Using Wireshark for Theater Protocols
Wireshark is a powerful open source tool for investigating exactly what's happening on a network. Different computers and machines on the network exchange information using small units of information called packets. Wireshark lets you see the function and contents of individual packets.
The following theatrical protocols are specifically supported in a friendly way by Wireshark:
- OSC (Open Sound Control)
- Art-Net
- sACN (known as Net3 or E1.31)
- OCP (Open Control Protocol) (known as OCA or AES70)
In addition, any TCP or UDP packet can be investigated.
Setting up Wireshark
Download Wireshark from wireshark.org. Most systems require you to also install ChmodBPF, which is included in the download. You don't need to add it to system path.
Enable UDP OSC and sACN
To enable them:
- Navigate to
Analyze→Enabled Protocols... - Search for "OSC" and enable
osc_udp - Search for "ACN" and enable
acn.
Enable sACN DMX
The ACN dissector's DMX setting is off by default. It can be enabled in Wireshark Preferences → Protocols → ACN and enabling Streaming DMX.
Using Wireshark
Wireshark can only deal with one Network Interface at a time. Wireshark lists all interfaces, even the secret internal interfaces we can ignore. The graph next to each interface is a good indicator of which interfaces are active and which are quiet.
Select an interface from the list by double clicking it.
There's a lot of traffic on most networks. Filters can be entered in the Apply a display filter... field, to zero in on just the specific kinds of traffic you care about.
| Filter | Function | Example |
|---|---|---|
artnet |
Art-Net packets | artnet |
acn |
sACN/E1.31/Net3 packets | acn |
osc |
OSC packets | osc |
ocp1 |
OCP/OCA packets | ocp1 |
udp |
UDP packets | udp |
ip.src |
packets coming from a source | ip.src==192.168.5.3 |
ip.dst |
packets going to an address | ip.dst==192.168.5.20 |
udp.port |
packets coming from a port | udp.port==53001 |
udp.dstport |
packets going to a port | udp.dstport==53000 |
Filters can be chained using operators && (and) and || (or). For example, to see both Art-Net and sACN packets, enter the filter artnet || acn
| Filter | Function |
|---|---|
artnet || acn |
show only packets that are Art-Net packets or sACN packets |
udp && ip.src==192.168.5.3 && udp.port==53001 |
show only UDP packets from a given address and port |