This is our old Q&A Site. Please post any new questions and answers at

Wireshark gives me a "malformed packet" message every time my DNP 3 responses are larger that a single frame. I am analyzing DNP over serial. I am trying to determine the setting that will allow decoding of greater that 255 byte packets, but am not having any luck. Any ideas?

asked 28 Jun '17, 15:59

Kurt's gravatar image

accept rate: 0%

Can you share a capture in a publicly accessible spot, e.g. CloudShark, Google Drive, DropBox etc?

(28 Jun '17, 21:25) grahamb ♦

That's not really necessary. I simply need to know how to set Wireshark to decide more than one frame of serial data. I figured it out with ASE2000, I just need help with Wireshark.

(06 Jul '17, 21:10) Kurt

As the DNP3 dissector successfully reassembles DNP3 traffic over both TCP and UDP, I suspect that the fact that your capture is "serial" may be the issue, hence the need to see the capture.

How exactly did you make the capture file?

(07 Jul '17, 02:58) grahamb ♦

Go Edit -> Preferences -> Protocols -> DNP 3.0 or right-click the DNP layer in the packet dissection pane. There is a single preference - Reassemble DNP3 messages spanning multiple TCP segments which is, however, on by default. If it is on and the problem persists, something is wrong with the trace contents or with the dissector, that's why @grahamb asked you to share the trace.

permanent link

answered 07 Jul '17, 00:11

sindy's gravatar image

accept rate: 24%

I haven't used this service before. I posted a capture on Cloudshark as requested

(11 Jul '17, 12:50) Kurt

Can you provide a link to it?

(11 Jul '17, 12:51) sindy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 28 Jun '17, 15:59

question was seen: 1,011 times

last updated: 11 Jul '17, 12:51

p​o​w​e​r​e​d by O​S​Q​A