Safety: use a test network or the mirror port of a test switch. dumpcap only listens; nothing is sent to the network.
State: modelled. Run only with dumpcap 4.2.2 on Linux, on frames injected into a virtual link: frames came back byte for byte, other frames were filtered out, and the streams and happenings equalled the analysis of the sent file. Never run on a station bus, a mirror port, with a real relay or merging unit, on macOS or on Windows. The decoder is the one of GOOSE and Sampled Values captures.
Before you start
- Install Wireshark. The module drives its
dumpcap(ortshark) as a separate process; it never installs a driver or ships capture code. - Set
neuralInverse.energy.paths.dumpcapto the program or its folder, or leave it empty: the module then looks on PATH, then in Wireshark's install folder (%ProgramFiles%\Wiresharkon Windows, the application bundle on macOS,/usr/bin,/usr/sbinand/usr/local/binelsewhere). - You need the right to capture: on Debian and Ubuntu, membership of the wireshark group; on Windows, Npcap, which IT installs with administrator rights.
Watch live
- Run Open Live GOOSE and Sampled Values Monitor. It shows the dumpcap version and path, and the interfaces with their addresses; the first interface that is not loopback is chosen.
- Choose the interface on the station switch's mirror port and press Start (or run Start Live GOOSE and Sampled Values Capture...). A status bar item counts frames, for example
GOOSE/SV enveth1: 0 frames, and turns to the warning colour with a count when something needs attention; a click opens the monitor. The command line shows under the state. - As it happens lists, newest first: new streams, state changes with the values that changed, messages later than
timeAllowedtoLive, sqNum and smpCnt gaps, values changed without a new stNum, frames that could not be read, and a GOOSE publisher silent for longer than itstimeAllowedtoLiveby the clock now. - Below are the streams table, the stream details and, when you choose a file under Check against station file, the check against its control blocks. The page updates twice a second.
- Press Stop (or run Stop Live GOOSE and Sampled Values Capture), then Save Live Capture As... to write what was captured as
.pcapng. The saved file opens in the capture editor with the same streams.
The capture stops by itself at 1 GB, and when the Energy environment is turned off. The capture filter takes Ethertypes 0x88B8 and 0x88BA, untagged and behind one or two VLAN tags.
When capture fails
A failure is said in plain words, with dumpcap's own message in parentheses:
| Message | What to do |
|---|---|
| "Your account may not capture on ..." | Ask IT for capture rights: the wireshark group or setcap on Linux; Npcap with capture allowed for non-administrators on Windows |
| Npcap missing | Ask IT to install Npcap |
| dumpcap not found | Install Wireshark, or set neuralInverse.energy.paths.dumpcap |
| An interface gone, or a refused filter | Choose the interface again |
| Nothing shows | Choose the interface on the mirror port, not the default one |
Limits
- Sustained rates (two merging units at 4000 samples per second for hours) and drops under load are not measured.
- The monitor redraws the whole page twice a second; this is not measured on a large station.
Not verified
- A station bus, a mirror port, a real relay or merging unit, a hardware time-stamping capture card.
- macOS and Windows: Npcap, the Program Files lookup, Windows interface names and the stop. The Windows and macOS messages are classified from the words Wireshark uses, not from a run.