AV-over-IP Network Inspector Prototype

Technical Architecture and Systems Engineering Specification

A diagnostic tool for live production has to work with what the network actually lets it see, without putting the show at risk. A laptop plugged into one switch port cannot see every VLAN or every unicast stream, so the tool combines what it observes across four network planes. Any change it makes to the laptop's own network settings must be safe and fully reversible.

Capture Filter and Temporary IP Address Workflow

The app is written in Python for macOS and uses Scapy to capture packets. A kernel-level BPF filter keeps only the protocols the inspector needs, including 802.1Q-tagged frames on trunk ports, so a busy show network cannot overwhelm it. A later stage will add a temporary IP address for reaching devices stuck on a factory subnet, without touching the Mac's internet routing:

# 1. Capture filter (avni/capture.py): Python and Scapy on macOS
#    Runs in the kernel. Keeps discovery, timing and switch protocols, skips
#    bulk media, and repeats the match inside "vlan and (...)" for tagged frames.
AV_CONTROL_TERMS = [
    "arp",
    "ether proto 0x88cc",               # LLDP
    "ether dst 01:00:0c:cc:cc:cc",      # CDP
    "ether dst 01:80:c2:00:00:00",      # Spanning Tree BPDUs
    "ether proto 0x88f7",               # PTP over Ethernet
    "igmp",
    "udp port 319 or udp port 320",     # PTP over UDP
    "udp port 5353",                    # mDNS (Dante, NDI, Sennheiser SSC)
    "udp port 9875",                    # SAP (AES67, ST 2110)
    "udp portrange 8700-8708",          # Dante ConMon
    "udp port 2467",                    # Q-SYS QDP
    "udp port 3702",                    # WS-Discovery (ONVIF cameras)
    "udp port 427 or udp port 8427",    # SLP (Shure)
    "udp port 67 or udp port 68",       # DHCP
    "udp port 5568",                    # sACN
    "udp port 6454",                    # Art-Net
    "tcp port 5959",                    # NDI Discovery Server
]
inner = " or ".join(f"({t})" for t in AV_CONTROL_TERMS)
AV_CONTROL_FILTER = f"({inner}) or (vlan and ({inner}))"

sock = conf.L2listen(iface="en5", filter=AV_CONTROL_FILTER, promisc=True)

# 2. Temporary secondary IP on macOS (planned for a later stage)
# 1. Detect: a device is seen outside the Mac's subnet,
#    for example a Shure AD4Q at 169.254.88.12/16.
# 2. Choose and check: pick a free address in that subnet (169.254.88.249)
#    and send three ARP probes first. Stop if any device answers.
# 3. Snapshot: record the routing table and the default route (netstat -rn).
# 4. Add, only after the user confirms (needs administrator rights):
#      ifconfig en5 alias 169.254.88.249 netmask 255.255.0.0
#    An alias sets no gateway, so internet and VPN traffic are unaffected.
# 5. Lease: the alias lasts 15 minutes and can be extended. The app checks
#    every second that its window is still open.
# 6. Remove on request, when the lease expires or when the app quits:
#      ifconfig en5 -alias 169.254.88.249
#    Then compare the routing table with the snapshot. If the app stopped
#    unexpectedly, it removes any alias it left behind the next time it starts.

4-Plane Broadcast Protocol Discovery and Diagnostic Matrix