iec61850 filtering in wireshark

Hi, I would like to know how can i filter IEC61850 frames from a wireshark capture file Thanks, Mukesh

edit retag close merge delete

Sort by » oldest newest most voted

There is a wiki page for IEC 61850 GOOSE/GSE (GOOSE/GSE) with a sample capture.

At a protocol level, there are dissectors for GOOSE and SV so a display filter of goose or sv to get both.

There are three Ethernet Type defined in etypes.h:

#define ETHERTYPE_IEC61850_GOOSE    0x88B8  /* IEC 61850 is a global standard for the use in utility communication,*/

#define ETHERTYPE_IEC61850_GSE      0x88B9  /* IEC 61850 is a global standard for the use in utility communication,*/

#define ETHERTYPE_IEC61850_SV       0x88BA  /* IEC 61850 is a global standard for the use in utility communication,*/


A display filter of eth.type in { 0x88b8 0x88b9 0x88ba } for all three or pick appropriate eth.type based on your captures.

more

HI Chuckc,

thank you very much for the prompt response, I would like also to know about filtering of mms messages in IEC61850. when i type mms, display are filter comes as green but , there is not messages down the list. But I'm sure that the capture contains IEC61850 traffic between a client and server.

So what is the correct syntax for display filter for mms messages. if any other settings to be done, please advise that too.

Thanks, Mukesh

( 2021-05-31 19:21:30 +0000 )edit

There is a sample pcap on the MMS Wiki page.
If you download and open it, does the mms filter return a list of packets?

( 2021-05-31 20:16:50 +0000 )edit

No, it does not. Note that I have also tried to use the "Decode As" option for tcp.port == 102, but MMS (or Pres) is not available...

( 2021-11-03 16:54:55 +0000 )edit

@eric-pierre, the sample capture and filter works for me, no "Decode As .." required as the default TKPT tcp port preference of 102 is correct, what version of Wireshark are you using?

( 2021-11-03 17:53:54 +0000 )edit

I am using 3.4.9-0. I have tried to edit my note because it was not working on the first attempt. Then I have changed the TPKT port to 103 first then back to 102 it works with sample capture. I am checking now why it is working with the sample and not with my own capture file.

( 2021-11-03 18:56:47 +0000 )edit

If you can see the packet dissected as protocol you can use almost any line in the "Packets Details"pane and use right click to add filtering. That is in most cases by far the easiest way to do specific filtering.

more