Some Hints on the use of Wireshark for IEC 61850-8-1 (MMS)

Please note the following preferences ... and have fun:

Version I used today:

Set the mms filter so see mms/IEC61850 only:

In case the MMS server is using a different port number: e.g., 12001 instead of standard port 102:

Analyze/Decode/ set other port number accordingly:

Check if presentation users context is correct:

Analyzing MMS/ASN.1/BER is sometimes tricky ... here is an example I figured out the other day ... if the length of a value is three (3) octets then the ASN.1 BER encoded message should indicate a length of 3 ... not 2 ... one single error in the length could damage the communication ...