AJapps

MAC Address & Ethernet Frame Decoder (GOOSE, SV, PTP, PRP)

Paste a MAC address to see what it is — an IEC 61850 GOOSE or sampled-value multicast, PTP, spanning tree, PRP/HSR supervision, IP multicast or a device's own address — or paste the start of a frame from Wireshark to decode the VLAN tag, priority, EtherType, APPID and the GOOSE or SV header, with range checks against IEC 61850.

MAC address

What this address is

Normalised01-0C-CD-01-00-11
TypeMulticast
CarriesIEC 61850 GOOSE multicast
Defined byIEC 61850-8-1
  • Inside the recommended GOOSE range 01-0C-CD-01-00-00 … 01-0C-CD-01-01-FF.

Manufacturer lookup (optional)

Download the IEEE registry once from standards-oui.ieee.org/oui/oui.csv (or oui.txt) and open it here. It is read in your browser and kept only while this page is open.

Frame (hex)

At least the first 14 bytes (destination, source, EtherType). Paste the whole frame to decode the GOOSE or SV fields.

Ethernet header

Destination01-0C-CD-01-00-11
Destination carriesIEC 61850 GOOSE multicast
Source02-AA-00-00-02-01
VLAN tagVLAN 10, priority 4
EtherType0x88B8 · IEC 61850 GOOSE
APPID / length0011 / 126 bytes
Reserved 1 / 20x0000 / 0x0000
Bytes pasted144

GOOSE PDU

gocbRefP132_Q01PROT/LLN0$GO$GCB_TRIP
timeAllowedtoLive2000 ms
datSetP132_Q01PROT/LLN0$DS_TRIP
goIDGCB_TRIP
t2026-08-01T18:34:40.500Z (time quality 0x0A: accuracy 10 bits)
stNum5
sqNum0
simulationFALSE
confRev1
ndsComFALSE
numDatSetEntries4
allData4 values

Checks

  • OKGOOSE APPID 0011 is inside 0000–3FFF.
Tool guide · know before you use

What this tool is, how it works and how far to trust it

A decoder for MAC addresses and the first bytes of an Ethernet frame, tuned to substation traffic: GOOSE, sampled values, PTP, PRP/HSR, MRP, spanning tree and IP multicast.

Read this before relying on a result. Every method, formula, assumption and limit is stated here, so you can check the answer yourself instead of accepting it blindly.

What it can do

  • Tell whether an address is broadcast, multicast or unicast, manufacturer-assigned or locally administered, and which protocol uses a well-known multicast address.
  • Decode a frame header from hex or a Wireshark hex dump: VLAN ID and priority, EtherType, HSR tag, PRP trailer.
  • For GOOSE and SV: check the APPID against the IEC 61850 ranges, show the simulation bit and decode the PDU fields (gocbRef, time allowed to live, data set, stNum, sqNum, confRev, svID, smpCnt, smpSynch).
  • Look up the manufacturer of a unicast address from the IEEE registry file you open.

Why you need it

  • Switch MAC tables, alarms and captures show raw addresses; knowing at a glance that 01-0C-CD-04-… is sampled values or 01-80-C2-00-00-0E never crosses a switch saves time when tracing a fault.
  • Wrong APPID ranges, missing VLAN tags and low priorities are common GOOSE configuration errors that are easy to see in the first 26 bytes.

Understand this first

  • The lowest bit of the first byte marks a multicast address; switches flood multicast to every port in the VLAN unless a static filter limits it.
  • GOOSE and SV are Layer 2 multicast. IGMP snooping filters IP multicast (01-00-5E-…), not GOOSE or SV.
  • The VLAN tag (0x8100) carries the VLAN ID and the 802.1Q priority (0–7) that switches use to queue the frame.
  • The first three bytes of a manufacturer-assigned unicast address are the OUI registered to the maker of the network interface — not necessarily the maker of the device.

What you need before you start

  • A MAC address in any common format, and/or the bytes of a frame: in Wireshark select the frame and use Copy → as Hex Dump or as Hex Stream.
  • Optionally the IEEE OUI registry (oui.csv or oui.txt) downloaded from standards-oui.ieee.org, for manufacturer names.
  • A current browser (Chrome, Edge, Firefox or Safari). Nothing is installed and your data is never uploaded; it is processed on your own computer.

How to use it

  • Type or paste a MAC address in the left panel and read what it is.
  • Paste a frame in hex (or click Load sample GOOSE) in the right panel; read the header, the GOOSE/SV fields and the checks.
  • For manufacturer names, download oui.csv from the IEEE once and open it with Open IEEE OUI file.

What you get

  • Address type, the protocol it belongs to and notes on ranges and flooding.
  • The decoded header and GOOSE/SV fields, and checks marked Problem, Check, Note or OK.

How to read the results

  • An APPID or MAC outside the recommended range is allowed by the protocol but usually breaks a project's addressing rules or a switch's static filter.
  • No VLAN tag, or priority below 4, means switches treat GOOSE/SV as ordinary traffic: fix the publisher's VLAN-ID and VLAN-PRIORITY.
  • Simulation bit set, or GOOSE 'simulation' TRUE: the publisher is in test or simulation mode and normal subscribers should ignore it.
  • sqNum 0 with a new stNum is the first transmission after a change; rising sqNum are repetitions.

Technical basis

  • Multicast and APPID ranges per IEC 61850-8-1 and -9-2 (Edition 2 Type 1A ranges 8000–BFFF and C000–FFFF accepted).
  • Well-known addresses from IEEE 802.1D/Q, IEEE 802.1AB, IEEE 1588, IEC 62439-2/-3, RFC 1112, RFC 2464 and RFC 5798.
  • PDU fields decoded with ASN.1 BER (tags 0x80–0x8A and 0xAB for GOOSE, 0x80–0x88 inside each ASDU for SV); UtcTime as seconds, a 24-bit fraction and a quality byte.
  • Manufacturer names come only from the IEEE file you open; nothing is bundled or guessed.

Limits: when not to rely on it

  • It decodes what you paste; it does not capture traffic or check a whole stream (use the GOOSE & SV Capture Analyzer for that).
  • Data-set values inside allData and seqData are counted, not interpreted, because their types come from the SCD.
  • Vendor-specific multicast addresses not in the list are reported as unknown multicast.

For preliminary engineering use. Results must be checked by a qualified engineer against the project's standards. How results are checked · Terms & disclaimer · Build 424d8a2 · 2026-11-12