and session establishmentWatch OpenSecureChannel, then CreateSession and ActivateSession. Where a connection fails, the last successful step tells you which layer to investigate: transport, channel, session or authentication.
5. Accept that encrypted payloads are opaque, and plan for itOn a signed and encrypted channel you see message framing but not content. Either reproduce the fault on an unsecured endpoint in a lab, or use tooling that dumps session keys and decodes the capture with them. The reference stack's diagnostics tooling exists for exactly this.
6. Capture to a file and analyse afterwardsUse a ring buffer with a size limit on a gateway so you can leave a capture running until an intermittent fault recurs, then analyse the file offline rather than watching a live window.
7. Check the capture is legal and authorised firstPacket capture on an operational network usually needs authorisation, and captures can contain credentials and process data. Get permission and agree retention before you start, not after.

What it will not do

• Encrypted traffic is unreadable without dumped keys, and most production channels are encrypted.
• It shows you the wire, not intent. It cannot tell you why an application chose a parameter, only what it sent.
• PubSub over UDP or Ethernet needs the right capture point and privileges, and multicast may not reach your capture host at all.
• Captures on a busy link are large, and analysis time grows faster than the file does.
• Capture requires elevated privileges and, on plant networks, authorisation you may not have.

Alternatives

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.