This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I am working a product which supports IEC-61850 GOOSE protocol. I am using Wireshark for Packet analysis.

According to similar question on forum: here http://ask.wireshark.org/questions/18597/goose-why-display-floating-point-in-hex

I found that, Wireshark displays Float values as Hex becuase, " FloatingPoint ::= OCTET STRING as it's defined as OCTET STRING it will be displayed in hex.". The authour has suggested to "One could pssibly redifine the field in the .cnf file to FT_FLOAT but as there is no size constraint the OCTET STRING can be of arbitarry length.".

I tried to figure how can I display Float value as floating value instread of HEX, but I could not find the solution for this. Please helm me.

Best Regards, Dhaval

asked 15 May '13, 23:11

d2v0's gravatar image

d2v0
11112
accept rate: 0%


If this is true: http://tissues.iec61850.com/tissue.mspx?issueid=817 Final Proposal: Change Table A.2: Encoding allData in Fixed-length GOOSE Message. Basic Data Type Float 32 ASN.1 Tag 0x87 ASN.1 Len = 5 Comment: MMS Data Production: first byte=8, remaining 4 bytes represents the floating point number in IEEE 754 single precision format.

Add someting like this to the .cnf file

#.FN_BODY FloatingPoint VAL_PTR= &parameter_tvb
tvbuff_t    *parameter_tvb;
int length;

%(DEFAULT_BODY)s

 if (!parameter_tvb)
    return offset;

 length = tvb_length(parameter_tvb);
 if(length!=5)
    return offset;
 if(tvb_get_guint8(parameter_tvb,0) != 8)
    return offset;

 proto_tree_add_item(tree, hf_goose_foo, parameter_tvb, 1, 4, ENC_BIG_ENDIAN);

and add the hf_ variable to the template file with FT_FLOAT or something along those lines. run make goose in the asn1 folder and then recompile Wireshark.

permanent link

answered 16 May '13, 09:10

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%

edited 17 May '13, 03:01

grahamb's gravatar image

grahamb ♦
19.8k330206

@anders Thanks. I will try your answer.

(17 May '13, 02:39) d2v0

Hi, If you get it to work please open a bug report and attach a sample pcap if possible and add your patch to the bug report for inclution into Wireshark. As of now we have no way of verifying the correctnes of any float data patch.

(17 May '13, 03:37) Anders ♦

Including one or more captures that contain the values in question with the patch would also be very helpful.

(17 May '13, 04:23) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×10
×5

question asked: 15 May '13, 23:11

question was seen: 2,923 times

last updated: 17 May '13, 04:23

p​o​w​e​r​e​d by O​S​Q​A