What changed in BacCat

Changes to the reports BacCat writes, newest first. The version is in every report's header. What changed on the site

0.9.111 — the copyright and trademark notice at the foot of each report

The foot of every report carries the copyright notice, the BACnet trademark notice, and where the vendor names come from. Nothing else in a report changed.

0.9.110 — MS/TP: a device that sends frames with a broken network header is named; a router's refusal names the device it refused

MS/TP: a device that sends frames with a broken network header is named. A frame whose checksums are good but whose network header BACnet does not allow is listed under Packet errors with the device that sent it and what is wrong with the header (for an address too long, the longest that is valid). Such a frame was sent that way, not damaged on the wire, and Wireshark's own reading of it is not what was sent.
A router's refusal on an MS/TP trunk names the device it refused. The line read "rejected 3 messages from for network ..." with no one named. Refusals that say the same thing are now one finding with a count, not one each.

0.9.108 — damaged MS/TP frames that Wireshark misses, caught; names and values from long answers; the firmware each device reports; Phoenix hoods: the controllers' Who-Has fault, and a controller's return judged by its own sash reading; a capture with an hour of nothing in it analysed in parts

MS/TP: damaged frames that Wireshark misses are caught. A frame cut short, or damaged where Wireshark does not check, is now counted as corrupt and left out of every analysis like any other corrupt frame, instead of reading as a device, a network or a router message that was never there. Each count of corrupt frames says how many of them Wireshark's own check missed.
Names and values from long answers. When a device answers a read in several pieces, the names and values in them now appear in the device inventory and the Polling and COV tables.
The firmware each device reports, where the capture holds its answer, in a new column of the device inventory.
Phoenix hoods: firmware and the Who-Has fault. The hood displays (FHD) are listed beside the controllers (ACM), each with its firmware, with a warning when they are not all on one generation or, within one, on one release. Controllers on firmware older than 1.3.1.14 are named as exposed to the fault in which an ACM stops transmitting after a Who-Has, and each ACM that went quiet right after one is named, with how often and for how long.
Phoenix hoods: a controller's return judged by its own sash reading. A controller that comes back from a silence at a new setpoint because the sash was moved meanwhile is no longer called a disturbance. The disturbances table shows the controller's own sash reading before and on return, and "none" where it reports no valid value.
A capture with an hour or more of nothing in it is analysed in parts, each recording on its own tabs, and the top of the report says when each was recorded.
Smaller: a capture of MS/TP trunks alone no longer says its times may be on a different clock from a LAN's.

0.9.99 — corrupt MS/TP frames explained, devices that transmitted while off the token ring, a device sending too fast, the trunk's baud rate as the capture states it; devices stopping after a broadcast only on a pattern; poll periods point by point; three kinds of capture that failed now get their report

What each corrupt MS/TP frame shows. Corrupt frames are counted as Wireshark shows them, every piece of a garbled frame included, with the transmissions they came from. For each one, the Packet errors table says what was going on and how it is known: a device that was off the token ring transmitting, two tokens on the ring, two devices talking at once, a device's late transmission, the ring restarting, or nothing else going on; the finding names the devices.
Devices that transmitted while off the token ring. A late token pass is now one sent after the device offering the token gave up on it. The finding counts everything a device sent while off the ring, with its late answers on a line of their own, and a new table lists each of those frames by number.
A device sending too fast is named. When every byte from a device arrives with its last bit read wrong, the report warns, names the device and says when it joined the ring. Before, its frames were only counted as corrupt.
A trunk's baud rate is the one the capture states, checked against the frames, with a warning and the rate they fit when they could not have been sent at it. Without a stated rate, the rate read from the frames no longer depends on how fast the devices answer.
Devices stopping after a broadcast is reported only on a consistent pattern, and a device's silence is put down to a broadcast only when the broadcast came before the request it missed. A regular Who-Is is no longer blamed for silences it had nothing to do with. The silences and dropout tables no longer name a broadcast; the finding and the charts do, where one matters.
Poll periods measured point by point in Polling's "By client and server": a poll that a slow trunk splits up no longer reads as a period of minutes, and a retried request is not counted as a read.
The Topology tree on BACnet/IP shows the devices addressed through a router on a non-standard UDP port, and a router that relays nothing back, with its network and the devices behind it, as on an MS/TP trunk.
Three kinds of capture that made an analysis fail now get their report: a trunk where every frame failed its checksum (the report says nothing on it can be read, and that the adapter's baud rate or polarity most likely does not match), a network whose requests all came in the capture's last seconds, and a Phoenix hood display heard only by its heartbeats when its valve controller goes quiet.
An MS/TP capture that begins in the middle of a frame says so, under Packet errors, instead of counting the piece as corrupt.
The broadcast load is said "on this port" on every kind of network; on BACnet/IP it said "site-wide", which a capture cannot show.
Smaller: "Token cycle over time" draws the median cycle beside the longest; the Ring timeline's count of devices in the ring no longer drops to 0 on a row that changes nothing; Max_Info_Frames is "at least" the most frames seen in one hold; "By responding device" puts retries, errors, unanswered and open in one column; a timing that was not measured is left out instead of printed empty; the Phoenix section says "No ACM silences".

0.9.80 — Phoenix hoods: the valve's flow reading beside the hood display's dropouts, and each controller's firmware; long replies through a router read right; a saved report's tabs work; findings said more plainly

The valve's flow reading beside the hood display's dropouts. The Phoenix section shows, hood by hood, each change in the valve controller's (ACM's) flow reading beside the times the hood display (FHD) dropped off the token ring, with a table counting the FHD's dropouts that came just after a change.
Each ACM's firmware generation, read from its broadcasts, in a table of its own, and a warning when the ACMs on one trunk are not all one generation.
Long replies read as each device sent them. Where a router answers for the devices behind it, pieces of two devices' replies could be read as one, which could name a device by another's number and report a device number used twice when it was not.
Times on a router's capture. A port tab or the LAN tab counts its times from the first frame of its own split-out capture, the file its frame numbers refer to, and says so, with how far that is from the uploaded capture.
A saved report works on its own. Saved from the browser ("Save page as", Webpage, Complete), a report's tabs and links open in the saved file; before, they tried to go back to the website and failed.
"Never answered" only where it is proven: where the capture cannot settle it, the device was "not seen to answer", and the finding says why; where a reply could not have been seen at all, it is an information line, not an error.
"What needs attention" says each problem in a short sentence of its own, and lists every router problem, several of one kind counted in one line.
Findings say what the capture shows and no more. Devices stopping together after a broadcast on the IP side is stated as that fact, with no advice; an object's name is printed exactly as the device has it; a count of one is in the singular; the reads of the wildcard device name each address in full.
MS/TP through a USB adapter that delivers frames in batches: the report says so at the top of the page and on the trunk's card, names the adapter's latency timer as the likely cause, and gives no baud rate or trunk load rather than wrong ones. A load over 100% is never printed; a heavily loaded trunk is a warning in the findings too.
Phoenix, smaller: a trunk of valve controllers with no hood display no longer makes the section fail, and those controllers are listed, not warned about; an ACM that misses one status broadcast is no longer reported as having gone quiet; a value never seen shows a dash, not "nan" or "0.0".
Sections that no longer go missing: Change-of-value, when a device accepted a subscription and sent nothing (the finding says what the device answered), and Polling, Broadcasts and the router section on a few unusual captures.
Smaller: a capture with no BACnet traffic says so once; a capture with too few broadcasts to measure a rate says how many it holds instead of warning; on the Traffic tab a device behind a router that was only ever sent to is counted on its own network; a trunk's summary card no longer says "Nothing on this trunk stands out against the others".

0.9.67 — on an MS/TP trunk, three faults the report did not name before, each an error; and findings that say only what the capture shows

A second token on the ring. A device that passes the token after the ring has already moved past it is now its own error at the top of the Token ring section, apart from devices dropping off the ring: it is the token passed wrong, not a device losing communication. The finding says how late each pass came after the offer and how many corrupt frames the two tokens' collisions left. The summary table has a row for it and every trunk's summary card says "Token passing faults: N late passes by M devices".
A stretch of the bus the capture point cannot hear. Devices that sent nothing the capture heard for many seconds while the token kept going through them (their neighbour kept offering it, the next device kept passing it on) are an error on the trunk's wiring between them and the capture point, not on the devices. The window is shown on the ring timeline and no longer counts as the trunk's worst token cycle.
The router off a trunk's ring. On a router's own capture, the router being off a trunk's token ring at all is an error on the Through-the-router section, with when, for how long, and what waited in its queue meanwhile.
Any device dropping out of the token ring is an error, including a single device and the short stalls; both were warnings before.
On a router's own capture, the Through-the-router section tells a request that waited because the router was off a trunk's token ring from one that waited in the router's queue: the queue figures are given with and without those waits, the absences are listed with what waited for them, and a broadcast copy that waited is counted apart from the others' delay.
Broadcast kinds in the fan-out table are named (who-Is, who-Has, i-Am, Who-Is-Router-To-Network) instead of numbered.
When several devices stop taking the token right after a broadcast, the finding names every broadcast that arrived together (a Who-Is and a Who-Has a tenth of a second apart are both named) and stops at pointing at the broadcast; it no longer tells you to find the sender, check firmware or suppress the sender.
A device asked for by Who-Is with no I-Am in the capture is called "never answered" only when a reply to the asker would have crossed the capture point. Otherwise it is "not seen to answer", and the finding says whether a reply would not cross this capture point or whether that could not be settled; the Discovery count reads "Devices asked for, no I-Am seen".
A Phoenix hood with no valid control loop is reported from its values alone; the finding no longer says what its display is showing.

0.9.62 — every point read or notified, by network and device, with its name and what it reported

The Polling section has By device and points read: folded by network, then by device, every point read on each device in object order (device, analog, multi-state, binary; input, value, output), one line per point with its present-value. A point whose other properties were read opens to list them, each with the value it read. A point the device refused to read shows the refusal ("unknown-object") where the value would go.
The Change-of-value section has By device and points notified, the same shape: folded by network, then by device, every point that sent a notification, in object order, with what it reported. The table above it lists the most-notified points.
Points carry their names where the capture holds them. When a tool read a point's Object_Name during the capture, the COV and polling tables show it (SPACE_TEMP beside analog-input 5), findings use it, and the Inventory shows each device's own name. A name belongs only to the exact device that answered the read; a point nobody named stays as its object.
The COV and polling tables show what each point reported over the capture: one value when it never moved, the range when it did; inactive/active for binary points, the states seen for multi-state ones. Fast-poll and COV-flood findings quote it too.
On a trunk tab, a station that polls through the router is no longer labelled as some other device whose announcement happened to arrive through the same router. It reads as unidentified, with its network and address, and its own findings are listed under it rather than under the wrong device.

0.9.55 — a timeline of discovery broadcasts, the capture length up front, and quieter findings

The Broadcasts section has a new picture, Discovery broadcasts over time: a tick for every Who-Is, I-Am, Who-Has and I-Have on the capture clock, so whether the I-Ams come in clusters behind the Who-Is or arrive on their own is visible at a glance. Global broadcasts have their own rows, because a global broadcast is repeated onto every MS/TP trunk on the site; any other kind of broadcast that is global gets a row too. I-Ams that no Who-Is asked for are red.
Every LAN and trunk overview opens with the length of the capture, so the counts and rates beside it can be read against it.
A router on a BACnet/Ethernet segment is no longer reported as two routers claiming the same network.
When an address is asked for by ARP over and over with no answer, the report says why that means nothing is there, rather than a reply the capture could not see.
The warning that a BBMD's inbound unicast is missing from the capture now links to the Topology section, where the capture point is worked out.
"What needs attention" says "There are no errors or warnings on this link" when that is so.
The device-numbers picture says that devices whose number was never revealed are not in it, and points to the Inventory table.
Two findings are notes rather than warnings: one device sending most of the frames, and a requester polling in bursts. Both are the normal shape of a supervisor polling a site.

0.9.50 — corrupt frames out, short captures counted, a LAN overview and two new figures on every tab

Frames that arrived corrupt (a failed checksum) are no longer taken at their word. Before, whatever a corrupt frame happened to look like went into the report: a device "addressed, never heard from" at an address nobody used, a network that does not exist, stations that are not on the trunk, a request "never answered" that was really a garbled reply, and, worst, a router blamed for losing replies it had rightly thrown away. Now they are excluded from every section, the Capture summary says how many were ("6,357 frames, 23 corrupt excluded"), and the count is its own error finding, since a frame that failed its checksum is a line fault whatever else is going on. On an MS/TP trunk the corrupt-frame finding under Errors is now always an error too.
Unanswered requests are now counted on short captures. A request the requester retried and then gave up on is reported as unanswered whatever the length of the capture; before, a capture under ten seconds always reported 0% unanswered, and a device that never answered showed only as a retry-rate warning.
A BACnet/IP or Ethernet link's tab now opens with a LAN overview, as an MS/TP trunk's opens with its Trunk overview: the frame rate, reply time, unanswered requests and broadcast rate at a glance, a bar of what the traffic is made of (polling, COV, discovery, writes, a vendor's private traffic), and a chart of frames per second over the capture, stacked the same way, so a polling burst, a discovery storm or a quiet spell is visible without reading a table. A reply counts with the request it answers. Under Traffic, the same breakdown as a table.
Two more pictures on every tab. Outcome by device (Requests and replies): a bar per device showing how its requests ended, answered, answered after a retry, answered with an error, never answered, with a bar for the whole link on top; a device that says no to everything or never answers at all is one glance instead of a row in a table and a line under it. Device numbers by network (Devices): a dot per device at its number, one row per network, so the site's numbering plan is visible, and a number used twice, on two networks or on one, shows as the same red dot in two places.
BacCat reads captures taken on an ARCNET network: the stations, the routers among them and everything the other sections say about an MS/TP trunk, with the same "mac N" addresses. A file whose header names the wrong ARCNET framing (Wireshark shows it as malformed) is read correctly anyway, and the report says so.
On an MS/TP trunk, broadcasts sent to the trunk itself (address 255) are now counted as broadcasts; before, only the ones addressed to every network were, so a trunk's Broadcasts section could be low by thousands. A vendor's own heartbeat traffic (private transfers) is listed but does not raise the broadcast-load warning.
On an MS/TP trunk the Transactions, Polling, COV and Broadcasts tables now name the device at each station instead of "unidentified".
A capture that holds I-Am announcements but not a single Who-Is request (a router re-announcing its devices, or a capture that starts just after the request) used to lose its Broadcasts section with "analysis 'broadcasts' failed". It is reported normally now.

0.9.43 — a Topology section on every tab

BacCat now shows a topology map of the network as seen from the capture: a tree of this subnet's BBMDs, routers (with the networks and devices behind each) and devices, then what reaches it from other subnets. On an MS/TP trunk it is the stations on the wire, the routers among them and what sits behind each.
A device that was polled but never answered is placed in the tree where it would sit, marked "addressed, never heard from", so a silent network shows where it is.
The report says where the capture was taken (which switch port is mirrored, or which host is capturing) when the traffic proves it, and for each device whether unicast to it was visible from there. Where it cannot prove a capture point it says so.
Each device's network-card maker (Automated Logic, Johnson Controls, Dell, Carel...) is shown; it is often the only clue to a device that never identified itself. Addresses a router made up for LON or other non-Ethernet nodes are called "synthesised", not Ethernet.
One network number reached through two routers is an error, and the report says which kind: one bus with two routers, or two networks under one number.
Two BBMDs on one subnet is an error. A routing loop is an error. A Reject-Message-To-Network says which frame was refused.
Discovery now covers Who-Has, I-Have, Who-Is-Router and I-Am-Router, lists every station that asked anything, and says for each search whether the reply was yes, no, not visible from this capture, or unproven.
A device that one requester keeps asking for with no answer is a warning wherever the requester is; "What needs attention" names the devices that never answered anything.
Smaller: one inventory on the Devices tab, unidentified addresses at the bottom, with a role column naming BBMDs and routers; the Polling table says whether each pair's traffic is a poll, a sweep or bursts; the broadcast-load warning counts global broadcasts once; long tables and long finding lists are folded with their count.

0.9.37 — one tab per BACnet link on a wire, and a tab for the router between them

A capture with more than one BACnet link on one cable (BACnet/IP and BACnet/Ethernet, or BACnet/IP on two UDP ports) gets one tab per link, each with its own file for Wireshark. A one-tab report counted every frame the router copied across twice.
A router seen from both sides gets its own tab: its ports and network numbers, what it announced against what it relayed, every frame it copied and the delay, and why each frame it did not copy was not copied. A network it relays but never announces is a warning.
Each tab's heading names the link's network number when the capture proves it.
Two IP subnets on one cable with no BBMD between them is an error: broadcasts on one are never heard on the other. Put every device on one subnet, or run a BBMD in each.
A device whose address changed during the capture is called out at the top of its tab, with both addresses and when it moved.
COV notifications on BACnet/Ethernet and MS/TP now show their object. Devices that only ever sent COV notifications are in the inventory.
"Asked for, never answered" is a warning only when the asker is on this link; a request that came through a router is noted, not flagged, because its answer goes back the other way.

0.9.34 — every tab names the file its frame numbers refer to

Every tab says which file its frame numbers refer to. For a capture with several links, each link's tab counts frames in that link's own file, renumbered from 1; the Router tab counts in the whole capture. A frame number in the report can be typed into Wireshark's "Go to packet" in the file the tab names.
On app.strongtech.us the per-link files can be downloaded from the capture's page, singly or as a zip.

0.9.33 — BACnet on any UDP port, LON/IP kept, large captures no longer fail

BACnet/IP on a UDP port other than 47808 is found from the traffic itself and analysed like any other; nothing to set. Before this version such traffic was discarded on upload, so upload those captures again.
LON/IP (IP-852) traffic is kept in the prepared capture, on its standard ports and any other port it is found on. It is not analysed yet; the report says how much there was and on which ports.
What is kept from an upload has changed: IGMP, VRRP, HSRP, EAPOL and NTP are now kept; DHCP no longer is, because it can carry the names of personal devices. The upload page and the Terms state the list.
A capture with many thousands of polled requests to one network failed with "The analysis failed unexpectedly". Fixed.

0.9.31 — older captures, fewer false alarms, BBMDs, times that match Wireshark

Classic .pcap files now open; they failed before.
Fewer false alarms: a device seen by more than one route is no longer a duplicate-instance error; a device readdressed during the capture is a warning that says so; "nothing is polling this link" is no longer concluded from a capture that simply saw no polling; the Change-of-value section no longer notes every subscription that began before the capture did.
BBMDs are identified and labelled, including one that only relays others' broadcasts, with a table of how much each relayed.
When a BBMD's inbound unicast is missing from the capture, the report warns that unicast on that network was invisible from the capture point (usually an unmirrored switch port), so polling, COV and device figures may be incomplete.
Every time in the report now matches Wireshark's Time column for the same file: counted from the first frame in the file, not the first BACnet frame, and from the whole capture on a router's multi-link capture. A frame stamped before the first frame shows a negative time, as Wireshark does.
Change-of-value tables show seconds and rates to one decimal; device instances no longer show a trailing ".0".

0.9.22 — initial public release

The first public version of BacCat: upload a BACnet capture and get a single self-contained report, with a plain-language summary and a tab for each link in the capture.