Wireshark; what is it good for

Wireshark is a packet protocol analyzer that is free for download and runs on Windows, Linux, BSD, OS X, and Solaris.  In the evolving broadcasting studio, computer networks are the backbone of the facility. Not just on the office side of the house, but also on the broadcast origination side as well. Today, almost everyone uses some type of computer automation system running on a network. In addition, new technologies such as AoIP consoles, VoIP phone systems, audio and video routing, remote control, off-site monitoring, audio processing, etc continue to develop.  Because of this, more and more broadcast engineering work is falling into the computer and networking realm.

Like anything else, networks can fail.  Failure modes can originate from both the physical side, e.g. wiring, connectors, patch bays, network interface cards or the software/protocol side.  Being able to diagnose problems quickly and take remedial action is important.  On the networking side, if a physical problem has been ruled out, then the problem exists with a protocol.  That is where Wireshark becomes useful; it takes the guesswork out of networking protocol troubleshooting.

Wireshark packet protocol analyzer has the following features (from their website):

  • Deep inspection of hundreds of protocols, more are in development
  • Live capture and offline analysis
  • Standard three-pane packet browser
  • Versions available for Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and other OS
  • Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
  • Filtering by protocol, IP address, MAC address, frame type, sequence number, etc
  • VoIP analysis
  • Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and others
  • Capture files compressed with gzip can be decompressed on the fly
  • Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)
  • Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
  • Coloring rules can be applied to the packet list for quick, intuitive analysis
  • Output can be exported to XML, PostScript®, CSV, or plain text

A few things to keep in mind with the physical connection.  Connecting a computer to a switch port will establish a collision domain between the switch port and the computer which is also called a network segment.  The computer NIC will see all traffic on that collision domain and all broadcast traffic on the network or sub-network that the switch is attached to.  If there is a suspected problem with a particular network segment, the Wireshark computer needs to join that collision domain.

Creating a network segment tap with a hub
Creating a network segment tap with a hub

This can be done most simply by installing Wireshark on the host in that domain. Alternatively, a hub can be used to add another host to the collision domain.  Or, if it is a managed switch, there may be a provision to send all traffic on the switch out of one designated port.  This is called ‘port mirroring’, ‘port monitoring’, ‘Roving Analysis’ (3Com), or ‘Switched Port Analyzer’ or ‘SPAN’ (Cisco).

Network diagram with managed switch
Network diagram with managed switch

A quick tutorial on what to look for when using Wireshark, Part A:

Part B:

And briefly, that is how it is done.  There are many more videos on youtube and elsewhere if interested in learning more.

WKNY, Kingston, NY

This is another one of those, ahem, AM success stories. WKNY is on 1490 KHz, 1,000 Watts day and night from a transmitter site that is located very close to its target audience of Kingston. It signed on on December 16, 1939, broadcasting 100 watts on 1500 kHz according to the Broadcasting Yearbook 1940 edition.

WKNY transmitter site location
WKNY transmitter site location

The transmitter location is the key to this station’s good signal over Kingston. Even though it is a class C AM station when driving around the Kingston city limits there is no electrical interference or nighttime co-channel interference.  The reason for this is that most of the city limits are within 2.5 to 3 miles (4 to 4.8 km) from the tower.

WKNY transmitter building and tower
WKNY transmitter building and tower

This is the original transmitter building and tower.  Like many old AM transmitter sites, this one is located in a low, swampy area.  The tower is electrically tall for 1490 KHz, at 92 meters (305 feet)  it is 163 electrical degrees. Something else that may contribute to the station’s performance.

WKNY tower base
WKNY tower base
WKNY tower
WKNY tower

WKNY tower, a typical design of a uniform cross-section guyed tower from the late 1930s to late 1950s.

WKNY transmitter
WKNY transmitter

WKNY transmitter. Another Nautel ND-1 series transmitter. Nothing ever breaks or goes wrong.

Air studio, WKNY Kingston, NY
Air studio, WKNY Kingston, NY

The air studio has an AudioArts R-60 console. For an inexpensive audio console, these things sure seem to last for a long time. I think this one was put in in 1997.

Talk Studio, WKNY KIngston, NY
Talk Studio, WKNY KIngston, NY

A small talk studio is used to originate local programming of interest. This morning, I was listening to “Speak Out With Jody McTague,” a local interest program that was discussing the impacts being felt in the Kingston area due to the “Affordable Health Care Act.”

WKNY production studio
WKNY production studio

The production studio has a rather old Harris rotary pot console from the 1980’s.

Of course, all of this equipment makes radio transmission possible, but what makes radio itself is the local people working at the station and bringing relevant information to the area.  I know a lot of very smart people are working on the “solution” to the AM problem.  It really has to do with the programming.

Man electrocuted putting up a pirate radio antenna

A south Florida man was electrocuted when the antenna he was putting up struck a power line. Police say 42-year-old Jean Adelphonse was working in the dark Monday night when part of an antenna to be used for an unlicensed radio station collapsed and struck a power line.  The Fort Lauderdale Sun-Sentinel reported that he was working on the roof of an office building where his other businesses were located.

That is rather unfortunate and completely preventable.  The first red flag here is working in the dark.  The second would be working alone.  Safety is always paramount; whether it is working on a transmitter, putting up an antenna, working on a ladder, or environmental conditions such as heat, weather, etc.  In my younger days, I had gotten away with a few careless moments mainly due to blind luck.  I cringe thinking about it today.  Nothing on the radio is worth killing yourself or anyone else over.

This type of thing used to happen more often when almost every house had an outside TV antenna.

Let’s be careful out there.

Happiness is: An AM directional array at licensed values

Last week I did some repair work at WDDY in Albany NY. It seems the sample line on one of the towers was melted in half by a lightning strike. This station uses sample loops up on the tower for its directional antenna monitoring system.

WDDY antena array, Albany, NY
WDDY antena array, Albany, NY

As it happened, the sample line in question was on the reference tower, which makes everything else meaningless.  Before the meltdown, there were several years’ worth of maintenance logs that showed the previous values for current ratio and phase relationship.

With the transmitter turned off and locked out, I removed the damaged section of the line from the base of the tower to the RF choke coil in the tuning house.  Where the sample line came off of the base of the tower, there was a UHF-type connector that had been improperly applied.  Using spare parts, I fixed that connector, then spliced the line into place.  Upon power-up, the transmitter and antenna readings returned to their previous values, which were slightly out of tolerance.

Thus, some phasor tuning was needed.  There are not too many people left that can properly tune an AM phasor.  All of the control interact with each other; moving the power or phase to one tower will likely affect all of the other towers and possibly the reflected power on the transmitter.  This phasor was made in the 1970s by Multronics with what looks like all RCA parts.  Multronics, I think, was John Mullaney who is more known for the folded unipole antenna.  In any case, after a good few hours of careful hand cranking and a run out to the reference tower to move a coil tap, here are the results:

WDDY tower one, reference
WDDY tower one, reference
WDDY tower two
WDDY tower two
WDDY tower three
WDDY tower three
WDDY forward/reflected power
WDDY forward/reflected power

Not bad for a day’s work.