Using Wireshark for Theater Protocols

Wireshark is a powerful open source tool for investigating exactly what's happening on a network. Different computers and machines on the network exchange information using small units of information called packets. Wireshark lets you see the function and contents of individual packets.

The following theatrical protocols are specifically supported in a friendly way by Wireshark:

• OSC (Open Sound Control)
• Art-Net
• sACN (known as Net3 or E1.31)
• OCP (Open Control Protocol) (known as OCA or AES70)

In addition, any TCP or UDP packet can be investigated.

Setting up Wireshark

Download Wireshark from wireshark.org. Most systems require you to also install ChmodBPF, which is included in the download. You don't need to add it to system path.

Enable UDP OSC and sACN

To enable them:

1. Navigate to Analyze → Enabled Protocols...
2. Search for "OSC" and enable osc_udp
3. Search for "ACN" and enable acn.

Enable sACN DMX

The ACN dissector's DMX setting is off by default. It can be enabled in Wireshark Preferences → Protocols → ACN and enabling Streaming DMX.

Using Wireshark

Wireshark can only deal with one Network Interface at a time. Wireshark lists all interfaces, even the secret internal interfaces we can ignore. The graph next to each interface is a good indicator of which interfaces are active and which are quiet.

Select an interface from the list by double clicking it.

There's a lot of traffic on most networks. Filters can be entered in the Apply a display filter... field, to zero in on just the specific kinds of traffic you care about.

Filter	Function	Example
artnet	Art-Net packets	artnet
acn	sACN/E1.31/Net3 packets	acn
osc	OSC packets	osc
ocp1	OCP/OCA packets	ocp1
udp	UDP packets	udp
ip.src	packets coming from a source	ip.src==192.168.5.3
ip.dst	packets going to an address	ip.dst==192.168.5.20
udp.port	packets coming from a port	udp.port==53001
udp.dstport	packets going to a port	udp.dstport==53000

Filters can be chained using operators && (and) and || (or). For example, to see both Art-Net and sACN packets, enter the filter artnet || acn

Filter	Function
artnet || acn	show only packets that are Art-Net packets or sACN packets
udp && ip.src==192.168.5.3 && udp.port==53001	show only UDP packets from a given address and port