Capture BACnet MS/TP Traffic

[Product_Support]

Issue

Need to capture and analyze BACnet MS/TP bus communication to troubleshoot issues such as excessive COV traffic, unstable token passing, wiring/installation problems, incorrect baud rates, or general MS/TP performance concerns.

Product Line

Andover Continuum, EcoStruxure Building Operation, TAC IA Series

Environment

• EcoStruxure Building Operation AS-P and AS-B
• bCX4000, bCX4040, ASP, ASB, b3 controllers
• MNB controllers
• Third‑party BACnet MS/TP devices
• Modern RS‑485 adapters compatible with BACnet MS/TP (USB‑RS485‑WE‑1800‑BT, FTDI-based adapters, etc.)
• Roam I/A or RoamIO

Cause

Troubleshooting MS/TP networks often requires packet captures to view token passing behavior, retries, polls, timing issues, and message patterns such as excessive COV notifications or broadcast storms that can only be confirmed by examining trunk-level traffic.

Resolution

There are two supported capture methods. Use Method 1 on EBO 2024 (V6.0) or later servers with BACnet interfaces. Use Method 2 on legacy systems or when you need a portable field capture from the trunk.

---

Method 1 — EBO Integrated Packet Capture (EBO 2024 and later)
Available on EBO Servers with BACnet interfaces. Creates packet captures that record BACnet messages visible to the server’s BACnet/IP and BACnet MS/TP networks.

1. On the EBO server, start a packet capture for the BACnet interface that is relevant to the investigation.
2. Reproduce or observe the issue window.
3. Stop the capture and export the PCAP.
4. Open the PCAP in Wireshark for analysis.

Notes

• This is the preferred approach on modern EBO systems because it captures exactly what the server sees on both BACnet/IP and MS/TP sides.
• Use this especially when MS/TP issues correlate with BACnet/IP behavior, such as BBMD or broadcast distribution.
• Refer to “Packet Captures in EcoStruxure Building Operation” for detailed steps in your installed version.

---

Method 2 — Field Capture with mstpcap.exe and Wireshark

Hardware setup

• Connect a BACnet‑compatible RS‑485 adapter to the MS/TP trunk.
  • USB to RS-485 Adapter
  • USB-RS485-WE-1800-BT FTDI, Future Technology Devices International Ltd | 768-1041-ND | DigiKey 
  • RoamIA or RoamIO
  • Any other RS-485 adapter compatible with BACnet MS/TP and baud rates used
• Observe polarity: Data+ (A) to A, Data− (B) to B.
• Install the adapter driver and confirm the assigned COM port in Windows Device Manager.

Obtain the capture tool

• Download mstpcap.exe from Steve Karg’s “bacnet-tools” on SourceForge.
• Option 1: Use it directly from a folder such as C:\MSTP Tool\.
• Option 2: Copy mstpcap.exe to Wireshark’s extcap directory, for example C:\Program Files\Wireshark\extcap, to use it as a native capture interface inside Wireshark.

Configuration

1. If using the USB to RS-485 Adapter
   1. Connect the USB adapter cable to the USB port on a laptop PC
   2. Connect the RS232/RS485 adapter to the 9-pin end of the USB adapter cable.
   3. Attach a length of MSTP bus cable to the wire terminal on the RS485 adapter.
2. If using the FTDI
   1. Connect the TDI RS-485 adapter to the USB port on a laptop PC
   2. Connect the cables to the MSTP trunk where Orange = Data+ (A) and Yellow = Data- (B)
3. Ensure the RS-485 adapter driver is installed in Windows by opening Device Manager and ensuring that it is listed as expected under Ports (COM and LPT). Record the COMx being reserved by the adapter. 
4. If using Wireshark with MSTPcap.exe to capture
   1. Ensure MSTPcap.exe is installed in the Wireshark Extcap folder per MSTP Capture Application link above
   2. NOTE: Wireshark may need to be rebooted if MSTPcap.exe was added while it was open
   3. Launch Wireshark
   4. Select gear next to BACnet MS/TP on COMx
   5. Set known baud rate
   6. Click to start a capture. 
5. If using MSTPcap.exe via Command Prompt to capture
   1. Copy the MSTP Capture application to C:\
   2. Open a Command Prompt in the folder where mstpcap.exe resides.
   3. Run the command:

      mstpcap comX BAUDRATE
      

      • Replace comX with your COM port (for example, COM3).
      • Replace BAUDRATE with the trunk speed (for example, 19200, 38400, 76800, 115200).
   4. The command window will indicate the name of the file the activity is being captured to.
   5. Press Ctrl+C to stop.
   6. The capture data can be viewed by running Wireshark. Select File > Open and navigate to the folder the capture file was saved to and select the capture file.

Baud rate and tool capability considerations

• Many low‑end PC RS‑485 setups reliably capture up to 38.4 kbps.
• 76.8 kbps capture is often unreliable with basic adapters due to PC serial hardware limitations.
• Use Roam I/A for higher rates:
  • Roam I/A serial port example: mstpcap comX 115200
  • Roam I/A Bluetooth example: mstpcap comX 76800
• Higher‑end MS/TP capture solutions (for example, PolarSoft or Cimetrix tools) are better suited for consistent 76.8 kbps captures.
• Also, check out the BACnet-Capturing MS/TP Traffic Quick-Help video on the Exchange. This video uses the older pipe method that was used before Extcap was available in Wireshark.

---

Quick analysis tips in Wireshark

• Apply display filter bacnet to focus on BACnet frames.
• Look for token rotation time stability, retries, NAKs, and frame errors.
• Watch for floods of Who‑Is/I‑Am or excessive Confirmed/Unconfirmed COV Notification traffic.
• If the issue involves BBMD or broadcast distribution, also review BACnet/IP captures. EBO integrated capture is useful here because it sees both MS/TP and IP perspectives.