How to Capture BACnet Traffic from a JACE Wiretap Port

JACEs running Niagara 4 offer a diagnostic feature called Wiretap that allows the users to sniff data from the BACnet MSTP or IP network. By using the Wiretap feature, users can directly capture a stream of BACnet data, with Optigo Networks' Capture Tool or Wireshark, without sending someone on-site or the need for additional hardware (e.g. USB-to-RS485 converter).

IMPORTANT:
Please follow every step carefully. If steps are missed (e.g. port 49000 set in the JACE and the capture tool), it will not work.

Prerequisites:

• Optigo Network's Capture Tool or Wireshark

• Computer

• JACE running Niagara 4 with embedded web-application enabled or Niagara Workbench, from any vendor
  
  

Using Wiretap to stream BACnet over MSTP or IP

1. Open Niagara 4 software (web or desktop)

2. Add Palette called "bacnetUtil"

   • Under "Wiretaps" folder, locate the "ForwardingWiretap" property

3. On the left menu bar, navigate to: Station → Config → Drivers → BacnetNetwork → Bacnet Comm → Network

   • Drag and drop "ForwardingWiretap" into the "MstpPort" or "Ip Port" folder depending on which you want to use

   • [Optional] Rename to "ForwardingWiretapMSTP1" or "ForwardingWiretapIP"

4. Open the property and configure as follows:

   • By default, ForwardingWiretap will broadcast all packets on the JACE local subnet. However, if the computer capturing the ForwardingWiretap packets is on a different subnet, change the address to the computer's address.

   • Port: 49000 (NOTE: Only port 49000 is currently supported)

   • Save

5. [Optional] Disable Wiretap after the capture if you do not want it to continue streaming.
   
   

Capture option 1: Capture Tool

1. Familiarize yourself with the Capture Tool Quick Start Guide

2. Copy the API key from Visual BACnet

3. Log into the Capture Tool

4. Paste the API key (from step 2) into the API key field on the capture tool's 'Cloudlink Settings' page

5. Go to the capture tool's 'Capture Settings' page and configure the capture settings as follows:

   • Protocol: BACnet/IP

   • Interface: Ethernet

   • Capture Filter: BACnet traffic only

   • Additional UDP ports: 49000

6. Go to the capture tool's 'Capture Console', set the capture duration, and start the capture

7. Once the capture is completed, it will automatically be uploaded to Visual BACnet for analysis
   
   

Capture option 2: Wireshark

1. Open Wireshark

   • Capture → Options

   • Capture filter for selected interfaces: UDP port 49000

2. Start capture

   • At least 20 mins (troubleshooting), recommended 1h (monitoring)

3. Stop capturing after the desired time has elapsed

4. File → Save as with PCAP format

   • Upload the capture file (e.g. some_file.pcapng) to Visual BACnet