GOOSE message processing method and device for Wreshark

Abstract

The embodiment of the invention provides a GOOSE message processing method and device for Wreshark, and the method comprises the steps: receiving an SCD file of an intelligent substation through a Lua plug-in in Wreshark software, and carrying out the analysis of the SCD file, and obtaining the configuration information of all devices in the intelligent substation; constructing a protocol tree based on a target protocol, and establishing an association relationship between the configuration information and each tree node in the protocol tree; receiving a GOOSE message through the Lua plug-in, and carrying out layer-by-layer analysis on the GOOSE message according to the hierarchical relationship of the protocol tree to obtain field information of a target field in the GOOSE message; and determining a target tree node corresponding to the target field according to the field information, reading target configuration information associated with the target tree node according to the association relationship, and determining and displaying semantic information corresponding to the target field based on the target configuration information.

Description

Technical Field

[0001] This specification relates to the field of intelligent substation technology in power systems, and in particular to a GOOSE message processing method for Wireshark. Background Technology

[0002] The smart grid is a crucial platform for implementing new energy strategies and optimizing energy resource allocation. It encompasses all aspects of power generation, transmission, transformation, distribution, consumption, and dispatch. It extensively utilizes advanced information and materials technologies to achieve large-scale integration and utilization of clean energy, improve energy efficiency, and ensure a safe, reliable, and high-quality power supply, meeting national strategic requirements and the needs of my country's economic and social development. Vigorously developing the smart grid technology industry and implementing major smart grid technology industrialization projects are of great significance for adjusting the energy structure, conserving energy and reducing emissions, and addressing climate change.

[0003] Digital substations are a crucial component of smart grids. They digitize signals from traditional substations and perform subsequent processing according to the IEC 61850 protocol, thereby enhancing the substation's intelligence. General object-oriented substation event GOOSE messages are control information within smart substations, reflecting the control status of the digital substation. Processing GOOSE messages is a major part of the smart substation system, facilitating timely fault detection and analysis of the operational status of relevant intelligent electronic equipment, identifying any false alarms, and providing data support for resolving hidden substation faults.

[0004] GOOSE messages contain large amounts of data, making their processing and reliable reporting of faults in digital substations crucial. Current methods for processing GOOSE messages often suffer from limited parsing depth and poor readability of the results. Therefore, an effective method is urgently needed to address these issues. Summary of the Invention

[0005] In view of this, embodiments of this specification provide a method for processing GOOSE messages for Wireshark. One or more embodiments of this specification also relate to a GOOSE message processing apparatus for Wireshark, a computing device, a computer-readable storage medium, and a computer program, to address the technical deficiencies existing in the prior art.

[0006] According to a first aspect of the embodiments of this specification, a method for processing GOOSE messages for Wireshark is provided, comprising: The SCD file of the smart substation is received by the Lua plugin in the Wireshark software, and the configuration information of each device in the smart substation is obtained by parsing the SCD file. A protocol tree is constructed based on the target protocol, and the association between the configuration information and each node in the protocol tree is established. The Lua plugin receives GOOSE messages and parses them layer by layer according to the hierarchical relationship of the protocol tree to obtain the field information of the target field in the GOOSE message. Based on the field information, determine the target tree node corresponding to the target field, read the target configuration information associated with the target tree node according to the association relationship, and determine and display the semantic information corresponding to the target field based on the target configuration information.

[0007] Optionally, parsing the SCD file to obtain the configuration information of each device in the smart substation includes: Extract the device identifiers of at least two smart electronic devices contained in the SCD file; Iterate through the logical devices and logical nodes under each device identifier to find the relevant general output control blocks and the datasets referenced by the general output control blocks; Each functional constraint data attribute within the dataset is parsed, and the path information, type information, and description information contained in the parsing results are recorded.

[0008] Optionally, the step of parsing the GOOSE message layer by layer according to the hierarchical relationship of the protocol tree to obtain the field information of the target field in the GOOSE message includes: The header of the GOOSE message is parsed according to the hierarchical relationship of the protocol tree to obtain the dataset identifier information corresponding to the dataset field in the GOOSE message; Read the corresponding output control block reference information based on the dataset identification information; Using the dataset identifier information and the output control block reference information as keywords, and based on the association relationship, we search for whether there is a corresponding key value; If not, the dataset identification information and the output control block reference information will be displayed in the parsing result display area of ​​the GOOSE message.

[0009] Optionally, the GOOSE message processing method for Wireshark further includes: If the execution result of the step of using the dataset identifier information and the output control block reference information as keywords and searching for the existence of corresponding key-value pairs based on the association relationship is yes, then the full dataset fields of the GOOSE message are parsed to obtain the corresponding parsing result.

[0010] Optionally, determining the target tree node corresponding to the target field based on the field information, and reading the target configuration information associated with the target tree node according to the association relationship, includes: Based on the output control block reference information, the corresponding target general output control block is determined, and the first target data node corresponding to the target general output control block is determined; Read the first target configuration information associated with the first target tree node according to the association relationship, and determine the first target configuration information as the configuration information of the target general output control block; The second target data node corresponding to the field of the full dataset is determined based on the parsing result of the full dataset field; According to the aforementioned association, read the second target configuration information associated with the second target tree node, and based on the second target configuration information, determine the path information, type information, and description information of each functional constraint attribute data in the full dataset.

[0011] Optionally, determining and displaying the semantic information corresponding to the target field based on the target configuration information includes: Based on the path information, type information, and description information, each functional constraint attribute data is parsed to obtain the data value corresponding to each functional constraint attribute data. The description information and the parsed data values ​​are used as semantic information for the corresponding fields in the GOOSE message. A final view is generated and displayed based on the semantic information and the parsing result of the GOOSE message.

[0012] According to a second aspect of the embodiments of this specification, a GOOSE message processing apparatus for Wireshark is provided, comprising: The first parsing module is configured to receive the SCD file of the smart substation through the Lua plugin in the Wireshark software, and parse the SCD file to obtain the configuration information of each device in the smart substation. The construction module is configured to build a protocol tree based on the target protocol and establish the association between the configuration information and each tree node in the protocol tree; The second parsing module is configured to receive GOOSE messages through the Lua plugin and parse the GOOSE messages layer by layer according to the hierarchical relationship of the protocol tree to obtain the field information of the target field in the GOOSE message. The display module is configured to determine the target tree node corresponding to the target field based on the field information, read the target configuration information associated with the target tree node according to the association relationship, determine the semantic information corresponding to the target field based on the target configuration information, and display it.

[0013] Optionally, the first parsing module is further configured to: Extract the device identifiers of at least two smart electronic devices contained in the SCD file; Iterate through the logical devices and logical nodes under each device identifier to find the relevant general output control blocks and the datasets referenced by the general output control blocks; Each functional constraint data attribute within the dataset is parsed, and the path information, type information, and description information contained in the parsing results are recorded.

[0014] According to a third aspect of the embodiments of this specification, a computing device is provided, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions: According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided that stores computer-executable instructions, which, when executed by a processor, implement the steps of any one of the GOOSE message processing methods for Wireshark.

[0015] According to a fifth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the GOOSE message processing method for Wireshark described above.

[0016] This embodiment of the specification uses a Lua plugin in Wireshark software to receive the SCD file of a smart substation and parses the SCD file to obtain the configuration information of each device in the smart substation; it constructs a protocol tree based on the target protocol and establishes the association relationship between the configuration information and each tree node in the protocol tree; it receives GOOSE messages through the Lua plugin and parses the GOOSE messages layer by layer according to the hierarchical relationship of the protocol tree to obtain the field information of the target field in the GOOSE message; it determines the target tree node corresponding to the target field based on the field information, reads the target configuration information associated with the target tree node according to the association relationship, and determines and displays the semantic information corresponding to the target field based on the target configuration information. By performing in-depth parsing of GOOSE messages, the specific data objects in the dataset are fully analyzed. By importing the SCD system configuration description file, semantic mapping between message fields and substation logic devices is achieved, significantly improving message readability. This allows users to intuitively identify key information in messages and quickly locate relevant anomalies without the need for additional auxiliary tools to deeply parse complex binary code streams. This helps shorten troubleshooting time, reduce losses caused by system downtime, and improve the reliability of smart substation operation. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating a GOOSE message processing method for Wireshark, provided in one embodiment of this specification. Figure 2 This is a schematic diagram illustrating a message parsing result provided in one embodiment of this specification; Figure 3 This is a flowchart illustrating the processing procedure of a GOOSE message processing method for Wireshark, provided in one embodiment of this specification. Figure 4 This is a schematic diagram of a GOOSE message processing plugin for Wireshark provided in one embodiment of this specification; Figure 5 This is a flowchart of an intelligent verification process provided in one embodiment of this specification; Figure 6 This is a schematic diagram of a GOOSE message processing device for Wireshark provided in one embodiment of this specification; Figure 7 This is a structural block diagram of a computing device provided in one embodiment of this specification. Detailed Implementation

[0018] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0019] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0020] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0021] The IEC 61850 standard is the core foundation of smart substations. It unifies the communication architecture and data model, enables seamless interoperability of equipment from different manufacturers, and replaces traditional, complex proprietary protocols.

[0022] The GOOSE protocol is a key component, serving as the "nervous system" for transmitting signals such as tripping and interlocking. It has three core characteristics: 1. Real-time multicast: Enables high-speed, direct horizontal communication between devices, replacing hard-wired connections.

[0023] 2. High reliability: Through retransmission mechanisms and network redundancy, critical signals are guaranteed to be completely safe.

[0024] 3. Complex encoding: Its messages use TLV (tag-length-value) encoding based on ASN.1 BER, which has a complex and rigorous structure and can efficiently and unambiguously encapsulate various types of data, which is the technical foundation for achieving reliable communication.

[0025] Wireshark is a leading global network protocol analysis tool. Its core function is to parse raw network packets into a readable protocol format.

[0026] Its core advantage lies in its open dissector extension mechanism: 1. Function: To write parsing plugins for private or new protocols, enabling decoding, hierarchical display, and field filtering.

[0027] 2. Development method: Lua scripts: fast and flexible, no compilation required, suitable for simple protocols and rapid development.

[0028] C language: High-performance processing of complex protocols, requires compilation, and has higher execution efficiency.

[0029] This mechanism allows developers to customize protocol parsing rules and continuously expand Wireshark's analytical capabilities.

[0030] The current GOOSE message parsing plugin has the following shortcomings: Limited parsing depth: Existing plugins may only be able to parse basic fields (such as AppID, gocbRef (used to identify the GOOSE control block itself), timeAllowedtoLive, etc.), and the parsing of specific data objects in the dataset (such as floating-point numbers, integers, and booleans) is incomplete, and only the raw hexadecimal data is presented, which has poor readability.

[0031] Lack of validity checks: It cannot automatically detect whether the message format conforms to the standard, whether the configuration version (confRev) is consistent, and whether the status number (stNum) and sequence number (sqNum) transitions are abnormal.

[0032] Weak visualization capabilities: Lacks real-time monitoring and graphical display of GOOSE message publishing rhythm (MinTime, MaxTime) and time-to-live (TimeAllowed to Live).

[0033] Lacks intelligent analysis capabilities: It cannot perform trend analysis, anomaly detection (such as packet loss, storm, and displacement anomalies) based on historical messages, or semantic parsing by associating with SCD (System Configuration Description) files.

[0034] Reliance on external tools: The lack of integrated tools requires analysts to switch between Wireshark and other dedicated IEC61850 analysis tools, which is inefficient.

[0035] The purpose of this invention is to overcome the shortcomings of existing GOOSE message parsing plugins and provide a powerful, highly integrated, and intelligent GOOSE message processing method. This method aims to achieve in-depth parsing, visual monitoring, automated verification, and intelligent diagnosis of GOOSE messages, greatly improving the efficiency of commissioning and fault diagnosis in power secondary systems.

[0036] This specification provides a method for processing GOOSE messages for Wireshark. It also relates to a device for processing GOOSE messages for Wireshark, a computing device, a computer-readable storage medium, and a computer program, which will be described in detail in the following embodiments.

[0037] Figure 1 A flowchart of a GOOSE message processing method for Wireshark according to an embodiment of this specification is shown, specifically including the following steps.

[0038] Step 102: Receive the SCD file of the smart substation through the Lua plugin in Wireshark software, and parse the SCD file to obtain the configuration information of each device in the smart substation.

[0039] Specifically, the embodiments in this specification relate to a plugin for the network protocol analysis software Wireshark, which can perform in-depth analysis, visualization, validity verification, and intelligent analysis of GOOSE packets.

[0040] The embodiments in this specification are preferably implemented based on Wireshark's Lua API. Lua is a highly integrated language with fast development iteration speed, requires no compilation, and facilitates plugin distribution and deployment. The development environment needs to be configured as follows: Install Wireshark: Ensure you have the latest version of Wireshark installed (3.6 or later recommended), which has full built-in support for Lua plugins.

[0041] To enable Lua: Locate and edit the init.lua file in the Wireshark installation directory, ensure disable_lua=false, and set the correct plugin path (e.g., dofile("your plugin path / goose-dissector.lua")).

[0042] Editor: Any code editor that supports the Lua language (such as the VS Code with Lua plugin or the IntelliJ IDEA with EmmyLua plugin).

[0043] Debugging: Use the print() or info() function to output logs to the Wireshark Terminal or Log window for debugging.

[0044] Once the plugin is developed, it can receive the SCD file of the smart substation and parse the SCD file to obtain the configuration information of each device in the smart substation.

[0045] In one optional implementation, parsing the SCD file to obtain the configuration information of each device within the smart substation includes: Extract the device identifiers of at least two smart electronic devices contained in the SCD file; Iterate through the logical devices and logical nodes under each device identifier to find the relevant general output control blocks and the datasets referenced by the general output control blocks; Each functional constraint data attribute within the dataset is parsed, and the path information, type information, and description information contained in the parsing results are recorded.

[0046] Specifically, the Lua plugin developed in the aforementioned manner includes an SCD file association and semantics module, which provides an interface for importing SCD (System Configuration Description, configuration information of a specific project) files. This allows the import of SCD files, and then the SCD file association and semantics module is used to parse the SCD file to obtain the configuration information of each device in the smart substation.

[0047] The parsing of SCD files can specifically include: extracting all IEDs (Intelligent Electronic Devices), traversing the logical devices (LDs) and logical nodes (LNs) under each IED, finding all general output control blocks (GoCBs) and their referenced datasets (DataSets), parsing each functional constraint data attribute (FCDA) within the DataSet, and recording its path, type, and description.

[0048] After parsing is complete, determine whether the parsing was successful; if the parsing is successful, subsequent processes such as GOOSE message parsing can proceed.

[0049] It should be noted that the embodiments in this specification are merely illustrative examples of the content to be parsed in SCD files, and the specific content to be parsed can be determined according to actual needs.

[0050] Step 104: Construct a protocol tree based on the target protocol, and establish the association between the configuration information and each tree node in the protocol tree.

[0051] Specifically, the target protocol can be IEC 61850, specifically IEC 61850-7-2 or IEC 61850-8-1.

[0052] The Lua plugin developed in the aforementioned manner also includes a core parsing module, which can build a complete protocol tree based on the IEC 61850-7-2 and IEC 61850-8-1 standards, enabling full parsing from AppID (Application ID), Ethernet type to all GOOSE PDU fields.

[0053] After the target protocol is parsed, the association between the aforementioned configuration information and each tree node in the protocol tree can be established, and the corresponding memory mapping table can be constructed.

[0054] Step 106: Receive the GOOSE message through the Lua plugin, and parse the GOOSE message layer by layer according to the hierarchical relationship of the protocol tree to obtain the field information of the target field in the GOOSE message.

[0055] In one optional implementation, the step of parsing the GOOSE message layer by layer according to the hierarchical relationship of the protocol tree to obtain the field information of the target field in the GOOSE message includes: The header of the GOOSE message is parsed according to the hierarchical relationship of the protocol tree to obtain the dataset identifier information corresponding to the dataset field in the GOOSE message; Read the corresponding output control block reference information based on the dataset identification information; Using the dataset identifier information and the output control block reference information as keywords, and based on the association relationship, we search for whether there is a corresponding key value; If not, the dataset identification information and the output control block reference information will be displayed in the parsing result display area of ​​the GOOSE message.

[0056] Additionally, if the execution result of the step of using the dataset identifier information and the output control block reference information as keywords and searching for the existence of corresponding key-value pairs based on the association relationship is yes, then the full dataset fields of the GOOSE message are parsed to obtain the corresponding parsing result.

[0057] Specifically, the core parsing module includes a deep dataset parser, which integrates an engine capable of parsing common data object types (FCDA). It can parse the BER-encoded binary stream of the data field in the dataset into readable boolean values, integers, floating-point numbers, timestamps, bit strings, etc., and display its functional constraints (FC) and unit information.

[0058] Once the SCD file parsing is complete and successful, the Lua plugin can listen for GOOSE messages or detect if a user has clicked on a GOOSE message. Upon detecting a GOOSE message or a user click, the deep dataset parser (Dissector) parses the basic fields of the current message: gocbRef and Dataset. Specifically, it parses the message header according to the protocol tree hierarchy to obtain the dataset identifier information corresponding to the Dataset field in the message, and reads the corresponding output control block reference information gocbRef based on this identifier. Then, using gocbRef and Dataset as keys, it searches the pre-built SCD memory mapping table, i.e., it checks if the corresponding key-value pair exists based on the aforementioned relationships, thus determining if a match is found. If no match is found, basic parsing information is displayed in the message's parsing result display area, without showing more detailed semantic annotations. If a match is found, the AllData portion of the message is deeply parsed to obtain the corresponding parsing result.

[0059] In practical applications, GOOSE messages are configured and categorized in the form of a tree diagram. The overall architecture of the GOOSE message can be displayed through the protocol tree. By parsing the GOOSE message layer by layer according to the hierarchical relationship of the target protocol's protocol tree, the field information of the target field in the GOOSE message can be obtained.

[0060] It should be noted that the embodiments in this specification are merely illustrative examples of parsing the basic fields gocbRef and Dataset in the GOOSE message. The specific fields to be parsed can be determined according to actual needs.

[0061] Step 108: Determine the target tree node corresponding to the target field based on the field information, read the target configuration information associated with the target tree node according to the association relationship, determine the semantic information corresponding to the target field based on the target configuration information, and display it.

[0062] In one optional implementation, the step of determining the target tree node corresponding to the target field based on the field information, and reading the target configuration information associated with the target tree node according to the association relationship, includes: Based on the output control block reference information, the corresponding target general output control block is determined, and the first target data node corresponding to the target general output control block is determined; Read the first target configuration information associated with the first target tree node according to the association relationship, and determine the first target configuration information as the configuration information of the target general output control block; The second target data node corresponding to the field of the full dataset is determined based on the parsing result of the full dataset field; According to the aforementioned association, read the second target configuration information associated with the second target tree node, and based on the second target configuration information, determine the path information, type information, and description information of each functional constraint attribute data in the full dataset.

[0063] Furthermore, determining and displaying the semantic information corresponding to the target field based on the target configuration information includes: Based on the path information, type information, and description information, each functional constraint attribute data is parsed to obtain the data value corresponding to each functional constraint attribute data. The description information and the parsed data values ​​are used as semantic information for the corresponding fields in the GOOSE message. A final view is generated and displayed based on the semantic information and the parsing result of the GOOSE message.

[0064] Specifically, based on the corresponding parsing results obtained from the AllData part of the GOOSE message through deep parsing, the corresponding target general output control block (GoCB) can be determined based on the output control block reference information gocbRef, and the first target data node corresponding to the target general output control block in the protocol tree can be determined. Then, according to the aforementioned configuration information and the association relationship between each tree node in the protocol tree, the first target configuration information associated with the first target tree node is read, and the first target configuration information is determined as the configuration information of the target general output control block.

[0065] In addition, after parsing the AllData field of the GOOSE message to obtain the corresponding parsing result, the second target data node corresponding to the AllData field can be determined based on the parsing result. Then, according to the aforementioned configuration information and the association relationship between each tree node in the protocol tree, the second target configuration information associated with the second target tree node is read. Based on the second target configuration information, the path information, type information, and description information of each functional constraint attribute data in the AllData are determined. Then, based on the path information, type information, and description information, each functional constraint attribute data is parsed to obtain the data value corresponding to each functional constraint attribute data. The description information and the parsed data value are used as the semantic information of the corresponding field in the GOOSE message. Finally, the final view is generated and displayed based on the semantic information and the parsing result of the GOOSE message.

[0066] By parsing the SCD file, the gocbRef (control block reference), DataSet (dataset name), and each FCDA (functional constraint data attribute) within the GOOSE message are mapped to the logical device (LD), logical node (LN), data object (DO), and data attribute (DA) information in the SCD file. The final view is generated in the GOOSE message parsing result display area (Wireshark parsing panel): basic fields + semantic annotations + parsed data values. The Wireshark parsing panel displays not only the raw values ​​but also their semantic information (e.g., not only a boolean value TRUE, but also its representation of "QF1 / CSWI1.Pos.stVal circuit breaker open position").

[0067] A schematic diagram of a message parsing result provided in the embodiments of this specification is shown below. Figure 2 As shown. Figure 2 This is a partial display of the results from the Wireshark analysis panel. Figure 2 "in "Used to hide parts of the code," Figure 2 The semantic plugin suggestions, semantic plugin information, and intelligent plugin alerts on the right are respectively... Figure 2 The semantic information of the corresponding code on the left.

[0068] In the embodiments described in this specification, in addition to the SCD file association and semantics module and the core parsing module, the Lua plugin may also include an intelligent verification and alarm module, an advanced visualization and statistics module, and an auxiliary tool module.

[0069] The intelligent verification and alarm module can be used for syntax and logic verification. For syntax verification, it automatically checks whether the message length and TLV format conform to BER encoding rules. For logic verification, it performs status sequence number analysis, configuration version verification, time-to-live (TTL) alarms, and release cycle verification. Specifically, status sequence number analysis monitors the changes in stNum (status number) and sqNum (sequence number) in real time, issuing alarms (e.g., yellow background, red text prompts) for unexpected resets, jumps, or discontinuities. Configuration version verification checks whether the confRev (configuration version) of messages with the same gocbRef has changed and whether the change is reasonable. TTL alarms calculate the message reception interval and compare it with the time allowed to live in the message, issuing alarms for timeout packet loss. Release cycle verification monitors whether the message release interval is within the range defined by MinTime and MaxTime.

[0070] The advanced visualization and statistics module leverages Wireshark's expert system to categorize and display anomalies of different levels (errors, warnings, and alerts). It also allows for custom coloring rules, enabling quick filtering through pre-defined packet coloring schemes based on anomaly type (e.g., packet loss, position changes, configuration changes). Furthermore, it supports I / O chart analysis, generating time-based trend graphs that can plot curves of specific data values ​​(e.g., current, voltage) or growth curves for stNum and sqNum. Additionally, it can generate packet timing diagrams, graphically displaying the release sequence and intervals of GOOSE packets to intuitively show whether real-time requirements are met.

[0071] The auxiliary tools module includes a filter generator with a graphical interface, helping users quickly generate display filters for specific gocbRef, MAC addresses, or data values. Additionally, the auxiliary tools module provides data export functionality, supporting the export of parsed structured data (such as all displacement information and statistical results) to formats like CSV and JSON for subsequent analysis.

[0072] By employing the above processing methods, multiple analysis functions can be integrated into a single Wireshark platform, avoiding tool switching and providing a "one-stop" analysis experience, thus improving processing efficiency. Deep parsing and semantic display of GOOSE messages make the raw binary messages easier to understand and analyze, lowering the technical barrier and enhancing readability. The shift from passive parsing to proactive analysis and alarms helps engineers quickly locate fault points, shortening troubleshooting time. Automated verification ensures consistency between messages and system configurations, improving the reliability of smart substation operation. Furthermore, the modular design provides a foundation for future support of other IEC 61850 message protocols such as SV and MMS, offering excellent scalability.

[0073] The embodiments in this manual address the problems of insufficient parsing depth, lack of intelligent analysis, and reliance on external software in existing tools. They realize "one-stop" deep parsing and intelligent diagnosis of GOOSE packets within the Wireshark platform, greatly improving the efficiency of commissioning and fault diagnosis in smart substations.

[0074] This embodiment of the specification uses a Lua plugin in Wireshark software to receive the SCD file of a smart substation and parses the SCD file to obtain the configuration information of each device in the smart substation; it constructs a protocol tree based on the target protocol and establishes the association relationship between the configuration information and each tree node in the protocol tree; it receives GOOSE messages through the Lua plugin and parses the GOOSE messages layer by layer according to the hierarchical relationship of the protocol tree to obtain the field information of the target field in the GOOSE message; it determines the target tree node corresponding to the target field based on the field information, reads the target configuration information associated with the target tree node according to the association relationship, and determines and displays the semantic information corresponding to the target field based on the target configuration information. By performing in-depth analysis of GOOSE messages based on the IEC 61850 standard, the specific data objects in the dataset are fully analyzed. By importing the SCD system configuration description file, semantic mapping between message fields and substation logic devices is achieved, significantly improving message readability. Users can intuitively identify key information in the message and quickly locate relevant anomalies without the need for additional auxiliary tools to deeply analyze complex binary code streams. This helps to shorten fault diagnosis time, reduce losses caused by system downtime, and improve the reliability of smart substation operation.

[0075] The following is in conjunction with the appendix Figure 3 The GOOSE message processing method for Wireshark is further described below. Figure 3 This specification illustrates a flowchart of a GOOSE message processing method for Wireshark provided in one embodiment, which specifically includes the following steps.

[0076] Step 302: The user starts the SCD import function.

[0077] Step 304: Select the SCD file through the GUI dialog box.

[0078] Step 306: The plugin calls the XML parser to read the SCD file.

[0079] Step 308: Parse the SCD file and build a memory mapping table.

[0080] The parsing of SCD files can specifically include: extracting all IEDs (Intelligent Electronic Devices), traversing the logical devices (LDs) and logical nodes (LNs) under each IED, finding all general output control blocks (GoCBs) and their referenced datasets (DataSets), parsing each functional constraint data attribute (FCDA) within the DataSet, and recording its path, type, and description.

[0081] Step 310: Determine if the parsing was successful.

[0082] If yes, proceed to step 312; otherwise, proceed to step 332.

[0083] Step 312: Display a success message on the interface.

[0084] Specifically, a success message could be "XX IEDs and YY GoCBs were found".

[0085] Step 314: The plugin listens for GOOSE messages or detects GOOSE messages clicked by the user.

[0086] Step 316: The plugin's core parsing module parses the basic fields of the current message: gocbRef and Dataset.

[0087] Step 318: Search the pre-built SCD memory mapping table using gocbRef and Dataset as keys.

[0088] Step 320: Determine if a match has been found.

[0089] If not, proceed to step 322; if yes, proceed to step 324.

[0090] Step 322: Display basic parsing information in the message parsing result display area, without semantic comments.

[0091] Step 324: Obtain detailed configuration information for GoCB and the control block, as well as the semantic description of each FCDA in the DataSet.

[0092] Step 326: Deeply analyze the AllData section of the GOOSE message.

[0093] Step 328: Associate and map the parsing results with the configuration information recorded in the SCD file.

[0094] Step 330: Display the final view in the message parsing result display area: basic fields + semantic annotations + mapped data values.

[0095] Step 332: Display the error message in the message parsing result display area and terminate the process.

[0096] This specification's embodiments enable in-depth parsing of GOOSE messages based on the IEC 61850 standard, fully analyzing the specific data objects in the dataset; by importing the SCD system configuration description file, semantic mapping between message fields and substation logic devices is achieved, significantly improving readability; a built-in intelligent verification mechanism can automatically detect and alarm for anomalies such as sequence number jumps, inconsistent configuration versions, and message timeouts; and advanced visualization functions such as trend analysis and time sequence diagrams are also provided.

[0097] Figure 4 This specification illustrates a schematic diagram of a GOOSE message processing plugin for Wireshark provided in one embodiment, specifically including: The core parsing module (GOOSE message parsing module), SCD file association and semantic markup module, intelligent verification and alarm module, advanced visualization and statistics module, and auxiliary tool module.

[0098] The plugin's input sources include files captured in real-time network packet capture and SCD files. The SCD file serves as input to the SCD file association and semantics module in the core parsing layer, which parses the SCD file to obtain the substation equipment's configuration information (semantic mapping information). GOOSE messages captured through network packet capture are used as raw message input to the GOOSE message parsing module, which parses the basic fields of the GOOSE messages. In addition, the GOOSE message parsing module can also associate and map the parsing results of the GOOSE messages with the configuration information recorded in the SCD file. The final parsing and mapping results are displayed in a deep parsing view and semantically through the output display layer.

[0099] The intelligent verification and alarm module, the advanced visualization and statistics module, and the auxiliary tool module all belong to the functional enhancement layer. The intelligent verification and alarm module can provide alarm prompts for abnormal events through the output display layer; the advanced visualization and statistics module can customize coloring rules and facilitate quick filtering by using preset message coloring schemes based on abnormal types (such as packet loss, displacement, and configuration changes); in addition, it can perform IO charts and trend analysis on graphical data, generate time-based trend charts, and draw change curves of specific data values ​​(such as current and voltage values), or growth curves of stNum and sqNum.

[0100] The auxiliary tools module includes a filter generator with a graphical interface, helping users quickly generate display filters for specific gocbRef, MAC addresses, or data values. Additionally, the auxiliary tools module provides data export functionality, supporting the export of parsed structured data (such as all displacement information and statistical results) to formats like CSV and JSON for subsequent analysis.

[0101] It should be noted that the core parsing module (GOOSE message parsing module), SCD file association and semantic markup module, intelligent verification and alarm module, advanced visualization and statistics module, and auxiliary tool module in the embodiments of this specification have the same functions and implementation methods as the corresponding modules in the foregoing embodiments. For the parts not described in detail in the embodiments of this specification, please refer to the relevant descriptions in the foregoing embodiments, and they will not be repeated here.

[0102] The core of this specification's embodiments lies in its ability to perform deep parsing of GOOSE messages based on the IEC 61850 standard, fully analyzing the specific data objects in the dataset; by importing the SCD system configuration description file, it achieves semantic mapping between message fields and substation logical devices, significantly improving readability; it has a built-in intelligent verification mechanism that can automatically detect and alarm for anomalies such as sequence number jumps, inconsistent configuration versions, and message timeouts; and it also provides advanced visualization functions such as trend analysis and time sequence diagrams.

[0103] Figure 5 A flowchart of an intelligent verification process provided in one embodiment of this specification is shown, using stNum / sqNum verification as an example, and specifically includes the following steps.

[0104] Step 502: Begin processing new GOOSE messages.

[0105] Step 504: Parse the basic fields of the current message: MAC address, gocbRef, T, stNum, sqNum.

[0106] Step 506: Determine if this is the first message of the gocbRef.

[0107] If the result of step 506 is yes, then proceed to step 508; if the result of step 506 is no, then proceed to step 510.

[0108] Step 508: Initialize the context records of the gocbRef, including stNum_prev, stNum_prev, and time_prev.

[0109] Step 510: Read the previous record (stNum_prev, stNum_prev, and time_prev) of this gocbRef from the global context.

[0110] Step 512: Determine whether stNUM == stNum_prev is true.

[0111] If step 512 is true, then proceed to step 514; if step 512 is false, then proceed to step 522.

[0112] Step 514: Determine that the state remains unchanged and belongs to the same time series.

[0113] Step 516: Determine whether sqNUM == sqNum_prev + 1 is true.

[0114] If step 516 is true, then proceed to step 518; if step 516 is false, then proceed to step 520.

[0115] Step 518: The serial number increases continuously, which is normal.

[0116] Step 520: Warning: Serial number not consecutive! Packet loss may occur.

[0117] Step 522: Determine whether stNUM == stNum_prev + 1 is true.

[0118] If step 522 is true, then proceed to step 524; if step 522 is false, then proceed to step 532.

[0119] Step 524: Confirm that the state has changed normally, and a new event begins.

[0120] Step 526: Determine if sqNUM == 0 is true.

[0121] If step 526 is true, then proceed to step 528; if step 526 is false, then proceed to step 530.

[0122] Step 528: Confirm that the status has changed and the serial number has been reset: Completely normal.

[0123] Step 530: Error Alarm: Status number has increased, but serial number has not been reset to 0.

[0124] Step 532: Determine whether stNUM < stNum_prev is true.

[0125] If step 532 is true, then proceed to step 534; if step 532 is false, then proceed to step 536.

[0126] Step 534: Error: Status number decreased abnormally! Device may have restarted or malfunctioned.

[0127] Step 536: State number jump increase > 1, serious error: intermediate state lost.

[0128] Step 538: Update the context and output the results.

[0129] Update the global context: Overwrite old records with stNum, sqNum, and T of the current packet; add inline alerts (if any) next to the corresponding fields in the protocol tree; add events of the appropriate level in the Wireshark expert information system; color the packet list according to rules (e.g., highlight anomalies in red); Step 538: End this verification.

[0130] The intelligent verification process in the embodiments of this specification is an implementation of part of the verification process of the aforementioned intelligent verification and alarm module.

[0131] The embodiments in this manual incorporate an intelligent verification mechanism in the plugin, which can automatically detect and alert to anomalies such as serial number jumps, inconsistent configuration versions, and message timeouts. This helps to shorten troubleshooting time and thus improve the reliability of smart substation operation.

[0132] Corresponding to the above method embodiments, this specification also provides embodiments of a GOOSE message processing apparatus for Wireshark. Figure 6 This specification illustrates a schematic diagram of a GOOSE message processing apparatus for Wireshark according to one embodiment. Figure 6 As shown, the device includes: The first parsing module 602 is configured to receive the SCD file of the smart substation through the Lua plugin in the Wireshark software, and parse the SCD file to obtain the configuration information of each device in the smart substation. The construction module 604 is configured to construct a protocol tree based on the target protocol and establish the association between the configuration information and each tree node in the protocol tree; The second parsing module 606 is configured to receive GOOSE messages through the Lua plugin and parse the GOOSE messages layer by layer according to the hierarchical relationship of the protocol tree to obtain the field information of the target field in the GOOSE message. The display module 608 is configured to determine the target tree node corresponding to the target field based on the field information, read the target configuration information associated with the target tree node according to the association relationship, and determine and display the semantic information corresponding to the target field based on the target configuration information.

[0133] Optionally, the first parsing module 602 is further configured to: Extract the device identifiers of at least two smart electronic devices contained in the SCD file; Iterate through the logical devices and logical nodes under each device identifier to find the relevant general output control blocks and the datasets referenced by the general output control blocks; Each functional constraint data attribute within the dataset is parsed, and the path information, type information, and description information contained in the parsing results are recorded.

[0134] Optionally, the second parsing module 606 is further configured to: The header of the GOOSE message is parsed according to the hierarchical relationship of the protocol tree to obtain the dataset identifier information corresponding to the dataset field in the GOOSE message; Read the corresponding output control block reference information based on the dataset identification information; Using the dataset identifier information and the output control block reference information as keywords, and based on the association relationship, we search for whether there is a corresponding key value; If not, the dataset identification information and the output control block reference information will be displayed in the parsing result display area of ​​the GOOSE message.

[0135] Optionally, the GOOSE message processing apparatus for Wireshark further includes a third parsing module configured to: If the execution result of the step of using the dataset identifier information and the output control block reference information as keywords and searching for the existence of corresponding key-value pairs based on the association relationship is yes, then the full dataset fields of the GOOSE message are parsed to obtain the corresponding parsing result.

[0136] Optionally, the display module 608 is further configured to: Based on the output control block reference information, the corresponding target general output control block is determined, and the first target data node corresponding to the target general output control block is determined; Read the first target configuration information associated with the first target tree node according to the association relationship, and determine the first target configuration information as the configuration information of the target general output control block; The second target data node corresponding to the field of the full dataset is determined based on the parsing result of the full dataset field; According to the aforementioned association, read the second target configuration information associated with the second target tree node, and based on the second target configuration information, determine the path information, type information, and description information of each functional constraint attribute data in the full dataset.

[0137] Optionally, the display module 608 is further configured to: Based on the path information, type information, and description information, each functional constraint attribute data is parsed to obtain the data value corresponding to each functional constraint attribute data. The description information and the parsed data values ​​are used as semantic information for the corresponding fields in the GOOSE message. A final view is generated and displayed based on the semantic information and the parsing result of the GOOSE message.

[0138] The above is an illustrative scheme of a GOOSE message processing device for Wireshark according to this embodiment. It should be noted that the technical solution of this GOOSE message processing device for Wireshark and the technical solution of the GOOSE message processing method for Wireshark described above belong to the same concept. Details not described in detail in the technical solution of the GOOSE message processing device for Wireshark can be found in the description of the technical solution of the GOOSE message processing method for Wireshark described above.

[0139] Figure 7 A structural block diagram of a computing device 700 according to one embodiment of this specification is shown. The components of the computing device 700 include, but are not limited to, a memory 710 and a processor 720. The processor 720 is connected to the memory 710 via a bus 730, and a database 750 is used to store data.

[0140] The computing device 700 also includes an access device 740, which enables the computing device 700 to communicate via one or more networks 760. Examples of these networks include a Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the Internet. The access device 740 may include one or more of any type of wired or wireless network interface (e.g., a Network Interface Card (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) interface, a Wi-MAX interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0141] In one embodiment of this specification, the above-described components of the computing device 700 and Figure 7 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 7 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0142] The computing device 700 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or PCs. The computing device 700 can also be a mobile or stationary server.

[0143] The processor 720 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the GOOSE message processing method for Wireshark described above.

[0144] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device belongs to the same concept as the technical solution of the GOOSE message processing method for Wireshark described above. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the GOOSE message processing method for Wireshark described above.

[0145] An embodiment of this specification also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the GOOSE message processing method for Wireshark described above.

[0146] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium belongs to the same concept as the technical solution of the GOOSE message processing method for Wireshark described above. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the GOOSE message processing method for Wireshark described above.

[0147] An embodiment of this specification also provides a computer program, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the GOOSE message processing method for Wireshark described above.

[0148] The above is an illustrative example of a computer program according to this embodiment. It should be noted that the technical solution of this computer program belongs to the same concept as the technical solution of the GOOSE message processing method for Wireshark described above. Details not described in detail in the technical solution of the computer program can be found in the description of the technical solution of the GOOSE message processing method for Wireshark described above.

[0149] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0150] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content contained in the computer-readable medium may be appropriately added to or subtracted according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0151] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0152] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0153] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A method for processing GOOSE messages in Wireshark, comprising: The SCD file of the smart substation is received by the Lua plugin in the Wireshark software, and the configuration information of each device in the smart substation is obtained by parsing the SCD file. A protocol tree is constructed based on the target protocol, and the association between the configuration information and each node in the protocol tree is established. The Lua plugin receives GOOSE messages and parses them layer by layer according to the hierarchical relationship of the protocol tree to obtain the field information of the target field in the GOOSE message. Based on the field information, determine the target tree node corresponding to the target field, read the target configuration information associated with the target tree node according to the association relationship, and determine and display the semantic information corresponding to the target field based on the target configuration information.

2. The GOOSE message processing method for Wireshark according to claim 1, wherein parsing the SCD file to obtain the configuration information of each device in the smart substation includes: Extract the device identifiers of at least two smart electronic devices contained in the SCD file; Iterate through the logical devices and logical nodes under each device identifier to find the relevant general output control blocks and the datasets referenced by the general output control blocks; Each functional constraint data attribute within the dataset is parsed, and the path information, type information, and description information contained in the parsing results are recorded.

3. The GOOSE packet processing method for Wireshark according to claim 1, wherein parsing the GOOSE packet layer by layer according to the hierarchical relationship of the protocol tree to obtain the field information of the target field in the GOOSE packet includes: The header of the GOOSE message is parsed according to the hierarchical relationship of the protocol tree to obtain the dataset identifier information corresponding to the dataset field in the GOOSE message; Read the corresponding output control block reference information based on the dataset identification information; Using the dataset identifier information and the output control block reference information as keywords, and based on the association relationship, we search for whether there is a corresponding key value; If not, the dataset identification information and the output control block reference information will be displayed in the parsing result display area of ​​the GOOSE message.

4. The GOOSE message processing method for Wireshark according to claim 3, further comprising: If the execution result of the step of using the dataset identifier information and the output control block reference information as keywords and searching for the existence of corresponding key-value pairs based on the association relationship is yes, then the full dataset fields of the GOOSE message are parsed to obtain the corresponding parsing result.

5. The GOOSE message processing method for Wireshark according to claim 4, wherein determining the target tree node corresponding to the target field based on the field information and reading the target configuration information associated with the target tree node according to the association relationship includes: Based on the output control block reference information, the corresponding target general output control block is determined, and the first target data node corresponding to the target general output control block is determined; Read the first target configuration information associated with the first target tree node according to the association relationship, and determine the first target configuration information as the configuration information of the target general output control block; The second target data node corresponding to the field of the full dataset is determined based on the parsing result of the full dataset field; According to the aforementioned association, read the second target configuration information associated with the second target tree node, and based on the second target configuration information, determine the path information, type information, and description information of each functional constraint attribute data in the full dataset.

6. The GOOSE message processing method for Wireshark according to claim 5, wherein determining and displaying the semantic information corresponding to the target field based on the target configuration information includes: Based on the path information, type information, and description information, each functional constraint attribute data is parsed to obtain the data value corresponding to each functional constraint attribute data. The description information and the parsed data values ​​are used as semantic information for the corresponding fields in the GOOSE message. A final view is generated and displayed based on the semantic information and the parsing result of the GOOSE message.

7. A GOOSE message processing apparatus for Wireshark, comprising: The first parsing module is configured to receive the SCD file of the smart substation through the Lua plugin in the Wireshark software, and parse the SCD file to obtain the configuration information of each device in the smart substation. The construction module is configured to build a protocol tree based on the target protocol and establish the association between the configuration information and each tree node in the protocol tree; The second parsing module is configured to receive GOOSE messages through the Lua plugin and parse the GOOSE messages layer by layer according to the hierarchical relationship of the protocol tree to obtain the field information of the target field in the GOOSE message; The display module is configured to determine the target tree node corresponding to the target field based on the field information, read the target configuration information associated with the target tree node according to the association relationship, determine the semantic information corresponding to the target field based on the target configuration information, and display it.

8. The GOOSE message processing apparatus for Wireshark according to claim 7, wherein the first parsing module is further configured to: Extract the device identifiers of at least two smart electronic devices contained in the SCD file; Iterate through the logical devices and logical nodes under each device identifier to find the relevant general output control blocks and the datasets referenced by the general output control blocks; Each functional constraint data attribute within the dataset is parsed, and the path information, type information, and description information contained in the parsing results are recorded.

9. A computing device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the GOOSE message processing method for Wireshark as described in any one of claims 1 to 6.

10. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the GOOSE message processing method for Wireshark as described in any one of claims 1 to 6.

Images