Firstly, I'm not responsible for the equipment, so don't panic that I'm asking such basic questions :)

At work we have multiple RS232 / Ethernet port servers (Say the 16 port version of this http://www.digi.com/products/serialservers/portserverts)

I have basic understanding of the OSI model and how protocol's at different layers interact. For example http being encapsulated in TCP packets using IP, which in turn are encapsulated in ethernet frames for the router layer using MACs etc etc.

I'm having trouble getting my head around what protocol is actually being transmitted in the cat5 cable of these port servers however. Is it straight RS232 which has simply had the wires remapped to an ethernet cable? Is it RS232 protocol encapsulated in some ethernet protocol (Ethernet is LLC / MAC yeah?)? Am I getting protocol's mixed up - i.e. RS232 and LLC is at the same level?

The motivation for the question stems from my work currently paying a couple of grand for serial analysers. Essentially it plugs inline with the cat5, is converted into a physical RS232 plug, has the tap with a USB output, and the reverse happens to have cat5 continuing again. I'm wondering why I can't make something like a simple passive ethernet network tap, and use two ethernet NICs bonded together and monitor the application protocol with wireshark. To research this further I'm trying to find exactly what protocol would be sent around in the port servers.


  • 1
    You might want to try posting this question on ServerFault. – paddy Mar 13 '13 at 23:16

Actually this is really very simple. I've probably written a RS232 to TCP 3 or 4 times in different jobs.

How it works in its simplest form is a piece of software reads data from the serial port, and directly writes it to a connected TCP socket. It also does the reverse, data read from the socket is directly written to the serial port. There is no protocol encapsulation over the IP/RS232 link. It simply routes from one to the other.

That's pretty much all there is to it. However, often you install some software onto your PC which gives you a virtual serial port. That serial port ends up talking real RS232 on the port server. There may be some headers poked into the data stream to control flow control. It all gets stripped off at both ends so that an application interacting with the serial port will think it's talking directly to a real RS232 port.

If you want to sniff this data then you just need to sniff all traffic going to the IP of the serial port server with wireshark. You'll then see whether the data is going through unaltered as your app sends it or with some headers included which will be for flow control.

  • Good answer - but it is worth saying that this won't work over SSH (because the specific devices linked support/use ssh) - the OP needs to make sure they work with Telnet. – davidgo Mar 14 '13 at 0:44
  • 1
    Actually, I must confess I didn't look at the details of the device directly. But what I said above is essentially correct (in terms of how it works). The only difference is that instead of an unencrypted TCP socket, it's using SSL ontop. Their virtual serial port is called "RealPort" and it just uses SSL to encrypt the data. There may be a way to turn off the encryption to sniff with wireshark. Otherwise you can sniff it at the RS232 level or at the application level with a RS232 sniffer. – Matt H Mar 14 '13 at 1:45
  • I love the marketing gimmick for the RealPort. Instead of 4 devices with 4 TCP connections, it's 4 devices with 1 TCP connection to the realport. Oh wow! that's amazing!! hehe. I guess it's like trying to market notepad.exe – Matt H Mar 14 '13 at 1:48

The fact that in some cases CAT5 cables and/or 8P8C (aka RJ45) modular connectors are used for serial communications does not mean anything. RS232 and Ethernet use absolutely different signalling. You can not replace a serial analyzer with a NIC. You can find a less expensive version of RS232 analyzer though.


In a nutshell - you will probably find that the RS232 session is wrapped up in a TCP session.

All I can do is provide an educated guess at how your particular devices are working, but if memory and experience serves, the boxes will effectively convert a telnet (or possibly ssh) session to a terminal session.

This is to say that they will run some kind of Network stack on the one side where you communicate with TCP, and it converts this to the bits required for a session.

You should not need to concern yourself with MAC addresses or similar of the terminal server (at least not as far as using it goes).

To specifically answer some of your questions -

  • The cat 5 cable is transmitting ethernet frames. Packets for a TCP session will be incorporated into the ethernet frames.

  • The RJ45 ports for the serial interfaces are "different" to the RJ45 ports for ethernet. The port is physically identical, but electrically totally different. (Think someone cutting a serial cable in 2 and crimping one side to an RJ45 cable, which you can do to make that cable) The exact wiring will depend on the device you get, although most are pretty standard. (Serial cables which you can plug the pins into in your desired order are very common and cheap if you know where to look)

  • RS232 is not an encapsulation, its a raw byte stream. It does not really compare with LLC (if my understanding of LLC is correct). Its just raw bits on a wire sent with a specific speed.

  • You can't make an Ethernet tap because its not analogous or comparable to an ethernet device. USB is actually a serial interface (Universal SERIAL Bus).

  • I've never tried it, but I imagine it should be possible to find the TX and RX lines on a serial cable (pins 2 and 3 from memory), tap a copy of the signal [ I'm not an electrical engineer, so don't know to much here, I'd hack around with a resistor to provide a high impedence on input ] and feed that into another Serial port [ if you don't have one, via a USB to serial interface ], plug that into a computer running a terminal program like minicom - you will need to make sure the baud rate and other settings match, but you should be able to do it "read only" - although you might need a separate outputs for the tx and rx line in the simplest case - to see both sides of the transaction.

  • The OP was referring to the serial side of PortServer which happen to use RJ45 jacks for the RS232 ports. There is no encapsulation at this point - just pure RS232. – Alex P. Mar 13 '13 at 23:23
  • Yes. Thats what I said. (There appears to be a formatting bug so my bullet points did not separate, but that was my second bullet point) – davidgo Mar 14 '13 at 0:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.