Made by Networkforensic.dk

IEC61850 profile for Wireshark
Date: 11 JUN 2026

---------------------------

How to setup parser for mms in wireshark:

MMS:
Wireshark -> Preferance -> Protocols -> PRESS - Users Context list -> Edit
Add ContextID 3 with Syntax Name OID 1.0.9506.2.3

Setup Decode:
ref _ PRESS - ContextID 3 - 1.0.9506.2.3
Wireshark -> Analyse -> Decode AS

Add
Filed - TCP port
Value - 8102
Type - Integer, base 10
Deafault - (None)
Current - TPKT

Add
Filed - TCP port
Value - 102
Type - Integer, base 10
Deafault - (None)
Current - TPKT


---------------------------
Import profile to your default profiles folder in wireshark

Copy the folder into your profiles folder:

Default on Windows
Path C:\Users\<YOUR Username>\AppData\Roaming\Wireshark\profiles

---------------------------

Other profiles is located on: 
https://networkforensic.dk/Tools/tools.html