Best practices for capturing packets to use in Visual BACnet

Tech tips
How long should your captures be, and where do you need to capture from?

We often have people ask us how to create a packet capture, or pcap file, to use in Visual BACnet. While any pcap should give you some insight into your network, there are some best practices that vary depending on what you are trying to discover.

Capture duration

The optimal duration depends on the intended use of the pcap file.

To get a general system health check, perhaps after commissioning or before starting a job or for regular audits, we recommend a minimum of a one-hour capture

Once a problem is identified, shorter captures can be used to troubleshoot. By initially looking at the longer pcap, you should be able to identify the cause or the frequency of the problem, or the time of day during which it occurs. Use this information to capture a pcap that is five to 20 minutes long, to see if your work fixed the problem and increased the network health. In some cases, it may be good to force a command/action during the capture period to ensure the fix is applied correctly (e.g. confirm reply on read-property is no longer an error).

Intended use of Visual BACnetRecommended capture length
General system health check1 hour
Troubleshooting and validating fix5-20 minutes


Capture location

Run Wireshark on the Building Management System, or BMS. This will ensure that you get a complete system-level view of the Building Automation System. All global broadcast messages, communication with the BMS and general network traffic will be captured.  

As a secondary step, you can also perform captures on each individual MS/TP network. This will capture all MSTP traffic between controllers and devices that may not be seen by the BMS and higher level network. Analyzing this capture in Visual BACnet  will expose any problems arising from token passing. Learn how to capture MS/TP traffic

Note that some BMS and controllers include a packet capture feature, which are much easier to use and require no additional software or hardware. Please ensure the capture file has an extension of .cap or .pcap or .pcapng. If it does not by default, append a .cap before uploading to Visual BACnet.

Capture Filters

In most cases, we suggest not using any capture filters. Visual BACnet also shows non-BACnet communications, so leaving it in the capture is helpful to get a comprehensive view of your network. When you upload your file to Visual BACnet, you will be able to see how many BACnet packets are in the file, and what percentage of the traffic is BACnet.

If large amounts of network traffic are bloating the file or there are privacy concerns, Wireshark can be configured to capture only BACnet traffic. This will slightly lower the quality of the overall analysis because it will not be possible to identify spikes in general network traffic that are affecting the BAS system. If you would like to do this, watch this video to find out how.

Capture Activities

A capture file will only contain packets from devices that communicate during the network capture window.  It is possible that some devices may exist but be dormant on the network. In order to generate a list of all devices and networks, a Global Who-Is can be triggered on the system.

If you would like to see all of your devices and networks, trigger a Global Who-Is from the BMS. Some BMS software can induce a Global Who-Is on the system. In other cases, a Global Who-Is can be triggered by resetting the BMS.

If you are using Visual BACnet for a particular problem, ensure that the action or commands triggering the problem occur during the capture period. If you know exactly what is the BACnet command that triggers the error/problem, use the detailed graphs (e.g. Traffic by Source Destination Type) to visualize the impact on the traffic. Now drag and drop your PCAP file into Visual BACnet and find out how your system is doing!

Recent Blog Posts

What defines a BACnet network?

BACnet Web Services is a standardized system that helps facilities managers integrate different types of information to understand their building and network.

April 3, 2019, Vancouver, BC – The latest release from Optigo Networks helps facility managers understand their building network’s health at the site, zone, and capture node levels.

We’re excited to announce the launch of our new Visual BACnet Site Manager! On April 25th, we’re releasing the latest update to Visual BACnet Site Monitoring.

We actually wrote a whole whitepaper on why you should use BACnet, interviewing thought leaders and technicians throughout the industry.

Recent Projects

Penn State University Optigo Networks Visual BACnet


When Tom Walker looked at Penn State University’s Navy Yard network, he saw huge issues. The system was busy and loud, to the point where the overrun network was bringing down the entire building. Because this was happening on the MS/TP network, pinpointing the problem would mean boots on the ground to segment and test the chain, piece by piece.

Penn State University Optigo Networks Visual BACnet


When Tom Walker first started working at Penn State University four years ago, there were a lot of network issues. Buildings were dropping offline. Broadcast traffic was pushing 90,000 packets per hour. Walker was on the phone almost every single night because devices were down or had to be reset.


Torre Manacar Mexico City Optigo Connect


When MR Soluciones began work on Torre Manacar, they knew they needed a flexible and scalable network infrastructure to support a wide array of integrated systems. Optigo Networks was a natural fit for the massive project, designing a robust network at a competitive cost.



Short Pump Town Center, an upscale retail center, underwent a complete renovation in 2014. The flexibility of Optigo Networks’ solution meant the retail center’s unknown final design was not a barrier to placing IP surveillance equipment in the field.



Optigo Networks connected New York-based Boulevard Mall’s security surveillance devices in December 2015, using a Passive Daisy Chain topology.

Visual BACnet tech support team


One tech support team at a manufacturer purchased an account with Visual BACnet in April 2017, for technical problems around the world.

Aster Conservatory Green Optigo Connect


The Aster Conservatory Green is a community comprising 352 residences across 24 low-rise buildings. The buildings use advanced surveillance and access control technology, including 40 HD video cameras and 60 FOB-access-tele-entry points for access control.



When Delta Building Automation (Australia) won the BMS Upgrade at 25 National Circuit for the Australian Trucking Association, they partnered with Optigo Networks to create a secure and robust Building Services Network (BSN). Optigo Connect more than delivered on this project with a scalable solution that restored the building network to perfection.

Optigo Connect Seattle Stadium


Optigo Connect offered a simple, cost-efficient solution for a premier Seattle-based stadium. Optigo Networks’ design improved the surveillance system to crystal clear perfection, made it dependable, and allowed the security system to scale with the addition of more than 40 16MP cameras.



Optigo Networks and OTI offered a secure and scalable solution for four data centers’ HVAC and Access Control systems throughout the United States. Optigo Connect’s performance in the first data center was so impressive, the client asked that Optigo replicate the network design for three other data centers.