How to allow tagged GOOSE and Sampled Values frames to be passed to your packet capture software?

When configuring GOOSE and Sampled Values communications it is useful (and sometimes is a must) to have the possibility to check VLAN and Priority tags. Whether your network adapter driver strips tagging or not will define the availability of these parameters not only while using Wireshark, but also other specific tools for analysis of GOOSE and Sampled Values traffic (Omicron SVScout, Omicron IEDScout, GOOSE Inspector, etc.). Today we will see how to make Intel network adapters not to strip this important info.


First of all it is required to make sure that you are really using Intel network adapter and you also need to identify driver version. For this it is required to open Windows Device Manager.

Overview of Network Adapters tab in Device Manager

After that it is required to open network adapter properties – for this right-click on the network adapter name and select Properties item from the pop-up menu.

Then in the new window select Driver tab and then choose Driver Details menu item. The displayed list will include list of driver files.

Driver details

You have to pay the attention to the first three symbols in the names of the files – they define driver version. If these are e1g, e1e or e1y then further you will have to add a new MonitorModeEnabled key to the registry. If these are e1c, e1d, e1k, e1q, e1r, ixe, ixn or ixt then you will have to add a new MonitorMode key to the registry. Remember that.

Having identified driver version, open the registry. The new key should be placed at: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\ControlClass\{4D36E972-E325-11CE-BFC1-08002BE10318}\0nn, where nn is the physical instance of the network port where you want to capture VLAN tags. It is an easy thing to find the required interface: check DriverDesc parameter value in the right window, its value has to be equal to the network adapter name you are using. Having found the specific instance, right click in parameters area and choose to create new DWORD value. You have to assign either MonitorModeEnable or MonitorMode name to the new parameter (which one – we have identified on the previous step).

Adding new DWORD value named either MonitorMode or MonitorModeEnabled

After that double click on the parameter and assign the value of 1 to it. Close the registry and restart your PC.

Setting the value of MonitorMode (MonitorModeEnabled) parameter

Having restarted your PC, launch specific packet sniffer and make sure that you see VLAN tags.

GOOSE-message with VLAN tag, displayed in Wireshark

If you do not see VLAN tag in the end, please, make sure that your Ethernet switch does not strip the tag while forwarding frames. As a rule the setting which defines that is located in the settings of VLANs available in the switch.

VLAN 1 settings, the switch preserves VLAN tag while forwarding frames only through 3 specific ports

Digital Substation