What are you using for protocol analysis? - Page 1
Forum section: electronics / general

author: NE666
author_rank: Frequent Contributor
timestamp: November 24, 2023, 09:40:41 am
content: A quick apology upfront; this seems somewhat of a beginner question and I'll be happy to take it to that board however, the microcontroller section feels more suited to the specifics of the topic.As per the subject title, I'd be interested to know what folks are using for capture and review of 'lengthy' message exchanges, for the purposes of debugging and reverse engineering. I've a couple of scopes with decent decoding capabilities and whilst these are great for bus/signal integrity testing and a quick peak at what's going on, clearly it's not an option for longer captures (many seconds to <5 minutes).I'm most interested in I2C and SPI, although I've worked with MODBUS and CAN too and it would be nice to have those options.The Total Phase Beagle I2C/SPI analyser seems most on point and probably the professional tool of choice however the pricing is a little rich for hobbyist use, especially given that additional purchases would be required for other protocols.Ikalogic's SP209I seems to cover all bases I'm interested in but I take the impression, largely from searching this forum for references (and finding few to none), that the user base isn't large and hence it's a bit of a niche animal. Which isn't reassuring to me at the level of investment required.Analog Discovery 3 seems to promise all things to all men but it's not clear to me from the many product and review videos that it's actually particularly great at any of them.Which then brings me to the multiple LA options, original and clones, with various software front-ends both proprietary and open source. None of which stand out to me as being 'amazing'.Would anyone care to share their recommendations, based on their own use cases?Thanks in advance.

author: wek
author_rank: Frequent Contributor
timestamp: November 24, 2023, 10:11:37 am
content: Quotehttp://www.asix.net/index_prices.htm#sigma2One of those "not amazing LA", but I found it to be fair value for the buck.Plus the good feeling of being a localpatriot.JW

author: mikerj
author_rank: Super Contributor
timestamp: November 24, 2023, 10:49:18 am
content: I have a Logicport (https://www.pctestinstruments.com/) which a fairly old product now but is very flexible with lots of inputs and high sampling speed though not the easiest to use IMO. We also have a few Beagles (https://www.totalphase.com/products/beagle-i2cspi/) at work and if you only need SPI and I2C it's a simpler and easier device to use. The same company also make a couple of USB interfaces that can act as I2C/SPI masters and slaves which has been really handy in the past.

author: Doctorandus_P
author_rank: Super Contributor
timestamp: November 24, 2023, 10:52:31 am
content: I very much like the combination of Sigrok/Pulseview combined with the Cypress CY7CY68013A you can get for EUR 10. It certainly is not the best Logic Analyser around, but as long as your signals fit within its capture range it is a quite remarkable tool. It is a good match for a lot of serial based signals up to a few Msps bitrate so it works for all signals you mention (although SPI is also used with much higher bitrates, upto 80MHz or more, and that is beyond what EUR10 hardware can do for you.I also very much like the protocol decoders in Pulseview. There are over 100 of them and all are written in relatively easy to understand Python (I do quite dislike Python in itself, but that is another chapter). If you have to sift though a lot of data, then writing a custom protocol decoder does seem sensible. It recognizes parts of a bitstream faster then you can, and it can also flag areas the "need more attention".I once hooked Pulseview up to a low speed USB connection (1.5Mbps) and the amount of info I got out of Sigrok's protocol decoder was truly amazing. From T-states and message types to checksums.I recently bought a Kingst LA2016 (EUR130, 16 channels @200Msps). I bought it mainly for use with Sigrok, and when I read it's official software also runs on Linux it made the choice easy. The software is usable, comparable to how other LA's work but it has less protocol decoders then Sigrok. It also has an unfortunate quirk at it quite often does not work properly after power up. It is even mentioned in the manual that when you see a lot of glitches in the data capture you have to power cycle the device. I had some trouble with getting it to work with Sigrok, today I downloaded the latest Sigrok Nightly and was now able (for the first time) to capture some data with it.But before you can use a logic analyzer, you always have to verify signal integrity. Especially with signal types such as I2C that have a lot of analog content. A logic analyzer will not tell you whether the pull-up resistors are too weak compared to the bus capacitance and bitrate, while you see that immediately on an oscilloscope. It may also be necessary to add signal conditioning, for example for RS485 and CAN. This is even more clear when you need to reverse engineer signals that are further away from standard logic. For example HART (which is binary data riding on top of a 4-20mA current loop) or OpenTherm (power and data combined).The combination of very low price and excellent usability makes the Sigrok/Pulseview dongles a very good choice for all beginners, and for more serious work as long as it fits within the capabilities of the hardware. It's quite a shame that Sigrok/Pulseview is struggling the way it is to keep alive at all.---------------------Another avenue is to use an oscilloscope. You can not only use it to verify signal integrity and to figure out what the actual signalling levels are (for things like HART etc) but it is becoming common for digital oscilloscopes to have built in protocol decoders too, and they can go to quite high bit rates. The obvious limitations are the number of channels (rarely more then 4), the limited amount of protocol decoders (sometimes you can buy more, but who pays for software these days?) I have a Siglent SDS1104X-E, but I find Sigrok much more user friendly. The small LA box is much easier to hook up then the big and unwieldy scope probes, and a big PC monitor (3840 pixels wide, 107cm diagonal) combined with mouse panning and scroll wheel zooming is easier to use then the scope interface. I also have a few of the LA boxes, so I can easily put it in a drawer together with aproject on a breadboard (without unhooking it) if I am working intermittently on a project.---------------------Things like the Total Phase Beagle are quite specialized (a.k.a limited) and also quite expensive. But when you go into higher speed signals it may be one of the few options left. Although more capable Logic analyzers are also widely available.---------------------I am guessing that writing custom FPGA firmware is also relatively common. If you have to reverse engineer a protocol you can start with a simple FPGA program to capture a raw bitstream, send it to a PC for analysis, and then iterate to refine the FPGA firmware. And once it works, you can use the same firmware as a library to build your application around. A lot of the LA's are also just an FPGA with some input protection and a microcontroller.---------------------It may be worth looking into how the XBOX was reverse engineered. Lot's of high speed signals and custom made hardware for snooping the signals, and there is quite a lot of documentation available on the whole process.

author: metebalci
author_rank: Frequent Contributor
timestamp: November 24, 2023, 11:14:04 am
content: Quote from: NE666 on November 24, 2023, 09:40:41 amI mostly used I2C and SPI decoding with a scope and sometimes with a digital discovery which seems to be OK if I need longer (but rarely used). I understand what you mean from USB, a protocol analyzer is useful but with I2C and SPI it is not that complicated I guess ? Digital discovery is not enough for your needs ?Quote from: NE666 on November 24, 2023, 09:40:41 amI do have SP209. The only reason I wanted to give it a try was to be able to use one input as external clock (most analyzers work only in timing mode I think, working synchronously with an external clock/state mode is not common) and to be able to use this external clock for sampling at both clock edges (ddr signals, again this is another not very common option for state mode). As far as I know there is no/few devices that can do this at this price point. I did not use it extensively yet to give a review, but I did not see a problem on Linux. On Windows, I have a driver issue, but they said it works fine on Windows, so not sure but it is probably due to a software or device I have. There is an SDK, I found an issue when I was trying it out, they quickly fixed it. So yes niche animal is a good description I think.

author: voltsandjolts
author_rank: Unknown
timestamp: November 24, 2023, 11:44:25 am
content: Quote from: Doctorandus_P on November 24, 2023, 10:52:31 amI bought an LA2016 sometime ago, one of the reasons being that sigrok claimed support for it but actually it did not work at all. The LA2016 internal FPGA is controlled over a SPI bus using two byte transactions (register address|RW + value) and some of those register addresses were wrong in sigrok, plus other things. I submitted patches to fix it up, then Gerhard added support for the LA5016 too. Works well now with Pulseview. I did some work creating an open fpga bitstream, got some small captures working but I got stuck on the DDR2 memory controller.Anyway, LA2016 is quite good tool. Kingst have a store on Ali:https://kingst.aliexpress.com/store/2791035

author: artag
author_rank: Super Contributor
timestamp: November 24, 2023, 01:52:04 pm
content: The Sigrok protocol disassemblers are indeed excellent but as Doctorandus_P says you do need to ensure the signals are within the thresholds of the simple Cypress boards. If you have the budget for it the Saleae Logic series are very good and include analogue capture as well as adjustable-threshold digital on the more capable models.

author: Doctorandus_P
author_rank: Super Contributor
timestamp: November 24, 2023, 10:29:18 pm
content: I find the price/performance comparison of the Saleaeaeae thing quite absurd. They started with USD 200 for an EUR10 uC in a fancy aluminimum box (I would much rather have a simple non-conductive plastic box), the "simple" version has been phased out years ago, and over time they more then doubled the price for their hardware. But apparently it works for them. They have been in buziness for a long time, while others such as USBee which started with pretty much the same hardware gave up long ago.One thing I like about the Sigrok project (pretty much inherent in Open source projects) is their opennessFor example on the bottom of the page for thehttps://sigrok.org/wiki/Kingst_LA2016there is a link to the reverse engineered schematic of the Kingst 2016.https://sigrok.org/wimg/2/26/Kingst_LA2016_LA1016_Schematic.zipIt uses PWM, filtering and an opamp to generate a DC voltage, which is combined with the input protection series resistors to make the trigger levels adjustable.

author: RoGeorge
author_rank: Super Contributor
timestamp: November 25, 2023, 09:32:14 am
content: HW:DSlogic Plusas LA, DSO sometimes (DS1054Z)SW:sigrok+PulseView(the build for DSlogic is calledDSview), sometimesWireShark

author: NE666
author_rank: Frequent Contributor
timestamp: November 25, 2023, 10:25:24 am
content: Quote from: RoGeorge on November 25, 2023, 09:32:14 amThank you, that's very interesting. Having worked on data centre networking in another lifetime, I used to be very familar with Wireshark and indeed, it's UI was what I had in the back of my mind when thinking of what I'd like to have available to me for this task. I'd not realised that it had moved into realms outside of Ethernet.On the back of some very quick googling, it appears to have dissectors available for everything I'd want, with the exception of SPI.Are you saying that the DSlogic Plus has utilities which can capture/export in a format which can then be imported into Wireshark? Or is it limited to capturing I2C over IPMI, as the Beagle I2C/SPI Analyser seems to be?

author: RoGeorge
author_rank: Super Contributor
timestamp: November 25, 2023, 11:59:20 am
content: Quote from: NE666 on November 25, 2023, 10:25:24 amDon't know, never tried that. Searched out of curiosity, and for other HW might be some tools already:https://www.totalphase.com/blog/2020/05/how-do-i-use-a-beagle-i2c-spi-protocol-analyzer-with-wireshark-for-ipmi-analysis/For DSlogic found this:https://re-ws.pl/2022/08/sniffing-usb-traffic-with-dslogic-logic-analyzer-into-pcap-file/Seems like a txt translator from sigrok to pcap. Same as above, never tried that, the GUI from PulseView (DSview in my case) was enough. I remember sigrok doc was mentioning WireShark here and there, don't know if that was only about a static file export, or if WireShark can act (live) as a frontend for sigrok.

author: zapta
author_rank: Super Contributor
timestamp: November 25, 2023, 10:21:15 pm
content: I am an old cheap Saleae 8 bit analyzer and am very happy with it. This model is discontinued but their software updates keeps supporting it and it has an excellent UI.I think it was based on an open design that was cloned (search Aliexpress for saleae logic analyzer), hence their switch to closed and more expensive products.

author: SiliconWizard
author_rank: Super Contributor
timestamp: November 25, 2023, 10:32:51 pm
content: Also have a DSLogic Plus, which is not bad at all. The OP didn't mention max frequency - if it's only up to a few MHz, then even a DSLogic Plus would be overkill, and some cheaper options are available.The DSView app works well enough, but the latest version has issues on some platforms (macOS & Linux) - can't use the 1.3.x versions myself, I had to downgrade to 1.2.2.DSView can export to a few formats: CSV, VCD, Sigrok .srzip and Gnuplot data. Should be enough to use acquisition data outside of DSView.

author: nctnico
author_rank: Super Contributor
timestamp: November 25, 2023, 10:37:15 pm
content: Quote from: NE666 on November 24, 2023, 09:40:41 amFor CAN I can highly recommend getting a CAN interface dongle which connects to your USB port and some dedicated CAN decoding / recording software. This doesn't have to cost an arm & leg.

author: tggzzz
author_rank: Super Contributor
timestamp: November 25, 2023, 11:03:36 pm
content: In a protocol analyser I would like to see the same features that exist in decent logic analysers, except operating further up the stack.So, how do the protocol analysers mentioned fare in these respects...The key feature which make an L.A. more useful than a scope is the ability toignoreirrelevant stuff, thus allowing me to concentrate on the useful information. That is vital when investigating rare intermittent events, or when demonstrating that design constraints are not exceeded. In such cases the ideal is that the engineernever has to look at anything, because there is no fault to investigate. No news is good news!Logic analysers allow you to ignore everythingexceptdata that meets defined complex criteria, e.g. a clocked write to one device on a bus. For a protocol analyser the analogous filtering might be messages to or from a particular address.Logic analysers only start retaining data (i.e. trigger) after a complex sequence of events, e.g. after signal1 then signal2 within 10ms, or when the gap between two events is less than 1000ns or greater than 1020ns. The L.A. is set running for days without it triggering. For a protocol analyser it could be the time between a "job done" message and the next "start job" message.In other words, having an enormous capture buffer is a disadvantage because I have to scan all of it. What I want is to only have to look at a short buffer, because itonlycontains directly useful information.So, what facilities do the protocol analysers mentioned have forignoringstuff?

author: Doctorandus_P
author_rank: Super Contributor
timestamp: November 25, 2023, 11:23:34 pm
content: Quote from: tggzzz on November 25, 2023, 11:03:36 pmGigabytes of RAM, clocks and multi core processors of regular PC's have progressed to such a level of magic that they are able to keep up with most data streams in real time.Back in the '90-ies modems were relative expensive and had DSP's on board. Then PC's became fast enough to take over the task of the DSP and modem hardware was reduced to a cheap an simple interface to the phone line.

author: tggzzz
author_rank: Super Contributor
timestamp: November 25, 2023, 11:31:39 pm
content: Quote from: Doctorandus_P on November 25, 2023, 11:23:34 pmFor conventional computer networking protocols already flowing through a PC, there's truth in that. But I'm still interested in knowing exactly which analysis software has the complex features I mentioned.I'm also interested in, say, an embedded MCU with a couple of logic lines and an SPI bus or UART comms.

author: RoGeorge
author_rank: Super Contributor
timestamp: November 26, 2023, 12:33:27 am
content: Quote from: SiliconWizard on November 25, 2023, 10:32:51 pmI've just downloaded the DSView-1.3.1 from their websitehttps://github.com/DreamSourceLab/DSView/archive/v1.3.1.tar.gzthen unpack, make and install according to the instructions in the PDF (over the already installed DSview 1.2.2, in Kubuntu 22.04). The LA is detected as DSlogicPRO. (I've made a confusion earlier, naming mine DSlogic PLUS instead of PRO).Seems to be working OK.

author: SiliconWizard
author_rank: Super Contributor
timestamp: November 26, 2023, 12:55:45 am
content: Quote from: RoGeorge on November 26, 2023, 12:33:27 amIt does connect successfully and downloads the FPGA configuration (that's what it does when you see the LED going from red to green), but it fails while retrieving acquisition data.Have you tried any acquisition with it? The issue is that it always ends up with an "incorrect packet" error. The issue can be found on their github. It does affect both macOS and Linux (which is not surprising as both use libusb). It's probably a change they've made in the USB communication layer with dodgy timings. So it may work on some machines and not on others. But 1.2.2 has been shown to work for pretty much everyone. Have not bothered looking at their source code yet to figure it out. According to the github ticket, they have posted a fixed version (for macOS) for the person that had the issue to test, and it seems to "fix it", but it's unclear (and I suspect it's not the case yet) if the fix has made it to the mainline code as of 1.3.1. I'm not using macOS, so I can't test their test version.Speaking of which, their officially tagged release in github is still 1.3.0, while the official binaries are at 1.3.1, so not sure how well they handle the github side either.

author: RoGeorge
author_rank: Super Contributor
timestamp: November 26, 2023, 01:08:08 am
content: The tar.gz linked in their dl page athttps://www.dreamsourcelab.com/download/is v1.3.1, which seems to be working fine in my setup. Tried both streaming and buffered mode, no errors, can see the induced mains humm when touching the DI pins.

author: voltsandjolts
author_rank: Unknown
timestamp: December 04, 2023, 07:45:41 pm
content: Quote from: tggzzz on November 25, 2023, 11:31:39 pmCapture everything then filter later is a valid methodology, e.g. sigrok pulseview can do any custom search you wish if you want to write some python plug-in (not too hard). However, this method is a PITA if you need to wait hours for a spurious fault to occur - I had such a problem on a SPI bus and the Keysight 3K series scope SPI triggering options saved my ass. So LAs with advanced hardware triggering have their uses.

author: tggzzz
author_rank: Super Contributor
timestamp: December 04, 2023, 11:31:05 pm
content: Quote from: voltsandjolts on December 04, 2023, 07:45:41 pmIt doesn't work if you want to demonstrate theabsenceof a fault, e.g. that after one particular type of bus transaction a timing constraint is not violated. Capturing and post-processing a day's worth of transactions plus.signals isn't going to work!

author: SiliconWizard
author_rank: Super Contributor
timestamp: December 05, 2023, 01:33:29 am
content: Yeah, people are re-non-inventing triggers. It's innovation for you.

author: tggzzz
author_rank: Super Contributor
timestamp: December 05, 2023, 09:37:25 am
content: Quote from: SiliconWizard on December 05, 2023, 01:33:29 amFor them it is "an unknown unknown". Weallhave our blind spots, and removing/avoiding them is what keeps life interesting. When that ceases to happen, I will be deadA key advantage of logic (or protocol) analysers over scopes is their ability tonotcapture theboring/irrelevantstuff. That leaves us able to concentrate on the unusual/interesting stuff.

author: SiliconWizard
author_rank: Super Contributor
timestamp: December 05, 2023, 09:43:45 am
content: Quote from: tggzzz on December 05, 2023, 09:37:25 amEven scopes (at least the good ones) have advanced triggers, and these can be immensely useful.

author: tggzzz
author_rank: Super Contributor
timestamp: December 05, 2023, 09:49:00 am
content: Quote from: SiliconWizard on December 05, 2023, 09:43:45 amAgreed, but I've never created an arm/trigger/capture FSM for a scope, nor filtering out everything not associated with a clock edge.