Error with Reading DB Parameter on S7 1511C PLC

[gaurav041089]

Hello,
I would like to thank you for all the work behind this repository.

Using the following code I was able to connect to S7 1214 PLC with ver 4.7. PUT/GET disabled and DB non-optimized. I was also able to read the parameter CountsTest in loop.

#1214 PLC- 214-1AG40-0XB0 H/W Ver 4.7.1 TIA Portal Ver 18 -- Filename: CleanDownload

DB is Non-optimized and PUT/GET is disabled

import struct
import time
from s7commplus import Client

PLC_IP = "192.168.1.1"
DB_NUMBER = 1 # Target Data Block
POLL_INTERVAL = 3 # Seconds between reads

def read_counts_test():
client = Client()

try:
    print(f"Connecting to S7-1200 at {PLC_IP} via S7CommPlus...")
    client.connect(PLC_IP, use_tls=True)
    print("Connected!\n")
    
    # 1. Fetch browse metadata (Done once before polling)
    items = client.browse()
    if not items:
        print("No browse items found.")
        return

    item = items[0]
    acc_seq = item.get('access_sequence', '')
    tag_name = item.get('name', 'CountsTest')
    
    # 2. Extract Variable LID
    parts = acc_seq.split('.')
    var_lid = int(parts[1], 16) if len(parts) > 1 else int(parts[0], 16)
    
    # 3. Compute Access Area
    access_area = 0x8A0E0000 + DB_NUMBER
    
    print(f"Tag Name:        {tag_name}")
    print(f"Access Sequence: {acc_seq}")
    print(f"Access Area:     0x{access_area:08X} ({access_area})")
    print(f"Variable LID:    {var_lid} (0x{var_lid:X})")
    print("-" * 42)
    print("Starting continuous polling (Press Ctrl+C to stop)...\n")

    # 4. Continuous Read Loop
    while True:
        raw_val = client.read_symbolic(access_area, [var_lid])
        
        if len(raw_val) >= 4:
            dint_value = struct.unpack(">i", raw_val[-4:])[0]
            timestamp = time.strftime("%H:%M:%S")
            print(f"[{timestamp}] LIVE DINT VALUE ({tag_name}): {dint_value}")
        else:
            print(f"Received incomplete data (Length: {len(raw_val)})")

        time.sleep(POLL_INTERVAL)
        
except KeyboardInterrupt:
    print("\nPolling stopped by user.")
except Exception as e:
    print(f"\nCommunication Error: {e}")
finally:
    client.disconnect()
    print("Disconnected.")

if name == "main":
read_counts_test()

However, when I use similar script to connect to S7 1511C PLC ver 2.1.0 to read a parameter it is throwing me error on connection itself. Same settings on this PLC. PUT/GET is disabled and DB is non-optimized. Error shown below.
=================================================================================== RESTART: C:/Users/Gaurav S Mithari/Desktop/===================================================================================
Testing S7 connection to 10.0.1.101...
Connection Error: Connection closed by peer
Connection closed.

The wireshark dump between TIA portal and 1511PLC shows no TLS communication. Only shows S7commplus, TCP and COTP.

Could you please help me on this.

[gijzelaerr]

Thanks for the working S7-1214 example and the S7-1511C report. The working example explicitly uses TLS. We need to locate where the older CPU closes the connection before attributing it to DB settings or permissions.

Could you provide:

• the exact script used for the failing S7-1511C attempt, particularly the connect arguments;
• your python-snap7 version or Git commit and Python version;
• the complete traceback and debug log from one connection attempt (logging.basicConfig(level=logging.DEBUG) before creating the client);
• the CPU order code, firmware version, and current access/protection settings from TIA.

For a controlled comparison, try a fresh client with client.connect(PLC_IP, use_tls=False) and capture its log separately from the TLS attempt. Install the S7CommPlus dependency extra in the same environment (python -m pip install -e '.[s7commplus]' for a source checkout). This is a diagnostic comparison, not a claim that plaintext will resolve it; another S7-1500 currently resets during SetupSession, tracked in gijzelaerr/python-snap7#710 and discussed in gijzelaerr/python-snap7#861.

There is also a separate addressing correction in the polling example: preserve the whole browse path with path = [int(part, 16) for part in item['access_sequence'].split('.')] and read with client.read_symbolic(path[0], path[1:]). Select the intended item by name rather than taking items[0]. That avoids mixing a hardcoded DB with another symbol's LID, although it does not explain a failure during connect itself.

[gaurav041089]

Using the following script I am able to connect to 1511 PLC.
import snap7

1. Initialize the classic snap7 client

client = snap7.client.Client()

2. Set connection type to OP/HMI before connecting.

This masquerades your script as an HMI, bypassing the PUT/GET restriction.

(1 = PG / Programming Device, 2 = OP / Operator Panel/HMI)

client.set_connection_type(2)

3. Define target parameters for your S7-1511

PLC_IP = "10.0.1.102"
RACK = 0
SLOT = 1

try:
print(f"Attempting HMI-masqueraded connection to S7-1511 at {PLC_IP}...")

# Establish connection using the correct Rack and Slot
client.connect(PLC_IP, RACK, SLOT)

# Verify using the proper library function
if client.get_connected():
    print("Success! Bypassed PUT/GET restrictions and connected to the PLC.")
else:
    print("Failed to connect to the PLC.")

except Exception as e:
print(f"An error occurred during connection: {e}")

finally:
# 4. Clean up connection pooling safely
if client.get_connected():
client.disconnect()
print("Connection closed cleanly.")

When I use the following script to read parameter at DB116 Offet 708, it gives me S7 protocol error (class=0x81, code=0x04).
import snap7

PLC_IP = "10.0.1.102"
client = snap7.client.Client()
client.set_connection_type(1) # PG Mode

try:
client.connect(PLC_IP, 0, 1)
if client.get_connected():
# Test read 4 bytes from MB0 (Flags / Merker area)
m_data = client.mb_read(0, 4)
print(f"SUCCESS: Read Merker Area MB0-MB3: {list(m_data)}")

    # Now try DB116
    db_data = client.db_read(116, 708, 4)
    print(f"SUCCESS: Read DB116 Offset 708: {list(db_data)}")

except Exception as e:
print(f"Read failed: {e}")
finally:
if client.get_connected():
client.disconnect()

[gaurav041089]

This is the code I used with s7commplus.
from s7commplus import Client

Generic PLC configuration

PLC_IP = "10.0.1.102" # Replace with your PLC IP address

def connect_s71500():
client = Client()

try:
    print(f"Initiating S7commPlus connection to {PLC_IP}...")

    # Establish connection. Enable TLS if required by PLC security configuration.
    client.connect(PLC_IP,rack=0, slot=1)
    print("Connection successfully established!")

    # Verify session by querying basic object metadata
    items = client.browse()
    print(f"Discovered {len(items)} symbolic items in PLC scope.")

except Exception as e:
    print(f"Failed to establish connection: {e}")

finally:
    client.disconnect()
    print("Session closed.")

if name == "main":
connect_s71500()

Error:
======= RESTART: C:/Users/Gaurav S Mithari/Desktop
Initiating S7commPlus connection to 10.0.1.102...
Failed to establish connection: Send failed: [WinError 10054] An existing connection was forcibly closed by the remote host
Session closed.

[gaurav041089]

This is the code I used with s7commplus.
from s7commplus import Client

Generic PLC configuration

PLC_IP = "10.0.1.102" # Replace with your PLC IP address

def connect_s71500():
client = Client()

try:
    print(f"Initiating S7commPlus connection to {PLC_IP}...")

    # Establish connection. Enable TLS if required by PLC security configuration.
    client.connect(PLC_IP,rack=0, slot=1)
    print("Connection successfully established!")

    # Verify session by querying basic object metadata
    items = client.browse()
    print(f"Discovered {len(items)} symbolic items in PLC scope.")

except Exception as e:
    print(f"Failed to establish connection: {e}")

finally:
    client.disconnect()
    print("Session closed.")

if name == "main":
connect_s71500()

Error:
======= RESTART: C:/Users/Gaurav S Mithari/Desktop
Initiating S7commPlus connection to 10.0.1.102...
Failed to establish connection: Send failed: [WinError 10054] An existing connection was forcibly closed by the remote host
Session closed.

[gaurav041089]

Wireshark dump between tia portal v13 and 1511C PLC. Fw ver 2.1.0
PUT/GET is disabled and DB is non-optimized.

s7-1500.zip

[gijzelaerr]

Thanks — I inspected the attached TIA capture. It contains two S7CommPlus connections with the same initial sequence:

Exchange	First connection frames	TPKT bytes
V1 CreateObject request / reply	73 / 75	241 / 218
V2 SetMultiVariables (SetupSession) request / reply	80 / 83	418 / 32
Subsequent traffic	from 94 onward	V3 framing with a digest prefix

Both initial reply return values decode to zero. There is no InitSSL exchange before CreateObject in these captured TIA connections, and the handshake is plaintext. This demonstrates a working S7CommPlus handshake on this CPU/configuration.

Your newly posted Python script already uses plaintext: omitting use_tls leaves it False. So the TLS-toggle comparison is no longer the next useful test. A concrete difference is that our current connection path sends InitSSL before CreateObject even in plaintext mode. We need to establish whether the Python connection is reset there or later, before changing negotiation behavior.

Please capture one failing Python connection to the same unchanged CPU and include the exact installed commit/version and full traceback. In the script, add import logging and logging.basicConfig(level=logging.DEBUG) before creating the client, and replace the exception print with logging.exception('S7CommPlus connection failed'). This will preserve the failure location; the pcap will show the last accepted exchange. Confirm that the S7CommPlus extra is installed in that same Python environment.

On the classic-client tests: a successful connect()/get_connected() does not prove that PUT/GET data reads are permitted, so the first script does not demonstrate bypassing that restriction. The second script also switches from connection type 2 to type 1, and tries mb_read() before db_read(); if the Merker read raises, the DB116 read is never reached. Those results cannot yet establish a DB-offset-specific problem. The supplied TIA capture gives us a better basis for the S7CommPlus investigation.

[gaurav041089]

I used the following code as suggested.
from s7commplus import Client
import logging

Generic PLC configuration

PLC_IP = "10.0.1.102" # Replace with your PLC IP address

def connect_s71500():
logging.basicConfig(level=logging.DEBUG)
client = Client()

try:
    print(f"Initiating S7commPlus connection to {PLC_IP}...")

    # Establish connection. Enable TLS if required by PLC security configuration.
    client.connect(PLC_IP,rack=0, slot=1)
    print("Connection successfully established!")

    # Verify session by querying basic object metadata
    items = client.browse()
    print(f"Discovered {len(items)} symbolic items in PLC scope.")

except Exception as e:
    logging.exception('S7commplus connection failed')
    #print(f"Failed to establish connection: {e}")

finally:
    client.disconnect()
    print("Session closed.")

if name == "main":
connect_s71500()

This is the IDLE Output
Initiating S7commPlus connection to 10.0.1.102...
DEBUG:snap7.connection:TCP connected to 10.0.1.102:102
DEBUG:snap7.connection:Sent COTP Connection Request
DEBUG:snap7.connection:Negotiated PDU size: 1024
DEBUG:snap7.connection:Unsupported COTP parameter: code=0xc1, length=2
DEBUG:snap7.connection:Unsupported COTP parameter: code=0xc2, length=16
DEBUG:snap7.connection:Received COTP Connection Confirm
INFO:snap7.connection:Connected to 10.0.1.102:102, PDU size: 1024
DEBUG:s7commplus.connection:=== InitSSL === sending (26 bytes): 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Sent 33 bytes: 03 00 00 21 02 f0 80 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=38 payload (34 bytes): 02 f0 80 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== InitSSL === received (31 bytes): 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:InitSSL response: version=V1, data_length=23
DEBUG:s7commplus.connection:InitSSL response body (27 bytes): 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== CreateObject === sending (192 bytes): 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Sent 199 bytes: 03 00 00 c7 02 f0 80 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=218 payload (214 bytes): 02 f0 80 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 ab 71 f1 1a 09 2d 5c e3 5e 50 fc e0 b3 ab 86 e1 2c ba 40 16 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== CreateObject === received (211 bytes): 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 ab 71 f1 1a 09 2d 5c e3 5e 50 fc e0 b3 ab 86 e1 2c ba 40 16 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:CreateObject response: version=V1, data_length=203
DEBUG:s7commplus.connection:CreateObject response body (207 bytes): 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 ab 71 f1 1a 09 2d 5c e3 5e 50 fc e0 b3 ab 86 e1 2c ba 40 16 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:CreateObject response header: opcode=0x32 function=0x04CA seq=1 transport=0x36
DEBUG:s7commplus.connection:CreateObject response: return_value=0 object_ids=['0x3b3', '0x3b5']
DEBUG:s7commplus.connection:Session created: id=0x000003B3 (947), version=V1
INFO:s7commplus.connection:ServerSessionVersion captured (87 bytes)
INFO:s7commplus.connection:Public key fingerprint captured: 00:181B7B0847D11694
INFO:s7commplus.connection:Session challenge captured (20 bytes): ab71f11a092d5ce35e50fce0b3ab86e12cba4016
INFO:s7commplus.connection:SessionKey auth blob generated (180 bytes)
INFO:s7commplus.connection:SecurityKey blob included in session setup, IntegrityId tracking enabled
DEBUG:s7commplus.connection:=== SetupSession === sending (395 bytes): 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 d1 85 cc 83 ac b4 93 d1 42 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 72 55 76 c3 e9 a9 d5 5a 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 cb a4 71 1f 1f d5 11 ce b2 0b a4 f1 9d e9 62 59 2b 02 bd 77 49 d6 27 de a8 33 c0 54 ee e3 e0 e6 5c 51 f7 16 4d 77 29 13 60 bf 88 ee 99 b9 6c 33 3f 62 25 ff c1 a3 c7 d1 bb 96 2d 68 4d 00 2f 24 c9 cd d9 16 ef 3a b9 fb e3 d1 b5 f3 7d a3 26 0a b7 5c c0 bc c1 dc 27 3d 71 fd ca db bd 3e 9f a5 68 04 22 b1 88 ad 43 cb 38 45 50 c4 01 49 34 97 e3 2c 79 3f a5 16 12 eb 83 f4 86 be 2a b7 2c 48 cb 21 c8 bc 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
DEBUG:snap7.connection:Sent 402 bytes: 03 00 01 92 02 f0 80 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 d1 85 cc 83 ac b4 93 d1 42 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 72 55 76 c3 e9 a9 d5 5a 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 cb a4 71 1f 1f d5 11 ce b2 0b a4 f1 9d e9 62 59 2b 02 bd 77 49 d6 27 de a8 33 c0 54 ee e3 e0 e6 5c 51 f7 16 4d 77 29 13 60 bf 88 ee 99 b9 6c 33 3f 62 25 ff c1 a3 c7 d1 bb 96 2d 68 4d 00 2f 24 c9 cd d9 16 ef 3a b9 fb e3 d1 b5 f3 7d a3 26 0a b7 5c c0 bc c1 dc 27 3d 71 fd ca db bd 3e 9f a5 68 04 22 b1 88 ad 43 cb 38 45 50 c4 01 49 34 97 e3 2c 79 3f a5 16 12 eb 83 f4 86 be 2a b7 2c 48 cb 21 c8 bc 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=32 payload (28 bytes): 02 f0 80 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
DEBUG:s7commplus.connection:=== SetupSession === received (25 bytes): 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
DEBUG:s7commplus.connection:SetupSession response: function=0x0542
INFO:s7commplus.connection:Session setup completed successfully
DEBUG:s7commplus.connection:Session activation: SET_VARIABLE addr 323 = USINT(5)
DEBUG:s7commplus.connection: IntegrityId: write=0
DEBUG:s7commplus.connection:=== SEND REQUEST === function_code=0x04F2 seq=3 session=0x000003B3
DEBUG:s7commplus.connection: Request header (14 bytes): 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34
DEBUG:s7commplus.connection: IntegrityId (1 bytes): 00
DEBUG:s7commplus.connection: Request payload (38 bytes): 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00
DEBUG:s7commplus.connection: Full frame (94 bytes): 72 03 00 56 20 cc a1 9d aa ab d4 82 52 8e e5 b8 05 db c1 67 38 9d b5 1d f4 f3 0a 6b 91 4b f0 bb 93 1b d2 ad 97 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 cc a1 9d aa ab d4 82 52 8e e5 b8 05 db c1 67 38 9d b5 1d f4 f3 0a 6b 91 4b f0 bb 93 1b d2 ad 97 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=64 payload (60 bytes): 02 f0 80 72 03 00 31 20 fe 2a 81 0c bb 71 20 70 0d 9e 92 f9 e8 96 a8 77 55 99 2a 0c e1 de 1a bc ee ec a6 ea 07 c7 12 5f 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection:=== RECV RESPONSE === raw frame (57 bytes): 72 03 00 31 20 fe 2a 81 0c bb 71 20 70 0d 9e 92 f9 e8 96 a8 77 55 99 2a 0c e1 de 1a bc ee ec a6 ea 07 c7 12 5f 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection: Frame header: version=V3, data_length=49, header_size=4
DEBUG:s7commplus.connection: V3 HMAC verified
DEBUG:s7commplus.connection: Response data (16 bytes): 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00
DEBUG:s7commplus.connection: Response header: opcode=0x32 function=0x04F2 seq=3 transport=0x34
DEBUG:s7commplus.connection: Response IntegrityId: 0 (1 bytes)
DEBUG:s7commplus.connection: Response payload (5 bytes): 06 00 00 00 00
DEBUG:s7commplus.connection: Trailer (4 bytes): 72 03 00 00
INFO:s7commplus.connection:Session activation completed
DEBUG:s7commplus.connection:Post-auth legitimation: reading challenge from address 303
DEBUG:s7commplus.connection: IntegrityId: read=0
DEBUG:s7commplus.connection:=== SEND REQUEST === function_code=0x0586 seq=4 session=0x000003B3
DEBUG:s7commplus.connection: Request header (14 bytes): 31 00 00 05 86 00 00 00 04 00 00 03 b3 34
DEBUG:s7commplus.connection: IntegrityId (1 bytes): 00
DEBUG:s7commplus.connection: Request payload (40 bytes): 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 04 00 01 00 00 00 00
DEBUG:s7commplus.connection: Full frame (96 bytes): 72 03 00 58 20 95 7b d1 c0 da eb 74 75 10 78 d8 8d 6a 1c 1c fa 0e fc cc aa 08 74 2d 08 fb a8 51 3a 4a 07 3d 43 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 04 00 01 00 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Sent 103 bytes: 03 00 00 67 02 f0 80 72 03 00 58 20 95 7b d1 c0 da eb 74 75 10 78 d8 8d 6a 1c 1c fa 0e fc cc aa 08 74 2d 08 fb a8 51 3a 4a 07 3d 43 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 04 00 01 00 00 00 00 00 72 03 00 00
INFO:snap7.connection:Disconnected from 10.0.1.102:102
ERROR:root:S7commplus connection failed
Traceback (most recent call last):
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\snap7\connection.py", line 466, in _recv_exact
chunk = self.socket.recv(size - len(data))
ConnectionResetError: [WinError 10054] An existing connection was forcibly closed by the remote host

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "C:/Users/Gaurav S Mithari/Desktop/Finolex/ASM/Test25.py", line 17, in connect_s71500
client.connect(PLC_IP,rack=0, slot=1)
~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\client.py", line 145, in connect
self._open_connection()
~~~~~~~~~~~~~~~~~~~~~^^
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\client.py", line 153, in _open_connection
self._connection.connect(
~~~~~~~~~~~~~~~~~~~~~~~~^
use_tls=p["use_tls"],
^^^^^^^^^^^^^^^^^^^^^
...<3 lines>...
password=p["password"] or "",
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 527, in connect
self._post_auth_legitimation(password=self._connect_password)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 1450, in _post_auth_legitimation
challenge_resp = self.send_request(
FunctionCode.GET_VAR_SUBSTREAMED,
self._build_get_var_substreamed(self._session_id, LegitimationId.SERVER_SESSION_REQUEST),
integrity_tail=4,
)
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 877, in send_request
response_frame = self._recv_s7_data()
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 1639, in _recv_s7_data
return self._iso_conn.receive_data()
~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\snap7\connection.py", line 204, in receive_data
tpkt_header = self._recv_exact(4)
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\snap7\connection.py", line 476, in _recv_exact
raise S7ConnectionError(f"Receive error: {e}")
snap7.error.S7ConnectionError: Receive error: [WinError 10054] An existing connection was forcibly closed by the remote host
Session closed.

Wireshark dump for this session.

1511CDump.zip

[gijzelaerr]

I inspected the Python capture. SetupSession receives a successful response at frame 41; the activation response is frame 46. The GetVarSubStreamed challenge request at frames 49/50 is followed by a system-event frame (51) and then the PLC reset (52).

There is a concrete request-layout difference: Python sends 103 bytes including TPKT/COTP, while TIA's accepted GetVarSubStreamed request at frame 94 of your earlier capture is 101 bytes. Our legacy path encoded a sequence-valued fixed-width qualifier and then appended a separate two-byte field. The accepted TIA layout uses the zero-valued qualifier and request field represented by the reference driver. A regression now checks the generated application bytes against that captured request and verifies the generated HMAC with a synthetic key.

The candidate correction is included in gijzelaerr/python-snap7#861. It also stops a failed challenge read from silently reusing the earlier CreateObject challenge. This establishes a wire-format defect, but does not yet establish that the complete session will succeed on your PLC.

Please retest the updated PR branch on the same unchanged CPU and attach the full debug traceback and a capture of that Python connection. Please include the installed commit and whether connect(), browse(), and the intended read each succeed. We still need this hardware result before calling the report resolved.

[gaurav041089]

T1_091126.zipPython 3.14.7 (tags/v3.14.7:823f032, Aug 5 2026, 10:51:32) [MSC v.1944 64 bit (AMD64)] on win32
Enter "help" below or click "Help" above for more information.

====== RESTART: C:/Users/Gaurav S Mithari/Desktop/Finolex/ASM/DebugTest.py =====
Initiating S7commPlus connection to 10.0.1.102...
DEBUG:snap7.connection:TCP connected to 10.0.1.102:102
DEBUG:snap7.connection:Sent COTP Connection Request
DEBUG:snap7.connection:Negotiated PDU size: 1024
DEBUG:snap7.connection:Unsupported COTP parameter: code=0xc1, length=2
DEBUG:snap7.connection:Unsupported COTP parameter: code=0xc2, length=16
DEBUG:snap7.connection:Received COTP Connection Confirm
INFO:snap7.connection:Connected to 10.0.1.102:102, PDU size: 1024
DEBUG:s7commplus.connection:=== InitSSL === sending (26 bytes): 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Sent 33 bytes: 03 00 00 21 02 f0 80 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=38 payload (34 bytes): 02 f0 80 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== InitSSL === received (31 bytes): 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:InitSSL response: version=V1, data_length=23
DEBUG:s7commplus.connection:InitSSL response body (27 bytes): 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== CreateObject === sending (192 bytes): 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Sent 199 bytes: 03 00 00 c7 02 f0 80 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=218 payload (214 bytes): 02 f0 80 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 5f a2 76 82 28 96 df 3b 41 07 da d6 c1 a2 22 a2 2f 2f 15 f6 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== CreateObject === received (211 bytes): 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 5f a2 76 82 28 96 df 3b 41 07 da d6 c1 a2 22 a2 2f 2f 15 f6 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:CreateObject response: version=V1, data_length=203
DEBUG:s7commplus.connection:CreateObject response body (207 bytes): 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 5f a2 76 82 28 96 df 3b 41 07 da d6 c1 a2 22 a2 2f 2f 15 f6 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:CreateObject response header: opcode=0x32 function=0x04CA seq=1 transport=0x36
DEBUG:s7commplus.connection:CreateObject response: return_value=0 object_ids=['0x3b3', '0x3b5']
DEBUG:s7commplus.connection:Session created: id=0x000003B3 (947), version=V1
INFO:s7commplus.connection:ServerSessionVersion captured (87 bytes)
INFO:s7commplus.connection:Public key fingerprint captured: 00:181B7B0847D11694
INFO:s7commplus.connection:Session challenge captured (20 bytes): 5fa276822896df3b4107dad6c1a222a22f2f15f6
INFO:s7commplus.connection:SessionKey auth blob generated (180 bytes)
INFO:s7commplus.connection:SecurityKey blob included in session setup, IntegrityId tracking enabled
DEBUG:s7commplus.connection:=== SetupSession === sending (395 bytes): 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 e5 c8 b8 9e e5 d7 fa be be 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 6d 55 bc 0f bf 1e 28 ea 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 7e 3f 84 2b 37 25 de 34 bf 72 8c 23 b0 bf 23 0d 6a 21 07 58 1b a3 e1 30 35 dd 13 cc d7 11 d1 eb d8 59 87 97 07 6c 33 32 cc a6 e5 5d b4 59 9d 8b 92 2b 1e 59 27 e9 9d 77 cb d1 b8 ca d7 70 b4 3d 78 36 e4 29 cd 66 2c 0a e1 a3 44 ce 9e 1d 7d 06 18 68 5e c7 55 94 6c 58 fe 58 f8 94 5b ad d8 f5 27 e0 34 05 36 87 5c 74 82 83 59 74 2f 62 7a 98 67 e3 ce 85 26 30 8e af 15 64 24 b9 25 fc 1b 07 93 f4 e3 a5 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
DEBUG:snap7.connection:Sent 402 bytes: 03 00 01 92 02 f0 80 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 e5 c8 b8 9e e5 d7 fa be be 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 6d 55 bc 0f bf 1e 28 ea 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 7e 3f 84 2b 37 25 de 34 bf 72 8c 23 b0 bf 23 0d 6a 21 07 58 1b a3 e1 30 35 dd 13 cc d7 11 d1 eb d8 59 87 97 07 6c 33 32 cc a6 e5 5d b4 59 9d 8b 92 2b 1e 59 27 e9 9d 77 cb d1 b8 ca d7 70 b4 3d 78 36 e4 29 cd 66 2c 0a e1 a3 44 ce 9e 1d 7d 06 18 68 5e c7 55 94 6c 58 fe 58 f8 94 5b ad d8 f5 27 e0 34 05 36 87 5c 74 82 83 59 74 2f 62 7a 98 67 e3 ce 85 26 30 8e af 15 64 24 b9 25 fc 1b 07 93 f4 e3 a5 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=32 payload (28 bytes): 02 f0 80 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
DEBUG:s7commplus.connection:=== SetupSession === received (25 bytes): 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
DEBUG:s7commplus.connection:SetupSession response: function=0x0542
INFO:s7commplus.connection:Session setup completed successfully
DEBUG:s7commplus.connection:Session activation: SET_VARIABLE addr 323 = USINT(5)
DEBUG:s7commplus.connection: IntegrityId: write=0
DEBUG:s7commplus.connection:=== SEND REQUEST === function_code=0x04F2 seq=3 session=0x000003B3
DEBUG:s7commplus.connection: Request header (14 bytes): 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34
DEBUG:s7commplus.connection: IntegrityId (1 bytes): 00
DEBUG:s7commplus.connection: Request payload (38 bytes): 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00
DEBUG:s7commplus.connection: Full frame (94 bytes): 72 03 00 56 20 1b fd 40 30 7c 59 a1 b5 70 b4 0c ca 3d d4 8a a2 41 40 e5 58 ef 80 9b 03 36 a5 39 d8 5d d9 df 56 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 1b fd 40 30 7c 59 a1 b5 70 b4 0c ca 3d d4 8a a2 41 40 e5 58 ef 80 9b 03 36 a5 39 d8 5d d9 df 56 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=64 payload (60 bytes): 02 f0 80 72 03 00 31 20 25 f9 e8 5d c5 a2 ab 08 9a 53 41 47 d8 7a c9 96 18 85 29 a8 e7 56 6f 2c dd 92 ce bd 21 b5 5a ec 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection:=== RECV RESPONSE === raw frame (57 bytes): 72 03 00 31 20 25 f9 e8 5d c5 a2 ab 08 9a 53 41 47 d8 7a c9 96 18 85 29 a8 e7 56 6f 2c dd 92 ce bd 21 b5 5a ec 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection: Frame header: version=V3, data_length=49, header_size=4
DEBUG:s7commplus.connection: V3 HMAC verified
DEBUG:s7commplus.connection: Response data (16 bytes): 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00
DEBUG:s7commplus.connection: Response header: opcode=0x32 function=0x04F2 seq=3 transport=0x34
DEBUG:s7commplus.connection: Response IntegrityId: 0 (1 bytes)
DEBUG:s7commplus.connection: Response payload (5 bytes): 06 00 00 00 00
DEBUG:s7commplus.connection: Trailer (4 bytes): 72 03 00 00
INFO:s7commplus.connection:Session activation completed
DEBUG:s7commplus.connection:Post-auth legitimation: reading challenge from address 303
DEBUG:s7commplus.connection: IntegrityId: read=0
DEBUG:s7commplus.connection:=== SEND REQUEST === function_code=0x0586 seq=4 session=0x000003B3
DEBUG:s7commplus.connection: Request header (14 bytes): 31 00 00 05 86 00 00 00 04 00 00 03 b3 34
DEBUG:s7commplus.connection: IntegrityId (1 bytes): 00
DEBUG:s7commplus.connection: Request payload (40 bytes): 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 04 00 01 00 00 00 00
DEBUG:s7commplus.connection: Full frame (96 bytes): 72 03 00 58 20 cb e1 83 16 f6 b7 33 72 55 dd f8 87 6c f5 7e 2d 48 fd e7 63 9e 11 e2 03 26 17 1e 17 d3 f5 aa fa 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 04 00 01 00 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Sent 103 bytes: 03 00 00 67 02 f0 80 72 03 00 58 20 cb e1 83 16 f6 b7 33 72 55 dd f8 87 6c f5 7e 2d 48 fd e7 63 9e 11 e2 03 26 17 1e 17 d3 f5 aa fa 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 04 00 01 00 00 00 00 00 72 03 00 00
INFO:snap7.connection:Disconnected from 10.0.1.102:102
ERROR:root:S7commplus connection failed
Traceback (most recent call last):
\AppData\Local\Programs\Python\Python314\Lib\site-packages\snap7\connection.py", line 473, in _recv_exact
chunk = self.socket.recv(size - len(data))
ConnectionResetError: [WinError 10054] An existing connection was forcibly closed by the remote host

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "DebugTest.py", line 17, in connect_s71500
client.connect(PLC_IP,rack=0, slot=1)
~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
File "\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\client.py", line 143, in connect
self._open_connection()
~~~~~~~~~~~~~~~~~~~~~^^
File "\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\client.py", line 151, in _open_connection
self._connection.connect(
~~~~~~~~~~~~~~~~~~~~~~~~^
use_tls=p["use_tls"],
^^^^^^^^^^^^^^^^^^^^^
...<3 lines>...
password=p["password"] or "",
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 527, in connect
self._post_auth_legitimation(password=self._connect_password)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 1450, in _post_auth_legitimation
challenge_resp = self.send_request(
FunctionCode.GET_VAR_SUBSTREAMED,
self._build_get_var_substreamed(self._session_id, LegitimationId.SERVER_SESSION_REQUEST),
integrity_tail=4,
)
File "\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 877, in send_request
response_frame = self._recv_s7_data()
File "\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 1643, in _recv_s7_data
return self._iso_conn.receive_data()
~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
File "\AppData\Local\Programs\Python\Python314\Lib\site-packages\snap7\connection.py", line 204, in receive_data
tpkt_header = self._recv_exact(4)
File "\AppData\Local\Programs\Python\Python314\Lib\site-packages\snap7\connection.py", line 483, in _recv_exact
raise S7ConnectionError(f"Receive error: {e}")
snap7.error.S7ConnectionError: Receive error: [WinError 10054] An existing connection was forcibly closed by the remote host
Session closed.

[gaurav041089]

Initiating S7commPlus connection to 10.0.1.102...
DEBUG:snap7.connection:TCP connected to 10.0.1.102:102
DEBUG:snap7.connection:Sent COTP Connection Request
DEBUG:snap7.connection:Negotiated PDU size: 1024
DEBUG:snap7.connection:Unsupported COTP parameter: code=0xc1, length=2
DEBUG:snap7.connection:Unsupported COTP parameter: code=0xc2, length=16
DEBUG:snap7.connection:Received COTP Connection Confirm
INFO:snap7.connection:Connected to 10.0.1.102:102, PDU size: 1024
DEBUG:s7commplus.connection:=== InitSSL === sending (26 bytes): 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Sent 33 bytes: 03 00 00 21 02 f0 80 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=38 payload (34 bytes): 02 f0 80 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== InitSSL === received (31 bytes): 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:InitSSL response: version=V1, data_length=23
DEBUG:s7commplus.connection:InitSSL response body (27 bytes): 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== CreateObject === sending (192 bytes): 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Sent 199 bytes: 03 00 00 c7 02 f0 80 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=218 payload (214 bytes): 02 f0 80 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 40 05 b1 05 44 59 dd cf bb 3f 07 e3 e7 09 a6 67 da f5 f5 45 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== CreateObject === received (211 bytes): 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 40 05 b1 05 44 59 dd cf bb 3f 07 e3 e7 09 a6 67 da f5 f5 45 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:CreateObject response: version=V1, data_length=203
DEBUG:s7commplus.connection:CreateObject response body (207 bytes): 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 40 05 b1 05 44 59 dd cf bb 3f 07 e3 e7 09 a6 67 da f5 f5 45 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:CreateObject response header: opcode=0x32 function=0x04CA seq=1 transport=0x36
DEBUG:s7commplus.connection:CreateObject response: return_value=0 object_ids=['0x3b3', '0x3b5']
DEBUG:s7commplus.connection:Session created: id=0x000003B3 (947), version=V1
INFO:s7commplus.connection:ServerSessionVersion captured (87 bytes)
INFO:s7commplus.connection:Public key fingerprint captured: 00:181B7B0847D11694
INFO:s7commplus.connection:Session challenge captured (20 bytes): 4005b1054459ddcfbb3f07e3e709a667daf5f545
INFO:s7commplus.connection:SessionKey auth blob generated (180 bytes)
DEBUG:s7commplus.connection:=== SetupSession === sending (395 bytes): 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 ff be f2 a1 a7 b4 be b6 83 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 78 8a fd 84 1d 78 7b f2 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 52 6a ed 9c 7d f0 0a cb d5 bc da 2c 94 0f 56 59 2c bc 6e 82 3d 7c f2 96 b7 02 53 9c 05 85 76 71 e4 7c 1a 53 88 9f f3 c9 4a 41 fe 36 67 9e b4 c4 f7 bb 82 82 af 41 c8 02 68 ac 91 91 3b 70 d5 b1 d4 17 43 0c 7a b0 c5 7a da e2 40 82 08 ae 53 f3 95 71 b2 d5 c0 38 cd ae 7a 6b fb e0 d3 12 b3 8e a8 4f a6 39 55 33 90 44 4e ba 1c 89 48 db 60 02 db 86 c2 cb ee 2d 16 ab 08 1b 9c bf a5 3f 0d 75 7f b4 21 f0 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
DEBUG:snap7.connection:Sent 402 bytes: 03 00 01 92 02 f0 80 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 ff be f2 a1 a7 b4 be b6 83 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 78 8a fd 84 1d 78 7b f2 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 52 6a ed 9c 7d f0 0a cb d5 bc da 2c 94 0f 56 59 2c bc 6e 82 3d 7c f2 96 b7 02 53 9c 05 85 76 71 e4 7c 1a 53 88 9f f3 c9 4a 41 fe 36 67 9e b4 c4 f7 bb 82 82 af 41 c8 02 68 ac 91 91 3b 70 d5 b1 d4 17 43 0c 7a b0 c5 7a da e2 40 82 08 ae 53 f3 95 71 b2 d5 c0 38 cd ae 7a 6b fb e0 d3 12 b3 8e a8 4f a6 39 55 33 90 44 4e ba 1c 89 48 db 60 02 db 86 c2 cb ee 2d 16 ab 08 1b 9c bf a5 3f 0d 75 7f b4 21 f0 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=32 payload (28 bytes): 02 f0 80 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
DEBUG:s7commplus.connection:=== SetupSession === received (25 bytes): 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
DEBUG:s7commplus.connection:SetupSession response: function=0x0542
INFO:s7commplus.connection:SecurityKey accepted by PLC, IntegrityId tracking enabled
INFO:s7commplus.connection:Session setup completed successfully
DEBUG:s7commplus.connection:Session activation: SET_VARIABLE addr 323 = USINT(5)
DEBUG:s7commplus.connection: IntegrityId: write=0
DEBUG:s7commplus.connection:=== SEND REQUEST === function_code=0x04F2 seq=3 session=0x000003B3
DEBUG:s7commplus.connection: Request header (14 bytes): 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34
DEBUG:s7commplus.connection: IntegrityId (1 bytes): 00
DEBUG:s7commplus.connection: Request payload (38 bytes): 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00
DEBUG:s7commplus.connection: Full frame (94 bytes): 72 03 00 56 20 68 8c 4c af e6 d4 10 8b 21 c2 62 4f 67 09 14 d1 09 6c 04 44 7a 39 5d 1a d0 b3 1d 38 46 cc 87 c7 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 68 8c 4c af e6 d4 10 8b 21 c2 62 4f 67 09 14 d1 09 6c 04 44 7a 39 5d 1a d0 b3 1d 38 46 cc 87 c7 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=64 payload (60 bytes): 02 f0 80 72 03 00 31 20 07 d5 00 20 4b ec c2 2d 66 4f 68 a5 63 4a 59 ab ef 16 85 2e fb 0f 1f 0e 5c 53 cf ee c1 57 63 b0 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection:=== RECV RESPONSE === raw frame (57 bytes): 72 03 00 31 20 07 d5 00 20 4b ec c2 2d 66 4f 68 a5 63 4a 59 ab ef 16 85 2e fb 0f 1f 0e 5c 53 cf ee c1 57 63 b0 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection: Frame header: version=V3, data_length=49, header_size=4
DEBUG:s7commplus.connection: V3 HMAC verified
DEBUG:s7commplus.connection: Response data (16 bytes): 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00
DEBUG:s7commplus.connection: Response header: opcode=0x32 function=0x04F2 seq=3 transport=0x34
DEBUG:s7commplus.connection: Response IntegrityId: 0 (1 bytes)
DEBUG:s7commplus.connection: Response payload (5 bytes): 06 00 00 00 00
DEBUG:s7commplus.connection: Trailer (4 bytes): 72 03 00 00
INFO:s7commplus.connection:Session activation completed
DEBUG:s7commplus.connection:Post-auth legitimation: reading challenge from address 303
DEBUG:s7commplus.connection: IntegrityId: read=0
DEBUG:s7commplus.connection:=== SEND REQUEST === function_code=0x0586 seq=4 session=0x000003B3
DEBUG:s7commplus.connection: Request header (14 bytes): 31 00 00 05 86 00 00 00 04 00 00 03 b3 34
DEBUG:s7commplus.connection: IntegrityId (1 bytes): 00
DEBUG:s7commplus.connection: Request payload (38 bytes): 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00
DEBUG:s7commplus.connection: Full frame (94 bytes): 72 03 00 56 20 00 16 7d 02 a6 13 61 5c 60 8b ac 82 84 98 52 d1 86 18 b6 53 56 4e ec 7b 7e 43 c8 8a 56 10 9a 0c 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 00 16 7d 02 a6 13 61 5c 60 8b ac 82 84 98 52 d1 86 18 b6 53 56 4e ec 7b 7e 43 c8 8a 56 10 9a 0c 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=88 payload (84 bytes): 02 f0 80 72 03 00 49 20 0d 2f b3 9f 94 1a 54 cd 6d 44 72 85 90 69 49 f0 e8 a8 11 fc 97 09 80 aa 14 3d 6d 10 65 72 1f 58 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 ac 21 43 73 92 5d 0f c9 a8 ef 73 0c 90 8f ca a2 86 3f 8a be 04 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection:=== RECV RESPONSE === raw frame (81 bytes): 72 03 00 49 20 0d 2f b3 9f 94 1a 54 cd 6d 44 72 85 90 69 49 f0 e8 a8 11 fc 97 09 80 aa 14 3d 6d 10 65 72 1f 58 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 ac 21 43 73 92 5d 0f c9 a8 ef 73 0c 90 8f ca a2 86 3f 8a be 04 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection: Frame header: version=V3, data_length=73, header_size=4
DEBUG:s7commplus.connection: V3 HMAC verified
DEBUG:s7commplus.connection: Response data (40 bytes): 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 ac 21 43 73 92 5d 0f c9 a8 ef 73 0c 90 8f ca a2 86 3f 8a be 04 00 00 00 00
DEBUG:s7commplus.connection: Response header: opcode=0x32 function=0x0586 seq=4 transport=0x34
DEBUG:s7commplus.connection: Response IntegrityId: 0 (1 bytes)
DEBUG:s7commplus.connection: Response payload (29 bytes): 00 10 02 14 ac 21 43 73 92 5d 0f c9 a8 ef 73 0c 90 8f ca a2 86 3f 8a be 04 00 00 00 00
DEBUG:s7commplus.connection: Trailer (4 bytes): 72 03 00 00
DEBUG:snap7.connection:Sent 33 bytes: 03 00 00 21 02 f0 80 72 01 00 12 31 00 00 04 d4 00 00 00 05 00 00 03 b3 34 00 00 00 00 72 01 00 00
INFO:snap7.connection:Disconnected from 10.0.1.102:102
ERROR:root:S7commplus connection failed
Traceback (most recent call last):
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 288, in _parse_get_var_substreamed_response
raise ValueError(f"declared value length {length} exceeds response payload")
ValueError: declared value length 67 exceeds response payload

[gijzelaerr]

The latest retest exposed a second deterministic parser defect after gijzelaerr/python-snap7#861 fixed the request layout. Session setup, V3 HMAC verification, and activation all succeed; the PLC then returns the challenge PValue directly after ReturnValue, without the zero marker assumed by the parser. That shifted 10 02 14 (USINT array, length 20) into a false BLOB interpretation and produced the reported declared-length error.

The candidate fix is now available in gijzelaerr/python-snap7#881 at 3162cd6:

python -m pip install --upgrade "python-snap7[s7commplus] @ git+https://github.com/gijzelaerr/python-snap7.git@3162cd6"

Please retest on the same unchanged S7-1511C and report whether connect(), browse(), and the intended symbolic read succeed. If anything still fails, include the full debug traceback; a new packet capture is only needed if the failure is again on the wire. The exact challenge response from your latest log is now a regression fixture.

Local validation for the PR: 2,125 passed, 78 skipped; all pre-commit hooks and source/wheel builds passed.

[gaurav041089]

========================================================== RESTART: C:/Users/Gaurav S Mithari/Desktop/Finolex/ASM/DebugTest.py =========================================================
Initiating S7commPlus connection to 10.0.1.102...
DEBUG:snap7.connection:TCP connected to 10.0.1.102:102
DEBUG:snap7.connection:Sent COTP Connection Request
DEBUG:snap7.connection:Negotiated PDU size: 1024
DEBUG:snap7.connection:Unsupported COTP parameter: code=0xc1, length=2
DEBUG:snap7.connection:Unsupported COTP parameter: code=0xc2, length=16
DEBUG:snap7.connection:Received COTP Connection Confirm
INFO:snap7.connection:Connected to 10.0.1.102:102, PDU size: 1024
DEBUG:s7commplus.connection:=== InitSSL === sending (26 bytes): 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Sent 33 bytes: 03 00 00 21 02 f0 80 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=38 payload (34 bytes): 02 f0 80 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== InitSSL === received (31 bytes): 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:InitSSL response: version=V1, data_length=23
DEBUG:s7commplus.connection:InitSSL response body (27 bytes): 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== CreateObject === sending (192 bytes): 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Sent 199 bytes: 03 00 00 c7 02 f0 80 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=218 payload (214 bytes): 02 f0 80 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 bc bc 0f 09 10 12 a5 ed c7 a0 0e 27 03 4b 45 ea 38 28 da ae a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:=== CreateObject === received (211 bytes): 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 bc bc 0f 09 10 12 a5 ed c7 a0 0e 27 03 4b 45 ea 38 28 da ae a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:CreateObject response: version=V1, data_length=203
DEBUG:s7commplus.connection:CreateObject response body (207 bytes): 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 bc bc 0f 09 10 12 a5 ed c7 a0 0e 27 03 4b 45 ea 38 28 da ae a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
DEBUG:s7commplus.connection:CreateObject response header: opcode=0x32 function=0x04CA seq=1 transport=0x36
DEBUG:s7commplus.connection:CreateObject response: return_value=0 object_ids=['0x3b3', '0x3b5']
DEBUG:s7commplus.connection:Session created: id=0x000003B3 (947), version=V1
INFO:s7commplus.connection:ServerSessionVersion captured (87 bytes)
INFO:s7commplus.connection:Public key fingerprint captured: 00:181B7B0847D11694
INFO:s7commplus.connection:Session challenge captured (20 bytes): bcbc0f091012a5edc7a00e27034b45ea3828daae
INFO:s7commplus.connection:SessionKey auth blob generated (180 bytes)
DEBUG:s7commplus.connection:=== SetupSession === sending (395 bytes): 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 d7 a0 d9 b4 e6 95 fb c0 74 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 26 be cc e4 be 0d 44 9d 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 b4 2d 70 5b 6b 24 7f fc 89 28 a9 58 59 90 92 f3 69 f9 d9 6f 6b ab e7 75 22 21 c6 25 4a 3a 1a 0a 96 7d 37 d1 a8 36 f1 b4 1a 64 12 41 72 56 7e 5b 69 88 9e 44 2d 79 6a ce a5 a0 15 42 dd 6e 19 2b 66 e9 84 c0 9e 7e 7a 82 07 8f e0 a2 54 d9 34 a7 86 22 79 ee 15 df f5 58 57 61 05 c5 58 59 fa 30 5f 1a 98 52 6c 19 56 6c a5 93 4b 3d 20 ad a5 0c ed 65 bc 02 7c e3 4a b3 9c e7 2a 13 9e e6 35 fd 59 87 d0 a8 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
DEBUG:snap7.connection:Sent 402 bytes: 03 00 01 92 02 f0 80 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 d7 a0 d9 b4 e6 95 fb c0 74 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 26 be cc e4 be 0d 44 9d 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 b4 2d 70 5b 6b 24 7f fc 89 28 a9 58 59 90 92 f3 69 f9 d9 6f 6b ab e7 75 22 21 c6 25 4a 3a 1a 0a 96 7d 37 d1 a8 36 f1 b4 1a 64 12 41 72 56 7e 5b 69 88 9e 44 2d 79 6a ce a5 a0 15 42 dd 6e 19 2b 66 e9 84 c0 9e 7e 7a 82 07 8f e0 a2 54 d9 34 a7 86 22 79 ee 15 df f5 58 57 61 05 c5 58 59 fa 30 5f 1a 98 52 6c 19 56 6c a5 93 4b 3d 20 ad a5 0c ed 65 bc 02 7c e3 4a b3 9c e7 2a 13 9e e6 35 fd 59 87 d0 a8 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=32 payload (28 bytes): 02 f0 80 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
DEBUG:s7commplus.connection:=== SetupSession === received (25 bytes): 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
DEBUG:s7commplus.connection:SetupSession response: function=0x0542
INFO:s7commplus.connection:SecurityKey accepted by PLC, IntegrityId tracking enabled
INFO:s7commplus.connection:Session setup completed successfully
DEBUG:s7commplus.connection:Session activation: SET_VARIABLE addr 323 = USINT(5)
DEBUG:s7commplus.connection: IntegrityId: write=0
DEBUG:s7commplus.connection:=== SEND REQUEST === function_code=0x04F2 seq=3 session=0x000003B3
DEBUG:s7commplus.connection: Request header (14 bytes): 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34
DEBUG:s7commplus.connection: IntegrityId (1 bytes): 00
DEBUG:s7commplus.connection: Request payload (38 bytes): 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00
DEBUG:s7commplus.connection: Full frame (94 bytes): 72 03 00 56 20 15 68 f3 64 c4 e1 ef 6c 74 3c cf c3 2c 50 99 0d 5e 83 5c 23 4f 00 76 d4 4c 29 9c 4e 5f 89 40 e1 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 15 68 f3 64 c4 e1 ef 6c 74 3c cf c3 2c 50 99 0d 5e 83 5c 23 4f 00 76 d4 4c 29 9c 4e 5f 89 40 e1 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=64 payload (60 bytes): 02 f0 80 72 03 00 31 20 40 79 13 a0 bf 0a bc 01 df cb 85 80 fb 37 f7 e4 39 9b ea 86 17 81 4d ff a3 4a b3 fe 7c 0f b1 b2 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection:=== RECV RESPONSE === raw frame (57 bytes): 72 03 00 31 20 40 79 13 a0 bf 0a bc 01 df cb 85 80 fb 37 f7 e4 39 9b ea 86 17 81 4d ff a3 4a b3 fe 7c 0f b1 b2 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection: Frame header: version=V3, data_length=49, header_size=4
DEBUG:s7commplus.connection: V3 HMAC verified
DEBUG:s7commplus.connection: Response data (16 bytes): 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00
DEBUG:s7commplus.connection: Response header: opcode=0x32 function=0x04F2 seq=3 transport=0x34
DEBUG:s7commplus.connection: Response IntegrityId: 0 (1 bytes)
DEBUG:s7commplus.connection: Response payload (5 bytes): 06 00 00 00 00
DEBUG:s7commplus.connection: Trailer (4 bytes): 72 03 00 00
INFO:s7commplus.connection:Session activation completed
DEBUG:s7commplus.connection:Post-auth legitimation: reading challenge from address 303
DEBUG:s7commplus.connection: IntegrityId: read=0
DEBUG:s7commplus.connection:=== SEND REQUEST === function_code=0x0586 seq=4 session=0x000003B3
DEBUG:s7commplus.connection: Request header (14 bytes): 31 00 00 05 86 00 00 00 04 00 00 03 b3 34
DEBUG:s7commplus.connection: IntegrityId (1 bytes): 00
DEBUG:s7commplus.connection: Request payload (38 bytes): 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00
DEBUG:s7commplus.connection: Full frame (94 bytes): 72 03 00 56 20 f5 36 ce c4 2e c8 b4 64 ad 84 ab b5 b1 c8 f8 9c 14 45 29 73 73 dd b9 b8 5c 8d d9 1c e7 0d 6a 4b 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 f5 36 ce c4 2e c8 b4 64 ad 84 ab b5 b1 c8 f8 9c 14 45 29 73 73 dd b9 b8 5c 8d d9 1c e7 0d 6a 4b 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00 00 72 03 00 00
DEBUG:snap7.connection:Received TPKT: version=3 length=88 payload (84 bytes): 02 f0 80 72 03 00 49 20 23 e9 27 96 19 cc b6 bd 32 3f 2c bb b6 77 a6 f8 c9 81 5c bc 9c 48 ec 85 b4 f9 e4 a1 fd e5 9b 2d 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 19 48 2e 2a c3 3d f8 98 ed b2 05 0c fe 60 81 9a c4 83 c9 6c 04 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection:=== RECV RESPONSE === raw frame (81 bytes): 72 03 00 49 20 23 e9 27 96 19 cc b6 bd 32 3f 2c bb b6 77 a6 f8 c9 81 5c bc 9c 48 ec 85 b4 f9 e4 a1 fd e5 9b 2d 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 19 48 2e 2a c3 3d f8 98 ed b2 05 0c fe 60 81 9a c4 83 c9 6c 04 00 00 00 00 72 03 00 00
DEBUG:s7commplus.connection: Frame header: version=V3, data_length=73, header_size=4
DEBUG:s7commplus.connection: V3 HMAC verified
DEBUG:s7commplus.connection: Response data (40 bytes): 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 19 48 2e 2a c3 3d f8 98 ed b2 05 0c fe 60 81 9a c4 83 c9 6c 04 00 00 00 00
DEBUG:s7commplus.connection: Response header: opcode=0x32 function=0x0586 seq=4 transport=0x34
DEBUG:s7commplus.connection: Response IntegrityId: 0 (1 bytes)
DEBUG:s7commplus.connection: Response payload (29 bytes): 00 10 02 14 19 48 2e 2a c3 3d f8 98 ed b2 05 0c fe 60 81 9a c4 83 c9 6c 04 00 00 00 00
DEBUG:s7commplus.connection: Trailer (4 bytes): 72 03 00 00
DEBUG:snap7.connection:Sent 33 bytes: 03 00 00 21 02 f0 80 72 01 00 12 31 00 00 04 d4 00 00 00 05 00 00 03 b3 34 00 00 00 00 72 01 00 00
INFO:snap7.connection:Disconnected from 10.0.1.102:102
ERROR:root:S7commplus connection failed
Traceback (most recent call last):
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 288, in _parse_get_var_substreamed_response
raise ValueError(f"declared value length {length} exceeds response payload")
ValueError: declared value length 72 exceeds response payload

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "C:/Users/Gaurav S Mithari/Desktop/Finolex/ASM/DebugTest.py", line 17, in connect_s71500
client.connect(PLC_IP,rack=0, slot=1)
~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\client.py", line 152, in connect
self._open_connection()
~~~~~~~~~~~~~~~~~~~~~^^
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\client.py", line 160, in _open_connection
self._connection.connect(
~~~~~~~~~~~~~~~~~~~~~~~~^
use_tls=p["use_tls"],
^^^^^^^^^^^^^^^^^^^^^
...<3 lines>...
password=p["password"] or "",
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 626, in connect
self._post_auth_legitimation(password=self._connect_password)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 1612, in _post_auth_legitimation
legit_challenge = _parse_get_var_substreamed_response(challenge_resp)
File "C:\Users\Gaurav S Mithari\AppData\Local\Programs\Python\Python314\Lib\site-packages\s7commplus\connection.py", line 293, in _parse_get_var_substreamed_response
raise S7ConnectionError(f"Malformed GetVarSubStreamed response: {exc}") from exc
snap7.error.S7ConnectionError: Malformed GetVarSubStreamed response: declared value length 72 exceeds response payload

[gaurav041089]

C:\Users\Gaurav S Mithari>python d:\NST\s71511\read_plc.py --ip 10.0.1.102 --db 116 --offset 708 --type INT --monitor --interval 1.0 -v

Siemens S7-1511 S7CommPlus Reader
Target PLC IP: 10.0.1.102:102
Protocol: S7CommPlus (OMS+) - No PUT/GET or OPC UA required

12:38:08 [INFO] Connecting to S7-1500 at 10.0.1.102:102 via S7CommPlus...
12:38:08 [DEBUG] TCP connected to 10.0.1.102:102
12:38:08 [DEBUG] Sent COTP Connection Request
12:38:08 [DEBUG] Negotiated PDU size: 1024
12:38:08 [DEBUG] Unsupported COTP parameter: code=0xc1, length=2
12:38:08 [DEBUG] Unsupported COTP parameter: code=0xc2, length=16
12:38:08 [DEBUG] Received COTP Connection Confirm
12:38:08 [INFO] Connected to 10.0.1.102:102, PDU size: 1024
12:38:08 [DEBUG] === InitSSL === sending (26 bytes): 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
12:38:08 [DEBUG] Sent 33 bytes: 03 00 00 21 02 f0 80 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
12:38:08 [DEBUG] Received TPKT: version=3 length=38 payload (34 bytes): 02 f0 80 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
12:38:08 [DEBUG] === InitSSL === received (31 bytes): 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
12:38:08 [DEBUG] InitSSL response: version=V1, data_length=23
12:38:08 [DEBUG] InitSSL response body (27 bytes): 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
12:38:08 [DEBUG] === CreateObject === sending (192 bytes): 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
12:38:08 [DEBUG] Sent 199 bytes: 03 00 00 c7 02 f0 80 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
12:38:08 [DEBUG] Received TPKT: version=3 length=218 payload (214 bytes): 02 f0 80 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 85 91 c7 2f 69 14 08 cd 30 a8 8e 3b 2e 96 47 15 59 69 2b 5d a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
12:38:08 [DEBUG] === CreateObject === received (211 bytes): 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 85 91 c7 2f 69 14 08 cd 30 a8 8e 3b 2e 96 47 15 59 69 2b 5d a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
12:38:08 [DEBUG] CreateObject response: version=V1, data_length=203
12:38:08 [DEBUG] CreateObject response body (207 bytes): 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 85 91 c7 2f 69 14 08 cd 30 a8 8e 3b 2e 96 47 15 59 69 2b 5d a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
12:38:08 [DEBUG] CreateObject response header: opcode=0x32 function=0x04CA seq=1 transport=0x36
12:38:08 [DEBUG] CreateObject response: return_value=0 object_ids=['0x3b3', '0x3b5']
12:38:08 [DEBUG] Session created: id=0x000003B3 (947), version=V1
12:38:08 [INFO] ServerSessionVersion captured (87 bytes)
12:38:08 [INFO] Public key fingerprint captured: 00:181B7B0847D11694
12:38:08 [INFO] Session challenge captured (20 bytes): 8591c72f691408cd30a88e3b2e96471559692b5d
12:38:10 [INFO] SessionKey auth blob generated (180 bytes)
12:38:10 [DEBUG] === SetupSession === sending (395 bytes): 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 e8 da d4 95 e8 b7 f3 ae 51 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 0f 27 54 e5 df 93 0f 5e 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 18 2f f3 a2 a8 1e 39 6e f3 ea 2b de cb c3 01 ed d3 26 68 ca 0f 7b b2 9a 45 d8 d6 3d 05 9d 16 4f 25 70 00 99 5d 50 62 62 33 5f bd b6 4b 4b a1 fa eb 92 70 a3 e3 e4 40 b6 2c 9a f4 a0 e5 cb c6 d0 ea d1 b1 6c b0 ba 1a b6 54 35 46 80 5d 0f 64 fd d3 a0 0f 16 8f fb 6d 10 37 77 bf eb d3 c3 b8 ac 4e 61 fe 0c 15 09 ba b6 90 71 bd a9 c2 d0 e5 69 8b 85 d7 b3 ff 4b 13 05 bc c1 bf 50 c2 8b 6d de 98 c9 6b ca 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
12:38:10 [DEBUG] Sent 402 bytes: 03 00 01 92 02 f0 80 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 e8 da d4 95 e8 b7 f3 ae 51 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 0f 27 54 e5 df 93 0f 5e 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 18 2f f3 a2 a8 1e 39 6e f3 ea 2b de cb c3 01 ed d3 26 68 ca 0f 7b b2 9a 45 d8 d6 3d 05 9d 16 4f 25 70 00 99 5d 50 62 62 33 5f bd b6 4b 4b a1 fa eb 92 70 a3 e3 e4 40 b6 2c 9a f4 a0 e5 cb c6 d0 ea d1 b1 6c b0 ba 1a b6 54 35 46 80 5d 0f 64 fd d3 a0 0f 16 8f fb 6d 10 37 77 bf eb d3 c3 b8 ac 4e 61 fe 0c 15 09 ba b6 90 71 bd a9 c2 d0 e5 69 8b 85 d7 b3 ff 4b 13 05 bc c1 bf 50 c2 8b 6d de 98 c9 6b ca 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
12:38:10 [DEBUG] Received TPKT: version=3 length=32 payload (28 bytes): 02 f0 80 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
12:38:10 [DEBUG] === SetupSession === received (25 bytes): 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
12:38:10 [DEBUG] SetupSession response: function=0x0542
12:38:10 [INFO] SecurityKey accepted by PLC, IntegrityId tracking enabled
12:38:10 [INFO] Session setup completed successfully
12:38:10 [DEBUG] Session activation: SET_VARIABLE addr 323 = USINT(5)
12:38:10 [DEBUG] IntegrityId: write=0
12:38:10 [DEBUG] === SEND REQUEST === function_code=0x04F2 seq=3 session=0x000003B3
12:38:10 [DEBUG] Request header (14 bytes): 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34
12:38:10 [DEBUG] IntegrityId (1 bytes): 00
12:38:10 [DEBUG] Request payload (38 bytes): 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00
12:38:10 [DEBUG] Full frame (94 bytes): 72 03 00 56 20 07 91 2b e7 9b 59 ed ad 28 6e d2 b6 d7 6b 4f c1 01 70 47 40 9b f3 5b dc ea 86 23 c3 a6 9d eb 50 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
12:38:10 [DEBUG] Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 07 91 2b e7 9b 59 ed ad 28 6e d2 b6 d7 6b 4f c1 01 70 47 40 9b f3 5b dc ea 86 23 c3 a6 9d eb 50 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
12:38:10 [DEBUG] Received TPKT: version=3 length=64 payload (60 bytes): 02 f0 80 72 03 00 31 20 41 b8 0c 38 1d 56 92 4c 73 36 74 a5 73 24 5f 0e a1 a8 14 1e da 98 9c 2b ec e0 c4 72 70 21 cf 19 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
12:38:10 [DEBUG] === RECV RESPONSE === raw frame (57 bytes): 72 03 00 31 20 41 b8 0c 38 1d 56 92 4c 73 36 74 a5 73 24 5f 0e a1 a8 14 1e da 98 9c 2b ec e0 c4 72 70 21 cf 19 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
12:38:10 [DEBUG] Frame header: version=V3, data_length=49, header_size=4
12:38:10 [DEBUG] V3 HMAC verified
12:38:10 [DEBUG] Response data (16 bytes): 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00
12:38:10 [DEBUG] Response header: opcode=0x32 function=0x04F2 seq=3 transport=0x34
12:38:10 [DEBUG] Response IntegrityId: 0 (1 bytes)
12:38:10 [DEBUG] Response payload (5 bytes): 06 00 00 00 00
12:38:10 [DEBUG] Trailer (4 bytes): 72 03 00 00
12:38:10 [INFO] Session activation completed
12:38:10 [DEBUG] Post-auth legitimation: reading challenge from address 303
12:38:10 [DEBUG] IntegrityId: read=0
12:38:10 [DEBUG] === SEND REQUEST === function_code=0x0586 seq=4 session=0x000003B3
12:38:10 [DEBUG] Request header (14 bytes): 31 00 00 05 86 00 00 00 04 00 00 03 b3 34
12:38:10 [DEBUG] IntegrityId (1 bytes): 00
12:38:10 [DEBUG] Request payload (38 bytes): 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00
12:38:10 [DEBUG] Full frame (94 bytes): 72 03 00 56 20 ed 62 f4 0f 28 a5 57 8d 71 89 de 51 bb 65 29 30 2c 10 73 7c 12 a2 45 5b 14 56 fe ee 9a 11 dc 07 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00 00 72 03 00 00
12:38:10 [DEBUG] Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 ed 62 f4 0f 28 a5 57 8d 71 89 de 51 bb 65 29 30 2c 10 73 7c 12 a2 45 5b 14 56 fe ee 9a 11 dc 07 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00 00 72 03 00 00
12:38:10 [DEBUG] Received TPKT: version=3 length=88 payload (84 bytes): 02 f0 80 72 03 00 49 20 7a 21 dc c7 d9 a4 ef e7 83 3d a2 11 58 49 40 63 b2 8d c3 11 af 09 26 3f c5 5a d7 bb 82 83 aa 1c 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 f0 30 2d 6e 54 f5 3b 93 6c 98 da 3f a6 1f f1 a6 fd 2f 91 cb 04 00 00 00 00 72 03 00 00
12:38:10 [DEBUG] === RECV RESPONSE === raw frame (81 bytes): 72 03 00 49 20 7a 21 dc c7 d9 a4 ef e7 83 3d a2 11 58 49 40 63 b2 8d c3 11 af 09 26 3f c5 5a d7 bb 82 83 aa 1c 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 f0 30 2d 6e 54 f5 3b 93 6c 98 da 3f a6 1f f1 a6 fd 2f 91 cb 04 00 00 00 00 72 03 00 00
12:38:10 [DEBUG] Frame header: version=V3, data_length=73, header_size=4
12:38:10 [DEBUG] V3 HMAC verified
12:38:10 [DEBUG] Response data (40 bytes): 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 f0 30 2d 6e 54 f5 3b 93 6c 98 da 3f a6 1f f1 a6 fd 2f 91 cb 04 00 00 00 00
12:38:10 [DEBUG] Response header: opcode=0x32 function=0x0586 seq=4 transport=0x34
12:38:10 [DEBUG] Response IntegrityId: 0 (1 bytes)
12:38:10 [DEBUG] Response payload (29 bytes): 00 10 02 14 f0 30 2d 6e 54 f5 3b 93 6c 98 da 3f a6 1f f1 a6 fd 2f 91 cb 04 00 00 00 00
12:38:10 [DEBUG] Trailer (4 bytes): 72 03 00 00
12:38:12 [INFO] Legitimation blob generated (248 bytes)
12:38:12 [DEBUG] Post-auth legitimation: writing solved blob to address 1846
12:38:12 [DEBUG] IntegrityId: write=1
12:38:12 [DEBUG] === SEND REQUEST === function_code=0x057C seq=5 session=0x000003B3
12:38:12 [DEBUG] Request header (14 bytes): 31 00 00 05 7c 00 00 00 05 00 00 03 b3 34
12:38:12 [DEBUG] IntegrityId (1 bytes): 01
12:38:12 [DEBUG] Request payload (292 bytes): 00 00 03 b3 20 04 01 8e 36 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 05 01 00 14 00 81 78 ef be ad de 7c 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 b7 bc 9c d3 80 63 e0 b0 01 00 00 00 00 00 00 00 3c 00 00 00 bd 5b 5e a5 85 ee da 59 98 32 4c bf e5 78 0a 0a 38 a2 f6 7a 29 4a b5 c4 90 22 bd 00 4e b6 22 07 ab 54 08 b5 84 65 c7 85 5e c5 12 94 25 bb 62 fa 4b 83 21 80 67 45 06 36 77 f9 59 b0 ef be ad de 00 00 00 00 40 00 00 00 23 56 67 96 51 2c f5 7c 99 24 58 93 03 30 2c a0 bb 58 f5 32 48 c2 8c 24 95 8a cc ce 3d 39 51 a6 7e e7 65 99 ba 76 03 5f 47 75 5e 75 93 c6 bc 55 30 ca f4 a1 6d e9 15 5e f1 00 a2 7e fb 22 69 36 ef be ad de 01 00 00 00 18 00 00 00 0a 1d bd 88 b2 ea 29 75 60 01 42 99 84 be 13 bc 3b e8 51 58 53 dd de d5 ef be ad de 02 00 00 00 00 00 00 00 05 00 00 00
12:38:12 [DEBUG] Full frame (348 bytes): 72 03 01 54 20 43 e3 f2 1c d5 2b 39 e6 d4 7a da dc 02 ba 83 34 30 df 72 44 d0 ab 21 7c 25 39 83 de 70 63 0a ad 31 00 00 05 7c 00 00 00 05 00 00 03 b3 34 00 00 03 b3 20 04 01 8e 36 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 05 01 00 14 00 81 78 ef be ad de 7c 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 b7 bc 9c d3 80 63 e0 b0 01 00 00 00 00 00 00 00 3c 00 00 00 bd 5b 5e a5 85 ee da 59 98 32 4c bf e5 78 0a 0a 38 a2 f6 7a 29 4a b5 c4 90 22 bd 00 4e b6 22 07 ab 54 08 b5 84 65 c7 85 5e c5 12 94 25 bb 62 fa 4b 83 21 80 67 45 06 36 77 f9 59 b0 ef be ad de 00 00 00 00 40 00 00 00 23 56 67 96 51 2c f5 7c 99 24 58 93 03 30 2c a0 bb 58 f5 32 48 c2 8c 24 95 8a cc ce 3d 39 51 a6 7e e7 65 99 ba 76 03 5f 47 75 5e 75 93 c6 bc 55 30 ca f4 a1 6d e9 15 5e f1 00 a2 7e fb 22 69 36 ef be ad de 01 00 00 00 18 00 00 00 0a 1d bd 88 b2 ea 29 75 60 01 42 99 84 be 13 bc 3b e8 51 58 53 dd de d5 ef be ad de 02 00 00 00 00 00 00 00 05 01 00 00 00 72 03 00 00
12:38:12 [DEBUG] Sent 355 bytes: 03 00 01 63 02 f0 80 72 03 01 54 20 43 e3 f2 1c d5 2b 39 e6 d4 7a da dc 02 ba 83 34 30 df 72 44 d0 ab 21 7c 25 39 83 de 70 63 0a ad 31 00 00 05 7c 00 00 00 05 00 00 03 b3 34 00 00 03 b3 20 04 01 8e 36 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 05 01 00 14 00 81 78 ef be ad de 7c 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 b7 bc 9c d3 80 63 e0 b0 01 00 00 00 00 00 00 00 3c 00 00 00 bd 5b 5e a5 85 ee da 59 98 32 4c bf e5 78 0a 0a 38 a2 f6 7a 29 4a b5 c4 90 22 bd 00 4e b6 22 07 ab 54 08 b5 84 65 c7 85 5e c5 12 94 25 bb 62 fa 4b 83 21 80 67 45 06 36 77 f9 59 b0 ef be ad de 00 00 00 00 40 00 00 00 23 56 67 96 51 2c f5 7c 99 24 58 93 03 30 2c a0 bb 58 f5 32 48 c2 8c 24 95 8a cc ce 3d 39 51 a6 7e e7 65 99 ba 76 03 5f 47 75 5e 75 93 c6 bc 55 30 ca f4 a1 6d e9 15 5e f1 00 a2 7e fb 22 69 36 ef be ad de 01 00 00 00 18 00 00 00 0a 1d bd 88 b2 ea 29 75 60 01 42 99 84 be 13 bc 3b e8 51 58 53 dd de d5 ef be ad de 02 00 00 00 00 00 00 00 05 01 00 00 00 72 03 00 00
12:38:12 [DEBUG] Received TPKT: version=3 length=27 payload (23 bytes): 02 f0 80 72 fe 00 10 00 00 00 00 00 00 02 f9 00 00 00 00 00 00 00 00
12:38:12 [DEBUG] Received TPKT: version=3 length=72 payload (68 bytes): 02 f0 80 72 03 00 39 20 6c 1e df 6c 63 a8 03 cd 2e 11 62 3a f4 f4 7e c4 49 e1 ff 5d 5d 0e 45 dd b5 58 62 88 15 9f 6a 0b 32 00 00 05 7c 00 00 00 05 34 c1 c6 91 90 80 86 e7 ff fe 05 00 00 00 00 72 03 00 00
12:38:12 [DEBUG] === RECV RESPONSE === raw frame (65 bytes): 72 03 00 39 20 6c 1e df 6c 63 a8 03 cd 2e 11 62 3a f4 f4 7e c4 49 e1 ff 5d 5d 0e 45 dd b5 58 62 88 15 9f 6a 0b 32 00 00 05 7c 00 00 00 05 34 c1 c6 91 90 80 86 e7 ff fe 05 00 00 00 00 72 03 00 00
12:38:12 [DEBUG] Frame header: version=V3, data_length=57, header_size=4
12:38:12 [DEBUG] V3 HMAC verified
12:38:12 [DEBUG] Response data (24 bytes): 32 00 00 05 7c 00 00 00 05 34 c1 c6 91 90 80 86 e7 ff fe 05 00 00 00 00
12:38:12 [DEBUG] Response header: opcode=0x32 function=0x057C seq=5 transport=0x34
12:38:12 [DEBUG] Response IntegrityId: 17595385856 (5 bytes)
12:38:12 [DEBUG] Response payload (9 bytes): 86 e7 ff fe 05 00 00 00 00
12:38:12 [DEBUG] Trailer (4 bytes): 72 03 00 00
12:38:12 [DEBUG] Legitimation write return_value=0x6CFFFF05
12:38:12 [INFO] Post-auth legitimation completed
12:38:12 [DEBUG] IntegrityId: read=1
12:38:12 [DEBUG] === SEND REQUEST === function_code=0x0586 seq=6 session=0x000003B3
12:38:12 [DEBUG] Request header (14 bytes): 31 00 00 05 86 00 00 00 06 00 00 03 b3 34
12:38:12 [DEBUG] IntegrityId (1 bytes): 01
12:38:12 [DEBUG] Request payload (38 bytes): 00 00 03 b3 20 04 01 8e 32 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00
12:38:12 [DEBUG] Full frame (94 bytes): 72 03 00 56 20 c5 fc dd 6d 15 21 92 74 40 46 1d c6 e3 b4 de 85 59 6c 68 03 1f e1 ef d3 d0 8b 84 a6 85 9b b9 df 31 00 00 05 86 00 00 00 06 00 00 03 b3 34 00 00 03 b3 20 04 01 8e 32 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 01 00 00 00 00 72 03 00 00
12:38:12 [DEBUG] Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 c5 fc dd 6d 15 21 92 74 40 46 1d c6 e3 b4 de 85 59 6c 68 03 1f e1 ef d3 d0 8b 84 a6 85 9b b9 df 31 00 00 05 86 00 00 00 06 00 00 03 b3 34 00 00 03 b3 20 04 01 8e 32 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 01 00 00 00 00 72 03 00 00
12:38:12 [DEBUG] Received TPKT: version=3 length=68 payload (64 bytes): 02 f0 80 72 03 00 35 20 38 73 99 ef 7a 83 40 49 40 0f a2 ed b8 a9 d5 93 7c 2d 89 e6 88 7f 15 89 76 3b 30 82 70 d1 1b 05 32 00 00 05 86 00 00 00 06 34 00 00 00 04 01 07 00 00 00 00 72 03 00 00
12:38:12 [DEBUG] === RECV RESPONSE === raw frame (61 bytes): 72 03 00 35 20 38 73 99 ef 7a 83 40 49 40 0f a2 ed b8 a9 d5 93 7c 2d 89 e6 88 7f 15 89 76 3b 30 82 70 d1 1b 05 32 00 00 05 86 00 00 00 06 34 00 00 00 04 01 07 00 00 00 00 72 03 00 00
12:38:12 [DEBUG] Frame header: version=V3, data_length=53, header_size=4
12:38:12 [DEBUG] V3 HMAC verified
12:38:12 [DEBUG] Response data (20 bytes): 32 00 00 05 86 00 00 00 06 34 00 00 00 04 01 07 00 00 00 00
12:38:12 [DEBUG] Response header: opcode=0x32 function=0x0586 seq=6 transport=0x34
12:38:12 [DEBUG] Response IntegrityId: 0 (1 bytes)
12:38:12 [DEBUG] Response payload (9 bytes): 00 00 04 01 07 00 00 00 00
12:38:12 [DEBUG] Trailer (4 bytes): 72 03 00 00
12:38:12 [INFO] PLC reports protection level: 1
12:38:12 [INFO] S7CommPlus connected to 10.0.1.102:102, version=V1, session=947, tls=False
12:38:12 [INFO] Connected successfully! Session ID: 947, Protocol Version: V1, Protection Level: 1

[*] S7CommPlus Session Established!
- Session ID : 947
- Protocol Ver : V1
- Protection Lvl : 1 (1 = Read/Write Access)
- TLS Active : False

[*] Starting continuous monitor mode (interval: 1.0s). Press Ctrl+C to stop.

12:38:12 [DEBUG] IntegrityId: read=2
12:38:12 [DEBUG] === SEND REQUEST === function_code=0x054C seq=7 session=0x000003B3
12:38:12 [DEBUG] Request header (14 bytes): 31 00 00 05 4c 00 00 00 07 00 00 03 b3 34
12:38:12 [DEBUG] IntegrityId (1 bytes): 02
12:38:12 [DEBUG] Request payload (47 bytes): 00 00 00 00 01 06 00 88 d0 b8 80 74 03 93 76 85 45 02 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00
12:38:12 [DEBUG] Full frame (103 bytes): 72 03 00 5f 20 e0 e6 52 04 0a 2d 9a 3f 63 a6 96 bd 75 56 fd 69 06 32 42 e6 16 56 0a 8b ef 54 a2 3c f0 5f b5 03 31 00 00 05 4c 00 00 00 07 00 00 03 b3 34 00 00 00 00 01 06 00 88 d0 b8 80 74 03 93 76 85 45 02 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 02 00 00 00 00 72 03 00 00
12:38:12 [DEBUG] Sent 110 bytes: 03 00 00 6e 02 f0 80 72 03 00 5f 20 e0 e6 52 04 0a 2d 9a 3f 63 a6 96 bd 75 56 fd 69 06 32 42 e6 16 56 0a 8b ef 54 a2 3c f0 5f b5 03 31 00 00 05 4c 00 00 00 07 00 00 03 b3 34 00 00 00 00 01 06 00 88 d0 b8 80 74 03 93 76 85 45 02 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 02 00 00 00 00 72 03 00 00
12:38:12 [DEBUG] Received TPKT: version=3 length=39 payload (35 bytes): 02 f0 80 72 fe 00 1c 00 00 00 00 00 00 05 02 00 00 00 00 00 00 00 00 00 00 00 17 00 00 9d 6c 00 00 00 00
[2026-09-11 12:38:12]
[-] Error occurred: S7ConnectionError: Receive error: [WinError 10054] An existing connection was forcibly closed by the remote host
12:38:12 [INFO] Disconnected from 10.0.1.102:102
12:38:12 [INFO] Disconnected from PLC.

C:\Users\Gaurav S Mithari>

[gaurav041089]

C:\Users\Gaurav S Mithari\python-snap7>python d:\NST\s71511\read_plc.py --ip 10.0.1.102 --db 116 --offset 708 --type DINT --monitor --interval 1.0 -v

Siemens S7-1511 S7CommPlus Reader
Target PLC IP: 10.0.1.102:102
Protocol: S7CommPlus (OMS+) - No PUT/GET or OPC UA required

13:30:53 [INFO] Connecting to S7-1500 at 10.0.1.102:102 via S7CommPlus...
13:30:53 [DEBUG] TCP connected to 10.0.1.102:102
13:30:53 [DEBUG] Sent COTP Connection Request
13:30:53 [DEBUG] Negotiated PDU size: 1024
13:30:53 [DEBUG] Unsupported COTP parameter: code=0xc1, length=2
13:30:53 [DEBUG] Unsupported COTP parameter: code=0xc2, length=16
13:30:53 [DEBUG] Received COTP Connection Confirm
13:30:53 [INFO] Connected to 10.0.1.102:102, PDU size: 1024
13:30:53 [DEBUG] === InitSSL === sending (26 bytes): 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
13:30:53 [DEBUG] Sent 33 bytes: 03 00 00 21 02 f0 80 72 01 00 12 31 00 00 05 b3 00 00 00 00 00 00 00 00 30 00 00 00 00 72 01 00 00
13:30:53 [DEBUG] Received TPKT: version=3 length=38 payload (34 bytes): 02 f0 80 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
13:30:53 [DEBUG] === InitSSL === received (31 bytes): 72 01 00 17 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
13:30:53 [DEBUG] InitSSL response: version=V1, data_length=23
13:30:53 [DEBUG] InitSSL response body (27 bytes): 32 00 00 05 a9 00 00 00 00 34 d1 80 b3 a0 80 86 b9 ff 89 00 00 00 00 72 01 00 00
13:30:53 [DEBUG] === CreateObject === sending (192 bytes): 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
13:30:53 [DEBUG] Sent 199 bytes: 03 00 00 c7 02 f0 80 72 01 00 b8 31 00 00 04 ca 00 00 00 01 00 00 01 20 36 00 00 01 1d 00 04 00 00 00 00 00 a1 00 00 00 d3 82 1f 00 00 a3 81 69 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 21 00 15 15 31 3a 3a 3a 36 2e 30 3a 3a 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 28 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 29 00 15 00 a3 82 2a 00 15 0c 70 79 74 68 6f 6e 2d 73 6e 61 70 37 a3 82 2b 00 04 01 a3 82 2c 00 12 80 c3 c9 01 a3 82 2d 00 15 00 a1 00 00 00 d3 81 7f 00 00 a3 81 69 00 15 15 53 75 62 73 63 72 69 70 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 a2 a2 00 00 00 00 72 01 00 00
13:30:53 [DEBUG] Received TPKT: version=3 length=218 payload (214 bytes): 02 f0 80 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 fd 5e 18 94 14 73 21 17 2b 73 fc 6e 6d 72 28 94 67 64 05 82 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
13:30:53 [DEBUG] === CreateObject === received (211 bytes): 72 01 00 cb 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 fd 5e 18 94 14 73 21 17 2b 73 fc 6e 6d 72 28 94 67 64 05 82 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
13:30:53 [DEBUG] CreateObject response: version=V1, data_length=203
13:30:53 [DEBUG] CreateObject response body (207 bytes): 32 00 00 04 ca 00 00 00 01 36 00 02 87 33 87 35 a1 00 00 01 20 82 1f 01 00 a3 81 69 00 15 13 30 30 3a 31 38 31 42 37 42 30 38 34 37 44 31 31 36 39 34 a3 82 2b 00 04 82 80 80 80 02 a3 82 2d 00 15 10 4f 4d 53 50 2e 52 45 4c 2e 38 30 38 39 2e 32 32 a3 82 2f 10 02 14 fd 5e 18 94 14 73 21 17 2b 73 fc 6e 6d 72 28 94 67 64 05 82 a3 82 32 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 1a 31 3b 36 45 53 37 20 35 31 31 2d 31 43 4b 30 30 2d 30 41 42 30 3b 56 32 2e 31 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 a2 00 00 00 00 72 01 00 00
13:30:53 [DEBUG] CreateObject response header: opcode=0x32 function=0x04CA seq=1 transport=0x36
13:30:53 [DEBUG] CreateObject response: return_value=0 object_ids=['0x3b3', '0x3b5']
13:30:53 [DEBUG] Session created: id=0x000003B3 (947), version=V1
13:30:53 [INFO] ServerSessionVersion captured (87 bytes)
13:30:53 [INFO] Public key fingerprint captured: 00:181B7B0847D11694
13:30:53 [INFO] Session challenge captured (20 bytes): fd5e1894147321172b73fc6e6d72289467640582
13:30:55 [INFO] SessionKey auth blob generated (180 bytes)
13:30:55 [DEBUG] === SetupSession === sending (395 bytes): 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 d7 fe e8 81 9d 86 fd de f4 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 bc 79 84 8b 17 bc a9 cb 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 c3 ae 2f f9 0c 46 e2 e0 03 b4 31 e0 40 20 2b 70 b9 c9 56 aa 9c 8e 71 66 c2 70 55 f1 00 8a 40 34 72 af d0 5b c0 e9 a2 c0 cf 35 e9 c4 10 f1 8c dd cf b9 ab 43 fe 01 16 09 bb 60 8c 8b 6f e1 07 6b ef ac 96 0e 76 08 84 a5 91 6d 60 39 27 55 67 7f 52 76 39 7b 30 9e 61 3a 48 80 54 65 09 71 79 8f 53 b0 7d 69 74 1a 67 dd 91 d2 97 74 ef 45 8a 76 1e 3b 78 6c 7a 45 0d 94 bf 2a ae b3 4a 90 61 51 ca eb 3b ec 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
13:30:55 [DEBUG] Sent 402 bytes: 03 00 01 92 02 f0 80 72 02 01 83 31 00 00 05 42 00 00 00 02 00 00 03 b3 34 00 00 03 b3 02 02 8e 26 82 32 01 00 17 00 00 07 08 8e 09 00 04 00 8e 0a 00 02 00 8e 0b 00 17 00 00 07 21 8e 22 00 05 8c 86 ef b0 c2 9f a2 96 94 8e 23 00 04 10 8e 24 00 04 00 00 8e 0c 00 17 00 00 07 21 8e 22 00 05 d7 fe e8 81 9d 86 fd de f4 8e 23 00 04 84 80 01 8e 24 00 04 00 00 8e 0d 00 14 00 81 34 ad de e1 fe b4 00 00 00 01 00 00 00 01 00 00 00 bc 79 84 8b 17 bc a9 cb 01 00 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 c3 ae 2f f9 0c 46 e2 e0 03 b4 31 e0 40 20 2b 70 b9 c9 56 aa 9c 8e 71 66 c2 70 55 f1 00 8a 40 34 72 af d0 5b c0 e9 a2 c0 cf 35 e9 c4 10 f1 8c dd cf b9 ab 43 fe 01 16 09 bb 60 8c 8b 6f e1 07 6b ef ac 96 0e 76 08 84 a5 91 6d 60 39 27 55 67 7f 52 76 39 7b 30 9e 61 3a 48 80 54 65 09 71 79 8f 53 b0 7d 69 74 1a 67 dd 91 d2 97 74 ef 45 8a 76 1e 3b 78 6c 7a 45 0d 94 bf 2a ae b3 4a 90 61 51 ca eb 3b ec 00 02 00 17 00 00 01 3a 82 3b 00 04 84 00 82 3c 00 04 83 40 82 3d 00 04 84 81 82 40 82 3e 00 04 84 81 81 40 82 3f 00 15 00 82 40 00 15 0a 32 3b 33 33 39 30 37 34 35 36 82 41 00 03 00 03 00 00 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00 72 02 00 00
13:30:55 [DEBUG] Received TPKT: version=3 length=32 payload (28 bytes): 02 f0 80 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
13:30:55 [DEBUG] === SetupSession === received (25 bytes): 72 02 00 11 32 00 00 05 42 00 00 00 02 34 00 00 00 00 00 00 00 72 02 00 00
13:30:55 [DEBUG] SetupSession response: function=0x0542
13:30:55 [INFO] SecurityKey accepted by PLC, IntegrityId tracking enabled
13:30:55 [INFO] Session setup completed successfully
13:30:55 [DEBUG] Session activation: SET_VARIABLE addr 323 = USINT(5)
13:30:55 [DEBUG] IntegrityId: write=0
13:30:55 [DEBUG] === SEND REQUEST === function_code=0x04F2 seq=3 session=0x000003B3
13:30:55 [DEBUG] Request header (14 bytes): 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34
13:30:55 [DEBUG] IntegrityId (1 bytes): 00
13:30:55 [DEBUG] Request payload (38 bytes): 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00
13:30:55 [DEBUG] Full frame (94 bytes): 72 03 00 56 20 5f d6 b4 b7 27 b7 8c 6a bb 92 e1 33 ea 27 8c 46 50 69 20 42 ee 7f 8c e1 3d 49 4e 74 71 9e 7e d3 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
13:30:55 [DEBUG] Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 5f d6 b4 b7 27 b7 8c 6a bb 92 e1 33 ea 27 8c 46 50 69 20 42 ee 7f 8c e1 3d 49 4e 74 71 9e 7e d3 31 00 00 04 f2 00 00 00 03 00 00 03 b3 34 00 00 03 b3 01 82 43 00 02 05 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 03 00 00 00 00 72 03 00 00
13:30:55 [DEBUG] Received TPKT: version=3 length=64 payload (60 bytes): 02 f0 80 72 03 00 31 20 b2 f3 f9 ce 31 c3 4a 2d fd c3 e2 91 65 43 85 4e 18 2e 4c 06 30 40 d3 ed ed 8e c5 19 95 b4 7e 78 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
13:30:55 [DEBUG] === RECV RESPONSE === raw frame (57 bytes): 72 03 00 31 20 b2 f3 f9 ce 31 c3 4a 2d fd c3 e2 91 65 43 85 4e 18 2e 4c 06 30 40 d3 ed ed 8e c5 19 95 b4 7e 78 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00 72 03 00 00
13:30:55 [DEBUG] Frame header: version=V3, data_length=49, header_size=4
13:30:55 [DEBUG] V3 HMAC verified
13:30:55 [DEBUG] Response data (16 bytes): 32 00 00 04 f2 00 00 00 03 34 00 06 00 00 00 00
13:30:55 [DEBUG] Response header: opcode=0x32 function=0x04F2 seq=3 transport=0x34
13:30:55 [DEBUG] Response IntegrityId: 0 (1 bytes)
13:30:55 [DEBUG] Response payload (5 bytes): 06 00 00 00 00
13:30:55 [DEBUG] Trailer (4 bytes): 72 03 00 00
13:30:55 [INFO] Session activation completed
13:30:55 [DEBUG] Post-auth legitimation: reading challenge from address 303
13:30:55 [DEBUG] IntegrityId: read=0
13:30:55 [DEBUG] === SEND REQUEST === function_code=0x0586 seq=4 session=0x000003B3
13:30:55 [DEBUG] Request header (14 bytes): 31 00 00 05 86 00 00 00 04 00 00 03 b3 34
13:30:55 [DEBUG] IntegrityId (1 bytes): 00
13:30:55 [DEBUG] Request payload (38 bytes): 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00
13:30:55 [DEBUG] Full frame (94 bytes): 72 03 00 56 20 cf 1a 8f b5 98 fa aa c1 b5 75 5d 54 64 d1 1c 86 e2 68 72 39 ac 30 df bd c9 30 7d 91 5b 30 1b 14 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00 00 72 03 00 00
13:30:55 [DEBUG] Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 cf 1a 8f b5 98 fa aa c1 b5 75 5d 54 64 d1 1c 86 e2 68 72 39 ac 30 df bd c9 30 7d 91 5b 30 1b 14 31 00 00 05 86 00 00 00 04 00 00 03 b3 34 00 00 03 b3 20 04 01 82 2f 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00 00 72 03 00 00
13:30:55 [DEBUG] Received TPKT: version=3 length=88 payload (84 bytes): 02 f0 80 72 03 00 49 20 df 0e d4 e3 8a 3e 58 c7 15 05 2b 1d a7 2d c9 0d d0 51 12 12 1f e3 44 5b ca 40 8a 40 af d7 7d 35 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 21 b7 b8 50 f2 44 09 fc 76 44 ae 35 39 cc 5f 57 46 96 1d 79 04 00 00 00 00 72 03 00 00
13:30:55 [DEBUG] === RECV RESPONSE === raw frame (81 bytes): 72 03 00 49 20 df 0e d4 e3 8a 3e 58 c7 15 05 2b 1d a7 2d c9 0d d0 51 12 12 1f e3 44 5b ca 40 8a 40 af d7 7d 35 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 21 b7 b8 50 f2 44 09 fc 76 44 ae 35 39 cc 5f 57 46 96 1d 79 04 00 00 00 00 72 03 00 00
13:30:55 [DEBUG] Frame header: version=V3, data_length=73, header_size=4
13:30:55 [DEBUG] V3 HMAC verified
13:30:55 [DEBUG] Response data (40 bytes): 32 00 00 05 86 00 00 00 04 34 00 00 10 02 14 21 b7 b8 50 f2 44 09 fc 76 44 ae 35 39 cc 5f 57 46 96 1d 79 04 00 00 00 00
13:30:55 [DEBUG] Response header: opcode=0x32 function=0x0586 seq=4 transport=0x34
13:30:55 [DEBUG] Response IntegrityId: 0 (1 bytes)
13:30:55 [DEBUG] Response payload (29 bytes): 00 10 02 14 21 b7 b8 50 f2 44 09 fc 76 44 ae 35 39 cc 5f 57 46 96 1d 79 04 00 00 00 00
13:30:55 [DEBUG] Trailer (4 bytes): 72 03 00 00
13:30:57 [INFO] Legitimation blob generated (248 bytes)
13:30:57 [DEBUG] Post-auth legitimation: writing solved blob to address 1846
13:30:57 [DEBUG] IntegrityId: write=1
13:30:57 [DEBUG] === SEND REQUEST === function_code=0x057C seq=5 session=0x000003B3
13:30:57 [DEBUG] Request header (14 bytes): 31 00 00 05 7c 00 00 00 05 00 00 03 b3 34
13:30:57 [DEBUG] IntegrityId (1 bytes): 01
13:30:57 [DEBUG] Request payload (292 bytes): 00 00 03 b3 20 04 01 8e 36 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 05 01 00 14 00 81 78 ef be ad de 7c 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 12 d0 f2 16 e5 ec d0 9c 01 00 00 00 00 00 00 00 3c 00 00 00 65 26 95 e2 15 5f d3 d8 8c c7 51 30 b4 3c ce 13 9b d8 19 5f 02 1f c2 c5 81 8d 5a 26 f3 2d 04 6f f6 27 d7 19 03 da 7f bf 8f eb a5 21 af 70 d0 d6 55 67 37 97 e0 1a 7b 8b e2 c6 e8 90 ef be ad de 00 00 00 00 40 00 00 00 1e 4a a5 5a a1 f0 cf 5c 50 0d 18 32 28 53 42 34 2a 61 4f 92 cd 0e 0d 05 7a 66 e9 b9 0b 7c c8 40 ac d7 a5 2f 81 eb 25 88 fb 15 ad 96 fc c6 4c 77 1a fd d6 47 a6 bc e9 37 c6 12 35 56 d3 e0 44 4a ef be ad de 01 00 00 00 18 00 00 00 7b c9 5a 37 21 00 8e 21 f2 35 e9 59 7f c5 30 cd 75 fe f1 eb cc 87 e5 79 ef be ad de 02 00 00 00 00 00 00 00 05 00 00 00
13:30:57 [DEBUG] Full frame (348 bytes): 72 03 01 54 20 5d 01 90 8f c7 91 6b e8 e6 cc a6 ae 02 06 ee bb 8b d1 8c 90 ac 71 39 d2 82 a8 a2 95 82 6e 0a 9a 31 00 00 05 7c 00 00 00 05 00 00 03 b3 34 00 00 03 b3 20 04 01 8e 36 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 05 01 00 14 00 81 78 ef be ad de 7c 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 12 d0 f2 16 e5 ec d0 9c 01 00 00 00 00 00 00 00 3c 00 00 00 65 26 95 e2 15 5f d3 d8 8c c7 51 30 b4 3c ce 13 9b d8 19 5f 02 1f c2 c5 81 8d 5a 26 f3 2d 04 6f f6 27 d7 19 03 da 7f bf 8f eb a5 21 af 70 d0 d6 55 67 37 97 e0 1a 7b 8b e2 c6 e8 90 ef be ad de 00 00 00 00 40 00 00 00 1e 4a a5 5a a1 f0 cf 5c 50 0d 18 32 28 53 42 34 2a 61 4f 92 cd 0e 0d 05 7a 66 e9 b9 0b 7c c8 40 ac d7 a5 2f 81 eb 25 88 fb 15 ad 96 fc c6 4c 77 1a fd d6 47 a6 bc e9 37 c6 12 35 56 d3 e0 44 4a ef be ad de 01 00 00 00 18 00 00 00 7b c9 5a 37 21 00 8e 21 f2 35 e9 59 7f c5 30 cd 75 fe f1 eb cc 87 e5 79 ef be ad de 02 00 00 00 00 00 00 00 05 01 00 00 00 72 03 00 00
13:30:57 [DEBUG] Sent 355 bytes: 03 00 01 63 02 f0 80 72 03 01 54 20 5d 01 90 8f c7 91 6b e8 e6 cc a6 ae 02 06 ee bb 8b d1 8c 90 ac 71 39 d2 82 a8 a2 95 82 6e 0a 9a 31 00 00 05 7c 00 00 00 05 00 00 03 b3 34 00 00 03 b3 20 04 01 8e 36 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 05 01 00 14 00 81 78 ef be ad de 7c 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 94 16 d1 47 08 7b 1b 18 10 00 00 00 00 00 00 00 12 d0 f2 16 e5 ec d0 9c 01 00 00 00 00 00 00 00 3c 00 00 00 65 26 95 e2 15 5f d3 d8 8c c7 51 30 b4 3c ce 13 9b d8 19 5f 02 1f c2 c5 81 8d 5a 26 f3 2d 04 6f f6 27 d7 19 03 da 7f bf 8f eb a5 21 af 70 d0 d6 55 67 37 97 e0 1a 7b 8b e2 c6 e8 90 ef be ad de 00 00 00 00 40 00 00 00 1e 4a a5 5a a1 f0 cf 5c 50 0d 18 32 28 53 42 34 2a 61 4f 92 cd 0e 0d 05 7a 66 e9 b9 0b 7c c8 40 ac d7 a5 2f 81 eb 25 88 fb 15 ad 96 fc c6 4c 77 1a fd d6 47 a6 bc e9 37 c6 12 35 56 d3 e0 44 4a ef be ad de 01 00 00 00 18 00 00 00 7b c9 5a 37 21 00 8e 21 f2 35 e9 59 7f c5 30 cd 75 fe f1 eb cc 87 e5 79 ef be ad de 02 00 00 00 00 00 00 00 05 01 00 00 00 72 03 00 00
13:30:57 [DEBUG] Received TPKT: version=3 length=27 payload (23 bytes): 02 f0 80 72 fe 00 10 00 00 00 00 00 00 02 f9 00 00 00 00 00 00 00 00
13:30:57 [DEBUG] === RECV RESPONSE === raw frame (20 bytes): 72 fe 00 10 00 00 00 00 00 00 02 f9 00 00 00 00 00 00 00 00
13:30:57 [DEBUG] Frame header: version=V254, data_length=16, header_size=4
13:30:57 [DEBUG] V254 frame: returning raw data (16 bytes)
13:30:57 [DEBUG] Legitimation write return_value=0x0
13:30:57 [INFO] Post-auth legitimation completed
13:30:57 [DEBUG] IntegrityId: read=1
13:30:57 [DEBUG] === SEND REQUEST === function_code=0x0586 seq=6 session=0x000003B3
13:30:57 [DEBUG] Request header (14 bytes): 31 00 00 05 86 00 00 00 06 00 00 03 b3 34
13:30:57 [DEBUG] IntegrityId (1 bytes): 01
13:30:57 [DEBUG] Request payload (38 bytes): 00 00 03 b3 20 04 01 8e 32 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 00 00 00 00
13:30:57 [DEBUG] Full frame (94 bytes): 72 03 00 56 20 bb a5 2f 65 6d 9b fe 45 cb fd ed da 84 77 c0 fe 0e 51 8e bc 10 69 e7 82 c6 ae 01 09 39 a4 48 f2 31 00 00 05 86 00 00 00 06 00 00 03 b3 34 00 00 03 b3 20 04 01 8e 32 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 01 00 00 00 00 72 03 00 00
13:30:57 [DEBUG] Sent 101 bytes: 03 00 00 65 02 f0 80 72 03 00 56 20 bb a5 2f 65 6d 9b fe 45 cb fd ed da 84 77 c0 fe 0e 51 8e bc 10 69 e7 82 c6 ae 01 09 39 a4 48 f2 31 00 00 05 86 00 00 00 06 00 00 03 b3 34 00 00 03 b3 20 04 01 8e 32 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 01 01 00 00 00 00 72 03 00 00
13:30:57 [DEBUG] Received TPKT: version=3 length=72 payload (68 bytes): 02 f0 80 72 03 00 39 20 3b 09 bb 75 64 b3 c6 d9 80 ec 10 3f 83 c8 5c e4 74 67 fc 05 8a e4 b5 a8 74 34 5f fb 2d c8 16 53 32 00 00 05 7c 00 00 00 05 34 c1 c6 91 90 80 86 e7 ff fe 05 00 00 00 00 72 03 00 00
13:30:57 [DEBUG] === RECV RESPONSE === raw frame (65 bytes): 72 03 00 39 20 3b 09 bb 75 64 b3 c6 d9 80 ec 10 3f 83 c8 5c e4 74 67 fc 05 8a e4 b5 a8 74 34 5f fb 2d c8 16 53 32 00 00 05 7c 00 00 00 05 34 c1 c6 91 90 80 86 e7 ff fe 05 00 00 00 00 72 03 00 00
13:30:57 [DEBUG] Frame header: version=V3, data_length=57, header_size=4
13:30:57 [DEBUG] V3 HMAC verified
13:30:57 [DEBUG] Response data (24 bytes): 32 00 00 05 7c 00 00 00 05 34 c1 c6 91 90 80 86 e7 ff fe 05 00 00 00 00
13:30:57 [DEBUG] Response header: opcode=0x32 function=0x057C seq=5 transport=0x34
13:30:57 [DEBUG] Response IntegrityId: 17595385856 (5 bytes)
13:30:57 [DEBUG] Response payload (9 bytes): 86 e7 ff fe 05 00 00 00 00
13:30:57 [DEBUG] Trailer (4 bytes): 72 03 00 00
13:30:57 [WARNING] PLC did not report a protection level: GetVarSubStreamed for protection level failed: 1828716293
13:30:57 [INFO] S7CommPlus connected to 10.0.1.102:102, version=V1, session=947, tls=False
13:30:57 [INFO] Connected successfully! Session ID: 947, Protocol Version: V1, Protection Level: None

[*] S7CommPlus Session Established!
- Session ID : 947
- Protocol Ver : V1
- Protection Lvl : None (1 = Read/Write Access)
- TLS Active : False

[*] Starting continuous monitor mode (interval: 1.0s). Press Ctrl+C to stop.

13:30:57 [DEBUG] IntegrityId: read=2
13:30:57 [DEBUG] === SEND REQUEST === function_code=0x054C seq=7 session=0x000003B3
13:30:57 [DEBUG] Request header (14 bytes): 31 00 00 05 4c 00 00 00 07 00 00 03 b3 34
13:30:57 [DEBUG] IntegrityId (1 bytes): 02
13:30:57 [DEBUG] Request payload (47 bytes): 00 00 00 00 01 06 00 88 d0 b8 80 74 03 93 76 85 45 04 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 00 00 00 00
13:30:57 [DEBUG] Full frame (103 bytes): 72 03 00 5f 20 25 fa e9 b3 ce 5f 7f 2e 02 73 b1 71 3f ea ef 76 7b f4 1d 30 80 37 a1 b4 20 07 62 7d bd df 0a 58 31 00 00 05 4c 00 00 00 07 00 00 03 b3 34 00 00 00 00 01 06 00 88 d0 b8 80 74 03 93 76 85 45 04 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 02 00 00 00 00 72 03 00 00
13:30:57 [DEBUG] Sent 110 bytes: 03 00 00 6e 02 f0 80 72 03 00 5f 20 25 fa e9 b3 ce 5f 7f 2e 02 73 b1 71 3f ea ef 76 7b f4 1d 30 80 37 a1 b4 20 07 62 7d bd df 0a 58 31 00 00 05 4c 00 00 00 07 00 00 03 b3 34 00 00 00 00 01 06 00 88 d0 b8 80 74 03 93 76 85 45 04 00 00 04 e8 89 69 00 12 00 00 00 00 89 6a 00 13 00 89 6b 00 04 00 00 00 00 02 00 00 00 00 72 03 00 00
13:30:57 [DEBUG] Received TPKT: version=3 length=68 payload (64 bytes): 02 f0 80 72 03 00 35 20 21 d6 7f cb 4f 7b 9e 45 fb 89 81 7e 4d 72 c5 a1 1f 75 c2 0b 8d 60 89 07 74 8b b7 d6 91 53 9c be 32 00 00 05 86 00 00 00 06 34 00 00 00 04 01 07 00 00 00 00 72 03 00 00
13:30:57 [DEBUG] === RECV RESPONSE === raw frame (61 bytes): 72 03 00 35 20 21 d6 7f cb 4f 7b 9e 45 fb 89 81 7e 4d 72 c5 a1 1f 75 c2 0b 8d 60 89 07 74 8b b7 d6 91 53 9c be 32 00 00 05 86 00 00 00 06 34 00 00 00 04 01 07 00 00 00 00 72 03 00 00
13:30:57 [DEBUG] Frame header: version=V3, data_length=53, header_size=4
13:30:57 [DEBUG] V3 HMAC verified
13:30:57 [DEBUG] Response data (20 bytes): 32 00 00 05 86 00 00 00 06 34 00 00 00 04 01 07 00 00 00 00
13:30:57 [DEBUG] Response header: opcode=0x32 function=0x0586 seq=6 transport=0x34
13:30:57 [DEBUG] Response IntegrityId: 0 (1 bytes)
13:30:57 [DEBUG] Response payload (9 bytes): 00 00 04 01 07 00 00 00 00
13:30:57 [DEBUG] Trailer (4 bytes): 72 03 00 00
[2026-09-11 13:30:57]
[-] Error occurred: RuntimeError: Read failed: PLC returned error for item
13:30:57 [INFO] Disconnected from 10.0.1.102:102
13:30:57 [INFO] Disconnected from PLC.

This is after 881 update.