Ask Your Question


asked 2018-07-19 12:10:00 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.


I do not have CEI 61850 GOOSE into the list of Expression filters. I have GOOSE filter
Because I try to capture Goose message but it does not appear. It seems that misses "CEI 61850 Goose", is it possible to download it?

Thanks, Abasse

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-07-19 12:25:12 +0000

grahamb gravatar image

Goose is part of IEC 61850 which includes a lot more besides GOOSE.

Use goose in your display filters if you do have GOOSE traffic.

edit flag offensive delete link more


Thanks a lot for your fast reply.

Actually I already tried "goose" but it did not work. I found this demo in youtube where the user had filtered with "CEI61850 GOOSE" and it works. That is why I checked into expressions list and I have "GOOSE" but not "CEI61850 GOOSE " like him. Here is the link of the video :

Technicaltim gravatar imageTechnicaltim ( 2018-07-19 12:53:07 +0000 )edit

That video shows an old version of Wireshark (1.99) that was custom built (SkunkWorksIEC61850), so who knows what dissector they were using. The current version (2.6.2) uses goose, not iecgoose.

What version of Wireshark are you using?

grahamb gravatar imagegrahamb ( 2018-07-19 13:04:35 +0000 )edit

OK I use 2.4.2 but after your comment I am installing 2.6.2 right now and I will repeat the test

Technicaltim gravatar imageTechnicaltim ( 2018-07-19 13:13:45 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2018-07-19 12:10:00 +0000

Seen: 34 times

Last updated: Jul 19