Detailed Expert Information for Goose Packet

goose
retag add tags

Hi, my team wants to show detailed expert information for Goose packet (IEC61850). The current wireshark shows:

[Malformed Packet: GOOSE]

  [Expert Info (Error/Malformed): Malformed Packet (Exception occurred)]

    [Malformed Packet (Exception Occurred)]

    [Severity level: Error]

    [Group: Malformed]

We want to show the detailed information for the malformed part, for example:

the numDatSetEntries's length is 0 in our malformed packet. According to the Goose protocol, the length should be 1. We want to show that this packet is malformed because of the "numDatSetEntries" field. And ideally also show the reason for it.

I have struggled a lot reading the code about the asn1 dissector, any hint for doing this, or is it possible with existing function?

Thanks for reading my question!

asked 2022-03-11 00:05:40 +0000

edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

2 Answers

Sort by

oldest

newest

most voted

Do you need to do this in the expert code? My first instinct would be a coloring rule showing this particular issue. That should be easy to accomplish.

hugo.vanderkooij

answered 2022-03-11 07:26:19 +0000

edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Hi, As goose is a dissector generated from the asn1 description you will have to add code on the .cnf file. If you can shar a pcap with the packet in a bug report we could do a fix. Otherwise you would have to do something like.

#.FN_BODY numDatSetEntries VAL_PTR= &num_dataset_entries
gint num_dataset_entries=0;

%(DEFAULT_BODY)s
if(num_dataset_entries == 0){
   "Add expert info here"
}

Anders

answered 2022-03-11 07:31:23 +0000, updated 2022-03-11 07:31:53 +0000

edit flag offensive 0 remove flag delete link

Comments

thanks for the reply, do you mean I have to submit the report to wireshark's gitlab repo?

Ke (2022-03-11 10:57:49 +0000) edit

If you want to report it as an issue/enhancment request https://gitlab.com/wireshark/wireshar...

Anders (2022-03-11 12:42:46 +0000) edit

thanks for the info, I have added the issue

Ke (2022-03-24 23:48:37 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer

Detailed Expert Information for Goose Packet edit

Comments

2 Answers

Comments

Comments