I have created some pcap files using DTL_USER ID=147. These files contain either serial "Modbus RTU" data or serial "DNP3" data. Note that this is just raw application data. I can open the Modbus.pcap file in Wireshark and use protocol preferences/Encapsulation table to add a User0 (DLT=147) with a payload protocol of mbrtu to decode the modbus messages. All good!
When I open the dnp3.pcap file I cant apply dnp3 as a payload protocol as it says dissector not found.
Is there a way to apply the DNP3 dissector to the raw DNP3 application data in the file without having to add a link layer (say dummy IP layer) to each message in the pcap file?
Thanks
