If you have ever pulled a packet capture from a supervisor or BAS server and called it a full picture of the network, you were missing data. Not incomplete data. Missing data.
MS/TP topology and design are getting more archaic by the year for a lot of newer building automation technicians, and that is a reasonable gap to have. BACnet/IP dominates new installs, and if your training happened recently, nobody may have walked you through what actually happens on an MS/TP trunk.
Most captures happen where it is easiest to get them: at the IP side, upstream of the routers, at the supervisor or BAS level. That capture is useful, but it’s also only half the network.
If you never run an MS/TP trunk capture, you cannot see how the MS/TP side of your BACnet network is actually behaving, and that is where most physical-layer problems live.
What an IP-Side Capture Actually Shows You
A capture taken at the supervisor or BAS server sees unicast and broadcast traffic after it has already been through a BACnet router. That router’s job is to move BACnet messages between an MS/TP segment and the IP side. To do that, it repackages the network-layer message (the NPDU) for the destination network and sends it on.
What it does not do is forward the MS/TP data-link layer itself. Token frames, poll-for-master frames, and reply-to-poll-for-master frames never leave the trunk. They are how MS/TP devices negotiate who gets to talk and when, and routers have no reason to pass them upstream because nothing on the IP side needs them. Contemporary Controls lays out the layer split clearly: only the NPDU, with the application message wrapped inside it, crosses the router. The frames underneath it stay local.
That means an IP-side capture, no matter how long you run it, won’t tell you whether tokens are circulating cleanly, whether a device is dropping off the bus, or whether your wiring is causing retries. All critically important information you need if you’re trying to troubleshoot, and it was never going to make it to the pcap file in the first place.
An MS/TP Trunk Capture Is Where the Physical-Layer Problems Show Up
Token passing is the mechanism that keeps an MS/TP segment functional. When it breaks down, quietly, you get symptoms that look like application problems but are actually physical-layer problems: slow polling, devices that go offline and come back, retries that pile up under load. None of that is visible from a capture taken above the router.
A capture taken directly on the trunk shows you token rotation, how long each device holds it, how often a device fails to respond and gets skipped, and where the noise or wiring issues actually are. This is exactly the kind of thing that shows up in the most common MS/TP mistakes: bad termination, baud rate mismatches, and wiring topology errors that never announce themselves at the IP layer. If you are only capturing upstream, you are troubleshooting blind on the one segment where the actual fault usually is.
How to Capture MS/TP the Right Way with OptigoVN
The fix is not complicated, but it does mean capturing in two places instead of one:
Packet capture best practices for OptigoVN recommend
- A capture from the BAS or supervisor level for system-wide, BACnet/IP visibility, running for at least an hour
- A separate capture on each MS/TP trunk, running for at least fifteen minutes.
The supervisor-level capture tells you what the system as a whole is doing. The trunk-level capture tells you what that specific MS/TP segment is doing at the wire.
OptigoVN supports both. Its capture tool filters for BACnet traffic automatically so you are not sorting through unrelated network noise, and it takes scheduled captures and uploads them automatically.
Tip: Before you start either capture, trigger a Global Who-Is from the supervisor so every device on the network is forced to respond, and make sure whatever problem you are chasing actually happens during the capture window. A capture that runs clean because nothing went wrong tells you nothing.
Where Is the MS/TP Trunk, and How Do I Capture From It?
The trunk is the RS-485 daisy chain itself: the twisted pair running from a BACnet router or supervisory controller out to the field devices on that segment. Every device shares that one wire and takes turns holding the token, which is why the traffic exists nowhere else. You will find it at the panel, on the terminal block where the field bus lands, usually labeled + and − or A and B depending on the manufacturer. Each trunk needs its own capture.
You need a laptop and a serial-to-USB adapter:
- Land the adapter on the trunk’s RS-485 terminals, matching polarity to the bus.
- Run the Optigo software capture tool on the laptop and select the adapter’s serial port.
- Set the capture to MS/TP at the trunk’s baud rate. Guess wrong and you get nothing usable.
- Capture for at least fifteen minutes, longer if the problem is intermittent.
- Let it upload to OptigoVN, where the diagnostics run against it.
Tip: Some BACnet IP/MSTP routers have built-in packet capture capabilities that can pull token data. Contemporary Controls, and KMC are two examples.
Not Sure What the Trunk Data Is Telling You? Ask the Assistant
OptigoVN runs its diagnostic suite against whatever capture you upload and resolves findings down to individual devices, including the MS/TP physical-layer problems that only a trunk capture will surface. Accuracy is the part that is already solved. The bottleneck is who on your team can read the result, and when the one person who can is busy, the finding gets delayed or ignored altogether.
The Optigo Assistant closes that gap. Ask it what you are looking at and it answers in plain language, goes to root cause instead of symptom, recommends a documented fix, then writes the punch list, the report, or the email to your integrator. It is trained in a closed loop on Optigo’s own data, drawn from real customer networks, Optigo’s technical documentation, and detailed troubleshooting sessions with customers, rather than on a general-purpose model that has read about BACnet.
It will also tell you how to capture in the first place. Ask what you need for a clean MS/TP trunk capture and it walks you through the steps, which matters when the reason the trunk gets skipped is that nobody on shift is certain how to do it. It is the BACnet expert who has seen thousands of OT networks and knows at a glance what is causing your problem, sitting inside OptigoVN. Don’t be shy about asking it for help. The Assistant is available on Solution plans and above.
What This Buys You
Run both captures and you get end-to-end visibility on your OT network instead of half of it: the application-layer view from the supervisor and the physical-layer view from the trunk. One without the other leaves a real gap in what you can diagnose, and it is the gap that shows up as a truck roll instead of a fix from your desk.
Capture your own MS/TP trunk and see what your IP-side capture has been missing. Request a free trial of OptigoVN and run it against your own network.
Can I capture MS/TP traffic from my BAS or supervisor?
Not the MS/TP part of it. A capture taken at that level sees BACnet/IP traffic after it has passed through a router, and MS/TP data-link traffic never reaches the router. You get the routed messages, not the behavior of the trunk itself.
What can a trunk-level capture show me that an IP-side capture cannot?
Token rotation and timing, how long each device holds the token, how often a device fails to respond and gets skipped, and the retry patterns that point at wiring, termination, or baud rate problems. These are the physical-layer symptoms that never announce themselves at the IP layer.
Why don’t MS/TP token frames cross the router?
They are data-link-layer traffic. A BACnet router forwards the network-layer message, the NPDU, with the application data wrapped inside it. Token, poll-for-master, and reply-to-poll-for-master frames sit below that layer and stay on the segment where they originate.
How do I capture MS/TP traffic from the trunk?
Land a serial-to-USB adapter on the trunk’s RS-485 terminals, run the Optigo software capture tool on a laptop, and set it to MS/TP at the trunk’s baud rate. Some BACnet IP/MSTP routers have built-in packet capture capabilities that can pull token data. Contemporary Controls, and KMC are two examples.
How long should an MS/TP capture run?
At least fifteen minutes per trunk, and each trunk needs its own capture since each one is a separate segment with its own token. Pair that with at least an hour at the BAS or supervisor level for BACnet/IP traffic.
