How to capture AVB audio packet (IEEE 1722) by wireshark?

If you have a simple question and just want an answer.
Posts: 1
Joined: Tue Oct 27, 2015 2:56 am

How to capture AVB audio packet (IEEE 1722) by wireshark?

Postby gibbsshih » Tue Oct 27, 2015 3:39 am

Dear all: I bought an AVB switch ( and an audio AVB endpoint (, then try to streaming out audio from Apple Mac mini (talker) to AVB endpoint (listener). due to some research reason, I need to capture AVB packet for studying. Mac mini (talker) and AVB audio endpoint (listener) plug in switch LAN port , and wireshark installed on Mac mini. I follow this guide for audio streaming out (, and capture AVB packet simultaneously. but I do not capture any 1722 packet when video streaming. There are only appear 1722.1(AVDECC), maap, gPTP packet. someont tell me that I can not see audio (1722) packet by wireshark, that's very strange, is it true? or I miss some setting? thanks for anyone suggestion. 
You do not have the required permissions to view the files attached to this post.
User avatar
Respected Member
Posts: 275
Joined: Fri Mar 12, 2010 6:03 pm

Postby larry » Tue Apr 26, 2016 6:46 pm

What is your Mac model, OS X version and Wireshark version? Recent systems have AVB capable NICs and OS support and capturing via Wireshark with AVB support should work.
User avatar
Active Member
Posts: 62
Joined: Mon Jun 10, 2013 2:14 pm

Postby ers35 » Sat Apr 30, 2016 3:25 am

I confirm what gibbsshih is seeing. I have never been able to capture 1722 packets with Wireshark on a Mac. I suspect the OS X networking stack has a special case to filter out the traffic before Wireshark is able to see it.

Hook up an AVB switch with mirror capability and use Windows or Linux to capture instead.
XCore Addict
Posts: 230
Joined: Wed Mar 10, 2010 12:46 pm

Postby peter » Thu May 05, 2016 12:37 pm

Another alternative is to use a LAN tap to capture the packets on the wire in both directions to another machine:

We use these regularly for testing internally. You will obviously need two NICs in order to capture the data in both directions.
New User
Posts: 2
Joined: Mon Mar 10, 2014 8:01 pm

Postby henry301128 » Sat May 14, 2016 12:43 pm

I got XMOS daisy-chain eval board and follow start guide to use a Mac Mini Late2012 to play music through AVB network. It works. I can hear music from XMOS eval audio card output port. But when I use Wireshark(version 2.0.3) in the Mac machine to filter packet by using ieee1722.subtype==0, there is no packet displayed, and then I can't see AM824 data. My Mac os is OSX 10.9.5. Could any body advise what's wrong with it ?
User avatar
Respected Member
Posts: 275
Joined: Fri Mar 12, 2010 6:03 pm

Postby larry » Thu Jul 28, 2016 1:39 pm

To tell if network interface is AVB capable, look in output of

Code: Select all

on command line. Note that even non-AVB interface see most or all traffic, including 1722. The "AVB-ness" is 1588 support, timestamping of received packets in Ethernet MAC and shaping of sent packets.

On modern MacBooks without Ethernet socket you can use Apple's USB Ethernet adapter. It shows as not AVB capable, but will show 1722 traffic.

1722 traffic won't appear on spare switch ports, because it is a layer 2 multicast that you'd have to explicitly join. I don't think you can do that from your host. You could do it on your switch if your switch has a good configuration interface. Or temporarily change 1722 to broadcast in avb1722_create_packet:

Code: Select all

        pEtherHdr->DA[i] = stream_info->destMACAdrs[i];
In theory, switch should flood all broadcast traffic to all ports. For some reason my MOTU switch doesn't, maybe it's filtering based on EtherType as well. You'll need to check what your switch does.

A wire tap such as the one suggested by Peter is an elegant solution.

Who is online

Users browsing this forum: No registered users and 2 guests