The official information is the ASHRAE 135-2008 BACnet standard, available from ashrae.org bookstore. You can use the open source BACnet stack or Wireshark to see how we have encoded and decoded the various services and data in BACnet.

Gracias.

BACnet MS/TP Capture Tool

This tool captures BACnet MS/TP packets on an RS485 serial interface,
and saves the packets to a file in Wireshark PCAP format for
the BACnet MS/TP dissector to read. The filename has a date and time
code in it, and will contain up to 65535 packets. A new file
will be created at each 65535 packet interval. The tool can
be stopped by using Control-C.

Here is a sample of the tool running (use CTRL-C to quit).
D:\code\bacnet-stack\bin>mstpcap COM3 38400
Adjusted interface name to \\.\COM3
mstpcap: Using \\.\COM3 for capture at 38400 bps.
mstpcap: saving capture to mstp_20090729123548.cap
1400 packets
MAC MaxMstr Tokens Retries Treply Tusage Trpfm Tder Tpostpd
0 0 525 0 32 0 0 0 0
1 127 525 0 16 79 0 0 0

The BACnet MS/TP capture tool also includes statistics which are
listed for any MAC addresses found passing a token,
or any MAC address replying to a DER message.
The statistics are emitted when Control-C is pressed, or when
65535 packets are captured and the new file is created.
The statistics are cleared when the new file is created.

MaxMstr = highest destination MAC address during PFM

Tokens = number of tokens transmitted by this MAC address.

Retries = number of second tokens sent to this MAC address.

Treply = maximum number of milliseconds it took to reply with
a token after receiving a token. Treply is required to be less
than 25ms (but the mstpcap tool may not have that good of
resolution on Windows).

Tusage = the maximum number of milliseconds the
device waits for a ReplyToPollForMaster or Token retry.
Tusage is required to be between 20ms and 100ms.

Trpfm = maximum number of milliseconds to respond to PFM with RPFM. It is
required to be less than 25ms.

Tder = maximum number of milliseconds that a device takes to
respond to a DataExpectingReply request. Tder is required to be less
than 250ms.

Tpostpd = maximum number of milliseconds to respond to
DataExpectingReply request with ReplyPostponed. Tpostpd is
required to be less than 250ms.

Note that the mstpcap tool may not have that good of
resolution on Windows, so timing under 50ms may not be accurate.

I have to give you a big THANKS for the mstpcap-Wireshark 1.1.x development combo. It works GREAT! Using Wireshark filters work wonderful with your mstpcap tool.

Thanks again!

To decode the serial port directly under Wireshark requires a driver that packetizes the serial stream, and makes the packets available as a network interface. I have not done any drivers like that for Linux (line discipline driver) or Windows.

However, it is still possible to use mstpcap to capture the Serial Port stream, which packetize it into a file. Then open that file with Wireshark to view the MS/TP messages. It is also possible (at least under Linux currently) to use mstpsnap to capture the Serial Port stream and send it out on an Ethernet port and monitor the capture in realtime with Wireshark.

Perhaps there will be better solutions (i.e. Wireshark Remote) for serial packet captures in the future that work on all platforms.

I have ICP CON 7561 USB to RS485 converter.
http://www.inovis-group.ch/d/artikel_ausgabe.asp?ID=2949&form=7
This converter uses the USB interface to conect with PC.

And other converter to connect mstp-bus to serial interface.

I can see the beatstream over HyperTerminal (serail interface (COMx)).

It is possible to connect Wireshark on Serial Port an decode the beatsream?

The mstpcap tool stores the packets to a file (named with the current date and time), and puts up to 65535 packets into a single file. A new file is created when the file is full, or when mstpcap is first started.
http://prdownloads.sourceforge.net/bacnet/bacnet-tools-0.5.1.zip?download

I have not tried to create an mstpsnap for Win32 with WinPcap.

Thanks in advance!

So the new BACnet MS/TP decoding feature is still in the 1.1.x development branch until 1.1.x becomes the stable release.
http://www.wireshark.org/download/
or specifically for Windows:
http://www.wireshark.org/download/win32/wireshark-win32-1.1.3.exe