Best practices for capturing packets to use in Visual BACnet

Tech tips
How long should your captures be, and where do you need to capture from?

We often have people ask us how to create a packet capture, or pcap file, to use in Visual BACnet. While any pcap should give you some insight into your network, there are some best practices that vary depending on what you are trying to discover.

Capture duration

The optimal duration depends on the intended use of the pcap file.

To get a general system health check, perhaps after commissioning or before starting a job or for regular audits, we recommend a minimum of a one-hour capture

Once a problem is identified, shorter captures can be used to troubleshoot. By initially looking at the longer pcap, you should be able to identify the cause or the frequency of the problem, or the time of day during which it occurs. Use this information to capture a pcap that is five to 20 minutes long, to see if your work fixed the problem and increased the network health. In some cases, it may be good to force a command/action during the capture period to ensure the fix is applied correctly (e.g. confirm reply on read-property is no longer an error).
 

Intended use of Visual BACnetRecommended capture length
General system health check1 hour
Troubleshooting and validating fix5-20 minutes

 

Capture location

Run Wireshark on the Building Management System, or BMS. This will ensure that you get a complete system-level view of the Building Automation System. All global broadcast messages, communication with the BMS and general network traffic will be captured.  

As a secondary step, you can also perform captures on each individual MS/TP network. This will capture all MSTP traffic between controllers and devices that may not be seen by the BMS and higher level network. Analyzing this capture in Visual BACnet  will expose any problems arising from token passing. Learn how to capture MS/TP traffic

Note that some BMS and controllers include a packet capture feature, which are much easier to use and require no additional software or hardware. Please ensure the capture file has an extension of .cap or .pcap or .pcapng. If it does not by default, append a .cap before uploading to Visual BACnet.

Capture Filters

In most cases, we suggest not using any capture filters. Visual BACnet also shows non-BACnet communications, so leaving it in the capture is helpful to get a comprehensive view of your network. When you upload your file to Visual BACnet, you will be able to see how many BACnet packets are in the file, and what percentage of the traffic is BACnet.

If large amounts of network traffic are bloating the file or there are privacy concerns, Wireshark can be configured to capture only BACnet traffic. This will slightly lower the quality of the overall analysis because it will not be possible to identify spikes in general network traffic that are affecting the BAS system. If you would like to do this, watch this video to find out how.

Capture Activities

A capture file will only contain packets from devices that communicate during the network capture window.  It is possible that some devices may exist but be dormant on the network. In order to generate a list of all devices and networks, a Global Who-Is can be triggered on the system.

If you would like to see all of your devices and networks, trigger a Global Who-Is from the BMS. Some BMS software can induce a Global Who-Is on the system. In other cases, a Global Who-Is can be triggered by resetting the BMS.

If you are using Visual BACnet for a particular problem, ensure that the action or commands triggering the problem occur during the capture period. If you know exactly what is the BACnet command that triggers the error/problem, use the detailed graphs (e.g. Traffic by Source Destination Type) to visualize the impact on the traffic. Now drag and drop your PCAP file into Visual BACnet and find out how your system is doing!

Recent Blog Posts

Over the years, we’ve dug into solutions for the most common problems we see on BACnet networks: everything from MS/TP issues, to Global Who-Is broadcasts, duplications, and Circular Networks.

When I really think about it, I’m astounded by how much movement and change there is among companies in the building automation industry.

The world of IT does not look quite like it did 40, or even 30 years ago. 

June 12, 2018, Vancouver, BC – Vancouver-based Optigo Networks, the network connectivity, monitoring, and analytics company, has released a new report on the challenges and opportunities for BACnet in smart b

Not so long ago, Penn State had big network problems.

Think tons of network traffic, buildings dropping offline — that sort of thing.

Recent Projects

Penn State University Visual BACnet Site Monitoring Optigo Networks

PENN STATE UNIVERSITY

When Tom Walker first started working at Penn State University four years ago, there were a lot of network issues. Buildings were dropping offline. Broadcast traffic was pushing 90,000 packets per hour. Walker was on the phone almost every single night because devices were down or had to be reset.

 

Torre Manacar Optigo Networks Optigo Connect Mexico City High-rise shopping centre

TORRE MANACAR

When MR Soluciones began work on Torre Manacar, they knew they needed a flexible and scalable network infrastructure to support a wide array of integrated systems. Optigo Networks was a natural fit for the massive project, designing a robust network at a competitive cost.

short

SHORT PUMP TOWN CENTER

Short Pump Town Center, an upscale retail center, underwent a complete renovation in 2014. The flexibility of Optigo Networks’ solution meant the retail center’s unknown final design was not a barrier to placing IP surveillance equipment in the field.

BOULEVARD MALL

BOULEVARD MALL

Optigo Networks connected New York-based Boulevard Mall’s security surveillance devices in December 2015, using a Passive Daisy Chain topology.

Tech Support Team

TECH SUPPORT TEAM

One tech support team at a manufacturer purchased an account with Visual BACnet in April 2017, for technical problems around the world.

Aster Conservatory Green

ASTER CONSERVATORY GREEN

The Aster Conservatory Green is a residential community comprising 352 residences across 24 low-rise buildings. The buildings use advanced surveillance and access control technology, including 40 HD video cameras and 60 FOB-access-tele-entry points for access control.

25 NATIONAL CIRCUIT

25 NATIONAL CIRCUIT

When Delta Building Automation (Australia) won the BMS Upgrade at 25 National Circuit for the Australian Trucking Association, they partnered with Optigo Networks to create a secure and robust Building Services Network (BSN). Optigo Connect more than delivered on this project with a scalable solution that restored the building network to perfection.

Optigo Connect Seattle Stadium

SPORTS AND ENTERTAINMENT CENTER

Optigo Connect offered a simple, cost-efficient solution for a premier Seattle-based stadium. Optigo Networks’ design improved the surveillance system to crystal clear perfection, made it dependable, and allowed the security system to scale with the addition of more than 40 16MP cameras.

TELECOM DATA CENTER

TELECOM DATA CENTER

Optigo Networks and Controlco offered a secure and scalable solution for four data centers’ HVAC and Access Control systems throughout the United States. Optigo Connect’s performance in the first data center was so impressive, the client asked that Optigo replicate the network design for three other data centers.

bueno

BUENO SYSTEMS

Energy analytics company BUENO Systems was working on a mall when the worst happened. The network failed and equipment failed to “ON,” which kept units running 24 hours a day. As it turns out, the mall’s network was overloaded and glitching before BUENO even deployed. It had been for a while. These latent issues were a ticking time bomb and would have resulted in a failure if any new devices were added to the network. Because it was BUENO’s device, though, they had to fix it. The only way to fix it was out of pocket.