Wiresharking IEC: Difference between revisions

Revision as of 16:45, 4 March 2015

Some basic filters for analysing wireshark logs in case of IEC protocols

Filter information object address 401

 104asdu.ioa == 401

Dispaly packages with TCP length>0 (no ack messages)

tcp.len>0

Display packets involving 192.168.0.111

ip.addr==192.168.0.111

Display packets involving TCP port 2404

tcp.port==2404

Show spontaneous events (COT==3)

104asdu.causetx == 3

Show packets containing activation, activation confirmation and activation termination messages (COT 6, 7, 10)

104asdu.causetx == 6 || 104asdu.causetx == 7 || 104asdu.causetx == 10

MMS: Manufacturing Message Specification GOOSE: Generic Object Oriented Substation Events

Filter IEC61850 packets

mms

Display packets involving TCP port 102

tcp.port==102

Display messages containing domain ID "VampRelay"

mms.domainId == "VampRelay"

Display messages containing item ID "VI1GGIO137$CO$SPCSO$Oper" (VI1 control command)

mms.itemId == "VI1GGIO137$CO$SPCSO$Oper"

Display messages containing control commands (Service request 5 = write)

mms.confirmedServiceRequest == 5

Dispaly packets containing message "success" (response to command message)

mms.Write_Response_item == 1

@@ Line 9: / Line 9: @@
 Display packets involving TCP port 2404
 <pre>tcp.port==2404</pre>
-*Inrogen: GI
+Show spontaneous events (COT==3)
-*Spont: Spontaneous event
+<pre>104asdu.causetx == 3</pre>
+Show packets containing activation, activation confirmation and activation termination messages (COT 6, 7, 10)
+<pre>104asdu.causetx == 6 || 104asdu.causetx == 7 || 104asdu.causetx == 10</pre>
+*Inrogen: GI (COT 20...36 )
+*Spont: Spontaneous event (COT 3)
 *IOA: Information Object Address
-*Act: activation message (select/execute)
+*Act: activation message (select/execute) (COT 6)
-*ActCon: activation confirmation
+*ActCon: activation confirmation (COT 7)
-*ActTerm: activation termination
+*ActTerm: activation termination (COT 10)
 ==IEC61850==