Wireshark; what is it good for

Wireshark is a packet protocol analyzer that is free for download and runs on Windows, Linux, BSD, OS X, and Solaris.  In the evolving broadcasting studio, computer networks are the backbone of the facility. Not just on the office side of the house, but also on the broadcast origination side as well. Today, almost everyone uses some type of computer automation system running on a network. In addition, new technologies such as AoIP consoles, VoIP phone systems, audio and video routing, remote control, off-site monitoring, audio processing, etc continue to develop.  Because of this, more and more broadcast engineering work is falling into the computer and networking realm.

Like anything else, networks can fail.  Failure modes can originate from both the physical side, e.g. wiring, connectors, patch bays, network interface cards or the software/protocol side.  Being able to diagnose problems quickly and take remedial action is important.  On the networking side, if a physical problem has been ruled out, then the problem exists with a protocol.  That is where Wireshark becomes useful; it takes the guesswork out of networking protocol troubleshooting.

Wireshark packet protocol analyzer has the following features (from their website):

  • Deep inspection of hundreds of protocols, more are in development
  • Live capture and offline analysis
  • Standard three-pane packet browser
  • Versions available for Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and other OS
  • Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
  • Filtering by protocol, IP address, MAC address, frame type, sequence number, etc
  • VoIP analysis
  • Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and others
  • Capture files compressed with gzip can be decompressed on the fly
  • Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)
  • Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
  • Coloring rules can be applied to the packet list for quick, intuitive analysis
  • Output can be exported to XML, PostScript®, CSV, or plain text

A few things to keep in mind with the physical connection.  Connecting a computer to a switch port will establish a collision domain between the switch port and the computer which is also called a network segment.  The computer NIC will see all traffic on that collision domain and all broadcast traffic on the network or sub-network that the switch is attached to.  If there is a suspected problem with a particular network segment, the Wireshark computer needs to join that collision domain.

Creating a network segment tap with a hub
Creating a network segment tap with a hub

This can be done most simply by installing Wireshark on the host in that domain. Alternatively, a hub can be used to add another host to the collision domain.  Or, if it is a managed switch, there may be a provision to send all traffic on the switch out of one designated port.  This is called ‘port mirroring’, ‘port monitoring’, ‘Roving Analysis’ (3Com), or ‘Switched Port Analyzer’ or ‘SPAN’ (Cisco).

Network diagram with managed switch
Network diagram with managed switch

A quick tutorial on what to look for when using Wireshark, Part A:

Part B:

And briefly, that is how it is done.  There are many more videos on youtube and elsewhere if interested in learning more.

Happiness is: An AM directional array at licensed values

Last week I did some repair work at WDDY in Albany NY. It seems the sample line on one of the towers was melted in half by a lightning strike. This station uses sample loops up on the tower for its directional antenna monitoring system.

WDDY antena array, Albany, NY
WDDY antena array, Albany, NY

As it happened, the sample line in question was on the reference tower, which makes everything else meaningless.  Before the meltdown, there were several years’ worth of maintenance logs that showed the previous values for current ratio and phase relationship.

With the transmitter turned off and locked out, I removed the damaged section of the line from the base of the tower to the RF choke coil in the tuning house.  Where the sample line came off of the base of the tower, there was a UHF-type connector that had been improperly applied.  Using spare parts, I fixed that connector, then spliced the line into place.  Upon power-up, the transmitter and antenna readings returned to their previous values, which were slightly out of tolerance.

Thus, some phasor tuning was needed.  There are not too many people left that can properly tune an AM phasor.  All of the control interact with each other; moving the power or phase to one tower will likely affect all of the other towers and possibly the reflected power on the transmitter.  This phasor was made in the 1970s by Multronics with what looks like all RCA parts.  Multronics, I think, was John Mullaney who is more known for the folded unipole antenna.  In any case, after a good few hours of careful hand cranking and a run out to the reference tower to move a coil tap, here are the results:

WDDY tower one, reference
WDDY tower one, reference
WDDY tower two
WDDY tower two
WDDY tower three
WDDY tower three
WDDY forward/reflected power
WDDY forward/reflected power

Not bad for a day’s work.

New Studio Project, Part II

The finished product:

SAS Rubicon console, WAJZ Albany, NY
SAS Rubicon console, WAJZ Albany, NY

This is the finished product from an earlier post.  Currently, it is the studio for WAJZ in Albany, but that is not permanent.  The SAS studio goes together fairly quickly, as most of the trunking between the TOC and studio is done over the SAS data channel.

The studio monitors (Tanoy Reveal) are set on little posts under the computer screens. I like this setup as the DJs are less likely to rock the house if they decide to crank up the volume on their favorite tune.  I am also kind of digging the lack of a tabletop equipment pod.  That takes up a lot of countertop space and always seems to be in the way.  There are two CD players racks mounted below the counter (lower left), which are almost never used.

The curious case of the WKZE Notice Of Violation

On June 19th, WKZE received a notice of violation from the FCC’s New York Field office.  The crux of the issue seems to be interference being generated on 784.8 MHz (WKZE 8th harmonic) to a new Verizon Wireless installation located nearby:

47 C.F.R. §73.317(a): “FM broadcast stations employing transmitters authorized after January 1, 1960, must maintain the bandwidth occupied by their emissions in accordance with the specification detailed below. FM broadcast stations employing transmitters installed or type accepted before January 1, 1960, must achieve the highest degree of compliance with these specifications practicable with their existing equipment. In either case, should harmful interference to other authorized stations occur, the licensee shall correct the problem promptly or cease operation.” The eighth harmonic of Station WKZE-FM (784.8 MHz) was causing interference to the Verizon Wireless transmitter located approximately 500 feet away.

First off, we note that the WKZE transmitter is not allegedly causing interference to a Verizon Wireless transmitter, but rather to a Verizon Wireless receiver.  That may be splitting hairs, however, since the FCC is quoting a technical rules violation, they can at least get the technical language right.

A brief examination of the rest of FCC part 73.317 is in order to find the specification cited in section (a).  Section (d) states:

 (d) Any emission appearing on a frequency removed from the carrier by more than 600 kHz must be attenuated at least 43 + 10 Log10 (Power, in watts) dB below the level of the unmodulated carrier, or 80 dB, whichever is the lesser attenuation.

Since 784.8 MHz – 98.1 MHz is greater than 600 KHz, this is the section that applies to the WKZE situation.  Thus, the interfering signal must be greater than -80 dBc to trigger the Notice Of Violation (NOV) from the FCC.  The station ERP is 1,800 watts or +62 dBm.  Measurements were made with an Agilent N992A spectrum analyzer using an LPA-1000 log periodic antenna.  At a 12-foot distance away from the WKZE transmitter cabinet, the signal on 784.8 MHz was found to be -94 dBc or 0.000063 watts.  At the base of the Verizon Wireless tower, the measurement was -124 dBc, or 0.000000025 watt, which is barely perceptible above the -130 dBm noise floor.  There does not appear to be any violation of 47 CFR 73.317.  Rather, the issue seems to be Verizon Wireless’s deployment of the 700 MHz LTE band and the use of high-gain antennas coupled with high-gain preamplifiers on frequencies that are harmonically related to broadcast stations nearby.  In this particular installation, the antenna has 16 dB of gain, minus a 4.5 dB of transmission line loss into a 21 dB preamplifier before the receiver.  At the output of the Verizon preamplifier, the signal on 784.8 MHz was measured at -89 dBc, which is still in compliance.

By these measurements, clearly, WKZE is not in violation of any FCC regulation.  It makes one wonder, does the FCC understand its own rules?  Or, is this a matter of favoritism towards a huge corporation over a small independent radio broadcaster?  Is it a matter of “broadband at the expense of all others?”  There are several of these broadcast to 700 MHZ LTE interference cases pending throughout the country.  This could set a dangerous precedent for broadcasters and other RF spectrum users as wireless giants like Verizon throw their weight around and eye even more spectrum to press into broadband service.

Commlaw blog has a good post on this subject: Harmonic Convergence?

Update: The response from the WKZE attorney can be found here, including the above-mentioned actual measurements.