I am only seeing BACnet traffice on Port 47808, how do I see BACnet traffic on Ports 47809, 47810, 47811 and 47812?

asked 2020-01-27 20:19:01 +0000

Laswell
1 ●1 ●1

updated 2020-01-27 21:51:31 +0000

Guy Harris
19890 ●3 ●660 ●207

I have a system with 5 BACnet IP to MSTP routers and am trying to identify my communication issues. Wireshark only seems to be picking up traffic on port 47808, but the other four routers are not getting picked up. Any assistance would be helpful.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2023-03-04 00:36:48 +0000

DennisVM-D2i
1

From my own terse notes:

Apply dissector for non-standard/different port # - e.g. for WebSocket (or BACnet/IP)

Right click on grid column

Right click "Source Port" field, click "Decode as", change "Current" DDL to the relevant protocol/dissector, "OK" for temporary or "Save" for permanent.

To add one: Select "TCP Port" in "Field", set the port # in "Value", set the relevant protocol/dissector within the "Current" DDL.

edit flag offensive delete link

add a comment

answered 2020-01-27 21:37:17 +0000

Chuckc
3023 ●6 ●612 ●20

updated 2020-01-27 21:37:40 +0000

Analyze -> Decode As...

Add rules to decode the non-standard UDP ports as BVLC.
The wiki https://wiki.wireshark.org/Protocols/... mentions non-default ports but probably could use a reference to Decode As...
https://www.wireshark.org/docs/wsug_h...

edit flag offensive delete link

Comments

I.e., "Wireshark isn't picking up traffic for protocol X on ports Y, Z, and W" or "I'm not seeing traffic for protocol X on ports Y, Z, and W" usually means "Wireshark is picking up traffic on ports Y, Z, and W, but it's not recognizing it as protocol X". Sometimes that means you have to tell Wireshark that the traffic on those ports is also protocol X traffic, in the fashion that bubbasnmp says.

Guy Harris ( 2020-01-27 21:51:18 +0000 )edit

add a comment