ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Introduction and first questions/suggestions

From: Simon Ginsburg <simon.ginsburg@xxxxxxxxxxx>
Date: Wed, 4 Apr 2007 14:20:59 +0200
Hello,

since I signed up this list just recently, I take the opportunity to introduce myself. My full name is Dr. Simon Ginsburg and I'm Product Manager for communication protocols/products for the company Saia- Burgess Controls Ltd in Switzerland. This is the company, where my college Christian Durrer has already written a dissector included in Wireshark for our proprietary field bus called "S-Bus".

One of my main fields of activity currently is the implementation of the BACnet protocol into our PLC (Programmable Logic Controllers). For testing, training, support and training purposes I frequently use Wireshark and also tell our customers with technical problems in the field to send my not only their project but also trace logs usually taken with Wireshark.

During recent support call treatments I discovered some fields of improvements. Before I adding them to the long list of whishes or in the Wikipedia, I wanted to check that I have not overlooked something.

Wishlist:

Either under Chapter "GUI" or "Dissection":
When a protocol is used on another port than Wireshark expects it to be (such as BACnet on UDP port 48560) the context sensitive menu Item "Decode as..." is GREAT, but finding what I need is not so great since only an abreviation (in above example BVLC) can be selected without any way of help. I suggest a tooltip when hovering over a selected protocol item with the same content as in help --> Supported Protocols (in above example BVLC: BACnet Virtual Link Control).

Dissector specific
Item 19. What's the reason, the APDU part of BACnet/IP is not dissected? Is it just the workload (for which a solution can be found) or there a technical reason such as variable length, the BACnet specific solution of segmenting or other?

Wikipedia:
BACnet is not easy to find. IMHO it's also a member of the "FieldbusProtocolFamily" as is LON and EIB, the first using "IP-852", the latter EIBnet/IP for the transport over IP. Is it OK that I extend the Wiki pages accordingly?

Sincerely
Simon