Energy

GOOSE and Sampled Values captures

Open a pcap or pcapng capture, see every GOOSE and Sampled Values stream with its states, gaps and late messages, and check each stream against its control block in a station file.

State: modelled. The decoder is checked frame by frame against tshark 4.2.2 on three captures of an IEC 61850 testbed (8,124 frames), with every compared field equal. Those captures are of simulated publishers: no capture from a real relay, merging unit or station switch has been read.

The decoder is the module's own and needs no capture driver: it reads capture files you already have.

Open a capture

Open a .pcap or .pcapng file with Reopen Editor With... > GOOSE and Sampled Values Capture, or run Open GOOSE and Sampled Values Capture and pick it. The editor follows the file on disk.

Read: pcap in both byte orders with microsecond or nanosecond time stamps, and pcapng with each interface's time resolution and several sections. Only Ethernet frames are decoded; frames of other link types are counted and reported. GOOSE (Ethertype 0x88B8) and Sampled Values (0x88BA) are decoded behind any 802.1Q tags, with every PDU field and every data type (boolean, bit string, integers, 32- and 64-bit float, strings, UtcTime with its quality, binary time, BCD, structures and arrays). A frame that cannot be decoded names the byte offset of the fault.

Streams

The streams table lists every stream (source, destination, APPID, VLAN) with its statistics. Pick a stream with a click or the keys to see:

its messages, and each stNum change with the values that changed and its repetition intervals;
states not captured and publisher restarts;
sqNum gaps and repeated messages;
values that changed without a new stNum;
messages later than the previous timeAllowedtoLive;
a publisher silent at the end of the capture;
simulation and test flags;
for Sampled Values, smpCnt gaps and wrap, and the measured rate.

The time stamps are the capturing device's, so intervals and late messages are as accurate as it is.

Check against a station file

Choose a station file of the workspace. Each stream is matched to its GOOSE or Sampled Values control block by gocbRef or svID, else by APPID and MAC address, and compared on APPID, MAC address, VLAN and priority, data set, goID, confRev and (for GOOSE) the number of data set entries. Streams no control block explains, and control blocks that sent nothing, are reported. A finding opens the control block in the file.

Try it: a sample capture of P1's gcb01 shows 10 messages, one state change (TRIP false to true at 2.5 s with the fast retransmissions after it), one sqNum gap, two messages later than the 2000 ms time allowed to live, and position bits changing without a new stNum. Checked against the station file, gcb01 is matched and a second stream from APPID 0009 is reported as sent by no control block of the station.

Size

200,000 generated frames (27 MB, 40 GOOSE publishers and 2 merging units at 4000 samples per second) are read and analysed in about 1 to 1.3 s. Captures over 512 MB are refused, and analysis runs on the window's main thread.

Limits

The Sampled Values data set member count is not compared, and seqData is shown as bytes, not values.
IEC 61850-90-5 routed GOOSE and Sampled Values, GSE management, and PRP or HSR trailers are not decoded.
The capture editor has no export; the live monitor saves its capture as pcapng.

Not verified

Captures from real relays, merging units or switches: frames with several ASDUs, merging units at 4000 or 4800 samples per second, VLAN tags and classic pcap files from the field.
Bit strings and data values after the first bit string have no second decoder to compare with (tshark 4.2.2 stops there).
The station file check on a real SCD; Windows.

Last reviewed 18 October 2026View as Markdown