Ask Your Question

Detailed Expert Information for Goose Packet

asked 2022-03-11 00:05:40 +0000

Ke gravatar image

Hi, my team wants to show detailed expert information for Goose packet (IEC61850). The current wireshark shows:

[Malformed Packet: GOOSE]

  [Expert Info (Error/Malformed): Malformed Packet (Exception occurred)]

    [Malformed Packet (Exception Occurred)]

    [Severity level: Error]

    [Group: Malformed]

We want to show the detailed information for the malformed part, for example:

the numDatSetEntries's length is 0 in our malformed packet. According to the Goose protocol, the length should be 1. We want to show that this packet is malformed because of the "numDatSetEntries" field. And ideally also show the reason for it.

I have struggled a lot reading the code about the asn1 dissector, any hint for doing this, or is it possible with existing function?

Thanks for reading my question!

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2022-03-11 07:31:23 +0000

Anders gravatar image

updated 2022-03-11 07:31:53 +0000

Hi, As goose is a dissector generated from the asn1 description you will have to add code on the .cnf file. If you can shar a pcap with the packet in a bug report we could do a fix. Otherwise you would have to do something like.

#.FN_BODY numDatSetEntries VAL_PTR= &num_dataset_entries
gint num_dataset_entries=0;

if(num_dataset_entries == 0){
   "Add expert info here"
edit flag offensive delete link more


thanks for the reply, do you mean I have to submit the report to wireshark's gitlab repo?

Ke gravatar imageKe ( 2022-03-11 10:57:49 +0000 )edit

If you want to report it as an issue/enhancment request

Anders gravatar imageAnders ( 2022-03-11 12:42:46 +0000 )edit

thanks for the info, I have added the issue

Ke gravatar imageKe ( 2022-03-24 23:48:37 +0000 )edit

answered 2022-03-11 07:26:19 +0000

hugo.vanderkooij gravatar image

Do you need to do this in the expert code? My first instinct would be a coloring rule showing this particular issue. That should be easy to accomplish.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools



Asked: 2022-03-11 00:05:40 +0000

Seen: 578 times

Last updated: Mar 11 '22