This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

We have BACnet system configured using ports 47811. While using wireshark for analysis, we found BACnet messages on port 47811 is not recognized.

asked 22 Jul '13, 04:39

RP_1985's gravatar image

RP_1985
6112
accept rate: 0%

edited 22 Jul '13, 06:04

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142


Jasper is close, but the packets have to be UDP, and then you can select the BVLC (BACNet Virtual Link Control) protocol.

BVLC also has preferences for additional UDP ports, so you can add another port there so you don't need to "Decode As" for each new capture.

permanent link

answered 22 Jul '13, 05:22

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

I tried it on TCP and UDP, but didn't know about it being called "BVLC" :)

(22 Jul '13, 06:10) Jasper ♦♦

I had to look at the code to find out.

(22 Jul '13, 06:12) grahamb ♦

Thanks, grahamb,,,that's right...

(23 Jul '13, 21:59) RP_1985

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(23 Jul '13, 23:18) grahamb ♦

Usually I'd say you should try to use the popup menu on a packet that is not recognized and use the "Decode As" option to tell Wireshark how to decode the packet. But when I tested this I haven't seen anything called "BACnet", and it isn't listed in the protocol section of the preferences either. Maybe you can spot the correct protocol name though, in case it is not exactly called "BACnet".

Other than that it is possible that Wireshark does not decode your protocol at all, or have you seen it work on other ports?

permanent link

answered 22 Jul '13, 05:08

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 22 Jul '13, 05:09

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×166
×19
×6

question asked: 22 Jul '13, 04:39

question was seen: 5,302 times

last updated: 10 Mar '15, 14:22

p​o​w​e​r​e​d by O​S​Q​A