Ask Your Question

iec61850 filtering in wireshark

asked 2021-05-31 12:32:36 +0000

Muk@123 gravatar image

Hi, I would like to know how can i filter IEC61850 frames from a wireshark capture file Thanks, Mukesh

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2021-05-31 15:42:38 +0000

Chuckc gravatar image

updated 2021-05-31 15:52:19 +0000

There is a wiki page for IEC 61850 GOOSE/GSE (GOOSE/GSE) with a sample capture.

At a protocol level, there are dissectors for GOOSE and SV so a display filter of goose or sv to get both.

There are three Ethernet Type defined in etypes.h:

#define ETHERTYPE_IEC61850_GOOSE    0x88B8  /* IEC 61850 is a global standard for the use in utility communication,*/

#define ETHERTYPE_IEC61850_GSE      0x88B9  /* IEC 61850 is a global standard for the use in utility communication,*/

#define ETHERTYPE_IEC61850_SV       0x88BA  /* IEC 61850 is a global standard for the use in utility communication,*/

A display filter of eth.type in { 0x88b8 0x88b9 0x88ba } for all three or pick appropriate eth.type based on your captures.

edit flag offensive delete link more


HI Chuckc,

thank you very much for the prompt response, I would like also to know about filtering of mms messages in IEC61850. when i type mms, display are filter comes as green but , there is not messages down the list. But I'm sure that the capture contains IEC61850 traffic between a client and server.

So what is the correct syntax for display filter for mms messages. if any other settings to be done, please advise that too.

Thanks, Mukesh

Muk@123 gravatar imageMuk@123 ( 2021-05-31 19:21:30 +0000 )edit

There is a sample pcap on the MMS Wiki page.
If you download and open it, does the mms filter return a list of packets?

Chuckc gravatar imageChuckc ( 2021-05-31 20:16:50 +0000 )edit

No, it does not. Note that I have also tried to use the "Decode As" option for tcp.port == 102, but MMS (or Pres) is not available...

eric-pierre gravatar imageeric-pierre ( 2021-11-03 16:54:55 +0000 )edit

@eric-pierre, the sample capture and filter works for me, no "Decode As .." required as the default TKPT tcp port preference of 102 is correct, what version of Wireshark are you using?

grahamb gravatar imagegrahamb ( 2021-11-03 17:53:54 +0000 )edit

I am using 3.4.9-0. I have tried to edit my note because it was not working on the first attempt. Then I have changed the TPKT port to 103 first then back to 102 it works with sample capture. I am checking now why it is working with the sample and not with my own capture file.

eric-pierre gravatar imageeric-pierre ( 2021-11-03 18:56:47 +0000 )edit

answered 2021-05-31 13:29:29 +0000

hugo.vanderkooij gravatar image

If you can see the packet dissected as protocol you can use almost any line in the "Packets Details"pane and use right click to add filtering. That is in most cases by far the easiest way to do specific filtering.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-05-31 12:32:36 +0000

Seen: 4,397 times

Last updated: May 31 '21