---
title: "Live GOOSE and Sampled Values monitor"
---

# Live GOOSE and Sampled Values monitor

Watch GOOSE and Sampled Values on the station network as they happen, through your installed Wireshark dumpcap, check streams against a station file, and save the capture.

**Safety:** use a test network or the mirror port of a test switch. dumpcap only listens; nothing is sent to the network.

**State:** modelled. Run only with dumpcap 4.2.2 on Linux, on frames injected into a virtual link: frames came back byte for byte, other frames were filtered out, and the streams and happenings equalled the analysis of the sent file. **Never run on a station bus, a mirror port, with a real relay or merging unit, on macOS or on Windows.** The decoder is the one of [GOOSE and Sampled Values captures](https://neuralinverse.com/docs/modules/energy/goose-sv-captures/).

## Before you start

- Install Wireshark. The module drives its `dumpcap` (or `tshark`) as a separate process; it never installs a driver or ships capture code.
- Set `neuralInverse.energy.paths.dumpcap` to the program or its folder, or leave it empty: the module then looks on PATH, then in Wireshark's install folder (`%ProgramFiles%\Wireshark` on Windows, the application bundle on macOS, `/usr/bin`, `/usr/sbin` and `/usr/local/bin` elsewhere).
- You need the right to capture: on Debian and Ubuntu, membership of the wireshark group; on Windows, Npcap, which IT installs with administrator rights.

## Watch live

1. Run **Open Live GOOSE and Sampled Values Monitor**. It shows the dumpcap version and path, and the interfaces with their addresses; the first interface that is not loopback is chosen.
2. Choose the interface on the station switch's mirror port and press **Start** (or run **Start Live GOOSE and Sampled Values Capture...**). A status bar item counts frames, for example `GOOSE/SV enveth1: 0 frames`, and turns to the warning colour with a count when something needs attention; a click opens the monitor. The command line shows under the state.
3. **As it happens** lists, newest first: new streams, state changes with the values that changed, messages later than `timeAllowedtoLive`, sqNum and smpCnt gaps, values changed without a new stNum, frames that could not be read, and a GOOSE publisher silent for longer than its `timeAllowedtoLive` by the clock now.
4. Below are the streams table, the stream details and, when you choose a file under **Check against station file**, the check against its control blocks. The page updates twice a second.
5. Press **Stop** (or run **Stop Live GOOSE and Sampled Values Capture**), then **Save Live Capture As...** to write what was captured as `.pcapng`. The saved file opens in the capture editor with the same streams.

The capture stops by itself at 1 GB, and when the Energy environment is turned off. The capture filter takes Ethertypes 0x88B8 and 0x88BA, untagged and behind one or two VLAN tags.

## When capture fails

A failure is said in plain words, with dumpcap's own message in parentheses:

| Message | What to do |
|---|---|
| "Your account may not capture on ..." | Ask IT for capture rights: the wireshark group or setcap on Linux; Npcap with capture allowed for non-administrators on Windows |
| Npcap missing | Ask IT to install Npcap |
| dumpcap not found | Install Wireshark, or set `neuralInverse.energy.paths.dumpcap` |
| An interface gone, or a refused filter | Choose the interface again |
| Nothing shows | Choose the interface on the mirror port, not the default one |

## Limits

- Sustained rates (two merging units at 4000 samples per second for hours) and drops under load are not measured.
- The monitor redraws the whole page twice a second; this is not measured on a large station.

## Not verified

- A station bus, a mirror port, a real relay or merging unit, a hardware time-stamping capture card.
- macOS and Windows: Npcap, the Program Files lookup, Windows interface names and the stop. The Windows and macOS messages are classified from the words Wireshark uses, not from a run.