BAS-FIELDWORK WIRESHARK PROFILE
==============================
From "BAS Communication - A Field Reference" by Scott Draper
basfieldreference.com/extras

WHAT THIS IS
------------
A Wireshark configuration profile set up for building-automation work:
colouring rules that make BACnet errors and Modbus exceptions announce
themselves, custom packet-list columns for BACnet APDU type / object
instance / Modbus transaction ID, and the saved display filters from
Chapters 21-24.

With this profile active, scanning a capture becomes a visual exercise
instead of a read-every-line exercise. Problems show up in red and
orange before you have consciously looked for them.


HOW TO INSTALL
--------------
1. Open Wireshark.
2. Help -> About Wireshark -> Folders tab.
3. Double-click "Personal configuration" - a file browser opens.
4. Inside that folder, find (or create) a folder called: profiles
5. Create a folder inside "profiles" called: BAS-Fieldwork
6. Copy these three files into it:
       colorfilters
       dfilters
       preferences
7. Restart Wireshark.
8. Bottom-right corner of the Wireshark window -> click the profile
   name -> choose "BAS-Fieldwork".

To switch back to your normal setup, click the same corner and pick
"Default". Your existing configuration is untouched - a profile is a
separate folder, not an overwrite.


WHAT YOU GET
------------
COLOURING RULES (first match wins, so order matters)
  red      BACnet Error / Reject / Abort   bacapp.type > 4
  orange   Modbus exception                modbus.exception_code
  blue     BACnet WriteProperty            bacapp.confirmed_service == 15
  green    BACnet discovery                Who-Is / I-Am
  amber    BBMD / forwarded broadcast      bvlc.function 4-9
  purple   TCP retransmission              tcp.analysis.retransmission

CUSTOM COLUMNS
  BACnet Type   bacapp.type            errors visible at a glance
  BACnet Inst   bacapp.instance_number which object is being touched
  Modbus TID    mbtcp.trans_id         request/response pairing

SAVED DISPLAY FILTERS
  Fourteen filters from the book, prefixed "BAS:" so they group
  together in the filter bookmark menu.


A HONEST NOTE ON FORMATS
------------------------
Wireshark's profile files are plain text and have been stable for
years, but they are not a formally versioned format. If a future
Wireshark release changes a preference key, the worst case is that
Wireshark ignores the line it does not recognise - it will not corrupt
anything. If a column or rule does not appear, open
Edit -> Preferences -> Columns (or Coloring Rules) and check the entry
by hand; every rule in this profile is listed above so you can rebuild
any single one in about ten seconds.

Tested against Wireshark 3.x and 4.x.


ONE THING WORTH DOING ON EVERY SITE
-----------------------------------
Wireshark cannot see traffic between two other devices on a switched
network. You need a SPAN / mirror port configured by IT, and that is a
conversation to have before you are standing in the mechanical room.
Chapter 21 covers the request and what to ask for.
