This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

BACnet messages on UDP ports other than 47808, can they be decoded?

0

We have BACnet system configured using ports 47811. While using wireshark for analysis, we found BACnet messages on port 47811 is not recognized.

asked 22 Jul '13, 04:39

RP_1985's gravatar image

RP_1985
6112
accept rate: 0%

edited 22 Jul '13, 06:04

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142


2 Answers:

3

Jasper is close, but the packets have to be UDP, and then you can select the BVLC (BACNet Virtual Link Control) protocol.

BVLC also has preferences for additional UDP ports, so you can add another port there so you don't need to "Decode As" for each new capture.

answered 22 Jul '13, 05:22

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

I tried it on TCP and UDP, but didn't know about it being called "BVLC" :)

(22 Jul '13, 06:10) Jasper ♦♦

I had to look at the code to find out.

(22 Jul '13, 06:12) grahamb ♦

Thanks, grahamb,,,that's right...

(23 Jul '13, 21:59) RP_1985

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(23 Jul '13, 23:18) grahamb ♦

0

Usually I'd say you should try to use the popup menu on a packet that is not recognized and use the "Decode As" option to tell Wireshark how to decode the packet. But when I tested this I haven't seen anything called "BACnet", and it isn't listed in the protocol section of the preferences either. Maybe you can spot the correct protocol name though, in case it is not exactly called "BACnet".

Other than that it is possible that Wireshark does not decode your protocol at all, or have you seen it work on other ports?

answered 22 Jul '13, 05:08

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 22 Jul '13, 05:09