Custom Powershell script for capture and upload

Follow these step if you wish to capture and upload BACnet traffic without the use of the Optigo Capture Tool. 

Pre-requisites

1. Install Wireshark and allow network capture for your user
2. Determine the interface you wish to capture the network traffic (e.g. BACnet traffic) AND confirm you are able to capture network traffic using Powershell. 
   You have two options to do this:
   
   1. Open Wireshark and start capture (double-click on interface). Confirm you are capturing the desired network traffic (e.g. BACnet). If you do not see the interface you need, try running Wireshark in Administrator mode.
      
   2. Or, Open Powershell (you may have to run as Administrator), and run "tshark -i X". Replace X with the interface number you wish to capture network traffic on. If you don't know the interface number, use "tshark -D" to get complete list. 
      Confirm this command lists the desired network traffic (e.g. UDP port 47808 for BACnet)
      
      
      

Capturing packets using tshark

In some instances, it may be desirable to capture network traffic using wireshark/tshark instead of using the Optigo Capture Tool

1. Create a folder where to save PCAP files
2. Open 
3. Run the following tshark command with appropriate changes

tshark.exe -i 1 -f "udp port 47808" -b duration:3600 -b files:20 -w capture_47808.pcapng

• Replace "-i 1" with the interface number to capture from. See Pre-requisites for more details
• Replace "udp port 47808" with the desired capture filter. Here are some examples,
  • "udp port 47809" to capture traffic with BACnet packets on UDP port 47809 only
  • "udp portrange 47808-47823" to capture BACnet traffic on all UDP ports from 47808 to 47823
  • "udp port 47808 && host 192.168.123.45" to BACnet traffic on UDP Port 47808 to and from host/device with IP address 192.168.123.45. This filter can be particularly useful with BMS systems registered to multiple sites using Foreign Device Registration to BACnet traffic only to and from a specific site.
• Replace "-b duration:3600" with the length of time for each file before writing to a new file. "3600" is 1 hour.
• Replace or remove "-b files:20" to limit the maximum number of files it can keep. If exceeded, tshark will keep only the last number of files defined. This can be useful for system with limited disk space or to exceed a total number of files.
• If using custom BACnet ports (e.g. 47807), add the following parameter

-d "udp.port==47807,bvlc"

Notes:

1. Multiple instantiations of the tshark.exe command can run simultaneously.  This can be useful if you wish to capture traffic of different parameters (e.g. 47808 and 47809) into different folders.
2. If you wish to have this tshark capture run automatically upon computer boot-up, you can use the Microsoft Task Scheduler. Note this will open a Windows Command Prompt window and it needs to remain open
   
   1. Open Task Scheduler
   2. Create Basic Task...
      
      1. Give the task a Name -> Next
      2. Select "When the computer starts" -> Next
      3. Select "Start a program" -> Next
      4. In Program/script, find "tshark.exe" (e.g. "C:\Program Files\Wireshark\tshark.exe")
      5. Set "Add arguments" to the following and adjust as appropriate (set step 2 above for details)
         "-i 1 -f "udp port 47808" -b duration:3600 -b files:20 -w capture_47808.pcapng"
      6. Set "Start in": to a folder where you want to save the capture files (e.g. c:\Users\Me\test_capture)
      7. Save

Upload to OptigoVN using Powershell script

This Powershell script will check for presence of PCAP file in a folder and upload these to OptigoVN for a given apiKey. Once a file is successfully uploaded, the file and sub-folders are deleted locally.

1. Download the attached upload_and_delete.ps1 script
2. Update the apiKey in the above script to match the apiKey of the Monitoring Node to receive the PCAP files
3. Create a Microsoft Task Scheduler basic task. Note this will open a Windows Command Prompt window and it needs to remain open
   
   1. Open Task Scheduler
   2. Create Basic Task...
      
      1. Give the task a Name -> Next
      2. Select "Daily" as trigger -> Next
      3. Select an appropriate start time (note additional modification below for hourly trigger)
      4. Select "Start a program" -> Next
      5. In Program/script, "powershell.exe"
      6. Set "Add arguments" to the following and adjust path to the powershell script created above
         "-ExecutionPolicy Bypass -NoProfile -File "D:\upload_and_delete.ps1"
      7. Set "Start in": to a folder where the capture files are saved (e.g. c:\Users\Me\test_capture)
      8. Save
   3. Once the task is created. Open it for edit. In the "Triggers" panel, edit the trigger to "Repeat task every: 1 hour"