From Roland Knall:

Two changes for openSAFETY over Modbus/TCP:

1. Changing the default preference for Big Endian encoding from TRUE to FALSE
2. Changing the position in the tree for the dissection to the top-level,
therefore, the openSAFETY entries no longer will show up as children of the
Modbus entry. This is the same behaviour as the other variants for openSAFETY
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6038

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@37739 f5534014-38df-0310-8fa8-9805f1628bb7

1 files changed, 5 insertions, 2 deletions

diff --git a/epan/dissectors/packet-opensafety.c b/epan/dissectors/packet-opensafety.c
index 3983d8db69..e12983ea47 100644
--- a/epan/dissectors/packet-opensafety.c
+++ b/epan/dissectors/packet-opensafety.c
@@ -357,7 +357,7 @@ static int hf_oss_spdo_time_request_to    = -1;
 static int hf_oss_spdo_time_request_from  = -1;
 
 static const char *global_scm_udid = "00:00:00:00:00:00";
-static gboolean global_mbtcp_big_endian = TRUE;
+static gboolean global_mbtcp_big_endian = FALSE;
 static guint global_network_udp_port = UDP_PORT_OPENSAFETY;
 static guint global_network_udp_port_sercosiii = UDP_PORT_SIII;
 
@@ -1625,7 +1625,10 @@ dissect_opensafety_mbtcp(tvbuff_t *message_tvb , packet_info *pinfo , proto_tree
             /* Only engage, if we are not called strictly for the overview */
             if ( tree )
             {
-                if ( dissect_opensafety_frame(next_tvb, pinfo, tree, FALSE, found ) == TRUE )
+            	/* When Modbus/TCP get's dissected, openSAFETY would be sorted as a child protocol. Although,
+            	 * this behaviour is technically correct, it differs from other implemented IEM protocol handlers.
+            	 * Therefore, the openSAFETY frame get's put one up, if the parent is not NULL */
+                if ( dissect_opensafety_frame(next_tvb, pinfo, ( tree->parent != NULL ? tree->parent : tree ), FALSE, found ) == TRUE )
                     packageCounter++;
             }
             handled = TRUE;