Wireshark CA Plugin< kazuro.furukawa @ kek.jp >Wireshark CA Plug-in
EPICS Channel Access Dissector
Kazuro Furukawa, KEK
Ron Rechenmacher, Fermilab
Anze Zagar, Cosylab
Klemen Zagar, Cosylab
Presented by
Masanori Satoh, KEK

EPICS Meeting 2008, Shanghai, China.

March 2008.

Wireshark CA Plugin

BackgroundIdeas and efforts from several groups in the pastTech-talk proposal of CA Sniffer from Ned Arnold, APS
Implementation of primary CA Plugin for Ethereal by RonRechenmacher, Fermilab
(Managers love to have analyzers)

KEK needed CA analyzer for efficient EPICS
operation
Without knowing above efforts
Thought about Tcpdump extension for textual processing
Discussion at ICALEPCS with Bob Dalesio and Jeff Hill
Discussion with Ron Rechenmacher, FermilabImplementation by Klemen and Anze Zagar, Cosylab
EPICS Meeting 2008, Shanghai, China.

March 2008.

Linac Network

Wireshark CA Plugin

CA Plug-in for Wireshark
Wireshark (formally Ethereal)Is the most famous network protocol analyzer and is open
source<http://www.wireshark.org/>Wireshark Plugin architecture
EPICS channel access protocol dissection in CA plugin
Development is well separated from main programPlugin distribution is simpler
Only one file (shared/dinamic library file) for binary distribution
One plugin directory and a simple patch (Makefile, etc) in a tar file for source

EPICS Meeting 2008, Shanghai, China.

March 2008.

Wireshark CA Plugin

CA Plug-in for Wireshark
Graphical or Textual user interface
Graphical interface for Online capture and Offline analysis
With flexible filters

Textual interface (tshark) for batch operation
Original intention at KEK was long-term rare event capturing andanalysis
Background operation was preferable
Almost the same as tcpdump
Captured data can be analyzed later»With Graphical user interface

EPICS Meeting 2008, Shanghai, China.

March 2008.

Wireshark CA Plugin

CA PluginDissects all CA packet header
Commands/replies and parameters
In Channel Access Protocol specification
<http://epics.cosylab.com/cosyjava/JCA-Common/Documentation/CAproto.html>

Also tracks PV/Channel names along virtual circuit
Each packet only contains ID (CID/SID/SubscriptionID)
Indispensable for human-readable analysis

Does not dissect payload
Use other EPICS toolsFor data contents

EPICS Meeting 2008, Shanghai, China.

March 2008.

Wireshark CA Plugin

Installation
Binary installation
Install normal Wireshark 0.99.8 or 0.99.7
Install CA plugin binary
From <http://www-linac.kek.jp/cont/epics/wireshark/>
Windows, Linux, MacOSX (x86/ppc) for now

Building from sourceGet Wireshark (0.99.8 or 0.99.7)
Expand CA plugin sourceApply patch
Normal building procedure<http://www-linac.kek.jp/cont/epics/wireshark/> for details
Gtk+ and packet capture software are required
EPICS Meeting 2008, Shanghai, China.

March 2008.

Wireshark CA Plugin

Simple Usage for EPICS
Invoke Wireshark
Capture options
Capture Filter: “port 5064 or port 5065”

Start capture(Stop capture)
Apply display/analysis filter
Filter examples
ca.cmd==1
Symbolic names like CA_PROTO_SEARCH in Helperca.chanName==“fred” or ca.channel==“fred”
Packets related to a PV named fredca.channel matches “^VAC:IP.*:Pressure”
ca.channel contains “VAC:IP”
PV name string or regular-expression matching
EPICS Meeting 2008, Shanghai, China.

March 2008.

Wireshark CA Plugin

Selecting EVENT_ADD command/response

EPICS Meeting 2008, Shanghai, China.

March 2008.

Wireshark CA Plugin

Selecting “fred” related packets

EPICS Meeting 2008, Shanghai, China.

March 2008.

Wireshark CA Plugin

Hints
Combination with CA Snooper may enhance
network trouble-shootingExpression button helps filter expression
construction
tshark may be used to capture packets, andlater Wireshark can be used to analyze them
Data contents dissection necessary?

EPICS Meeting 2008, Shanghai, China.

March 2008.

Wireshark CA Plugin

Summary
Wireshark CA plugin was build with efforts
by many peopleIt may be used for the efficient operation of
EPICS system and for the trouble-shooting
Please send any comments to< kazuro.furukawa @ kek.jp >EPICS Meeting 2008, Shanghai, China.

March 2008.

Wireshark CA Plugin

Thank you

EPICS Meeting 2008, Shanghai, China.

March 2008.