How to Record Ethernet Network Traffic with Wireshark

Most peripheral equipment in the robot cell communicates over Ethernet. This makes it hard for an average technician to monitor the communication and validate that devices are talking correctly.

There is a popular free tool called Wireshark. This is a PC application (Windows or Linux) which records network traffic and displays it to the user. There are a number of terms for this type of application. They all mean essentially the same thing:

• Packet sniffer
• Protocol tracer
• Network analyzer

Setup Hardware

If you are trying to record communication to/from the PC that is running Wireshark, then no special setup is required.

If, however you want to monitor the communication between two (or more) other devices, then you must have a “managed” switch. This needs to be configured to support “port mirroring”. This will allow all communication between specific ports to be copied to another port where the Wireshark PC is listening.

An example of a managed switch that is commonly used in ArcWorlds is the NTron 708TX, which is normally preconfigured to mirror traffic to port 4.

Usage

When you launch Wireshark, it will show a listing of all the network adapters on your computer. This includes the Ethernet, Wifi, Bluetooth, and others. It is helpful if you rename the network adapters in the Windows control panel.

Simply double-click the ethernet adapter that you will listen on. The capture will start immediately.

After the desired traffic has been captured, click the red STOP icon. Then go to [File] > [Save] to save the capture as a .pcapng file on your PC.

If this is being used long-term to capture an intermittent problem, it is recommended to have Wireshark create new save-files at a regular (smaller) period. This makes it much easier to analyze later.

For that, go to the [Capture] menu and select [Capture Options]. In the [Output] tab, configure it to save a new file every ten minutes. You can also set it to retain a specified number of old files.

Interpreting data

Many protocols are automatically recognized by Wireshark. These will be displayed in human readable format above the binary data of the packet.

There are many proprietary protocols that are not recognized by Wireshark. It is possible to create a custom “dissector” which translates the binary data. It is always worth searching the internet for a dissector. If a dissector is not available, then you are forced to sift through the raw binary data.