Wiznet makers

Project Overview

Anyone who has ever done cable management in an office or data center knows the frustration: dozens of Ethernet cables tangled together, and no easy way to tell which cable connects to which switch port. Commercial solutions mean spending hundreds to thousands of dollars on a handheld cable tester.

This project reproduces the core feature of those tools at a fraction of the cost.

An ESP32 paired with a WIZnet W5500 passively sniffs LLDP/CDP packets from the Ethernet cable, then instantly displays the connected switch name, port, and VLAN on an OLED screen. Results can also be read wirelessly via BLE from a smartphone.

Protocols Used: LLDP and CDP

LLDP (Link Layer Discovery Protocol)

An IEEE 802.1AB standard, vendor-neutral Layer 2 discovery protocol.

• Switches and routers periodically broadcast their information every 30 seconds by default as multicast frames to all ports
• Destination MAC: 01:80:C2:00:00:0E, EtherType 0x88CC
• Data is carried in TLV (Type-Length-Value) structures: System Name, Port ID, Port Description, VLAN info, and more
• Supported across all major vendors — Cisco, Juniper, HP/Aruba, MikroTik, Ubiquiti — making it ideal for multi-vendor environments

CDP (Cisco Discovery Protocol)

A Cisco proprietary protocol, predating LLDP (1994) and still enabled by default on most Cisco equipment.

• Default interval: 60 seconds, destination MAC 01:00:0C:CC:CC:CC
• Uses LLC/SNAP encapsulation (hence the 26-byte header skip in the code)
• Carries Device ID, Port ID, Native VLAN, Software Version, PoE negotiation info

This project parsing both protocols is a deliberate design choice — you never know which vendor's switch is at the other end of the cable.

The Technical Core: W5500 MACRAW Mode

Most W5500 tutorials cover TCP/UDP socket programming (web servers, MQTT, etc.). This project uses a lesser-known W5500 feature: MACRAW mode.

What Is MACRAW?

A standard socket receives only packets addressed to the device, after passing through the IP stack. A socket opened in MACRAW mode bypasses the IP stack entirely and receives all raw Ethernet frames — including those not addressed to the device. This is how the project captures LLDP/CDP frames that are multicast to specific MAC addresses.

// Switch W5500 socket 0 to MACRAW mode (direct register access)
w5500.execCmdSn(0, Sock_CLOSE);
w5500.writeSnMR(0, SnMR::MACRAW);  // Socket 0 → raw L2 capture mode
w5500.execCmdSn(0, Sock_OPEN);

The library used (sstaub/Ethernet3) does not expose MACRAW through its standard API (EthernetClient / EthernetUDP), so the project accesses the internal utility/w5500.h object directly to manipulate the registers.

Solving the DHCP vs. MACRAW Socket Conflict

MACRAW occupies an entire socket exclusively. Since the buffer is concentrated on a single socket (Ethernet.init(1), 16 KB), obtaining an IP via DHCP and running MACRAW sniffing must share the same socket in a time-sliced fashion. The solution:

1. Boot → set MAC only (initialize with IP 0.0.0.0)
2. Core 0 FreeRTOS task → run DHCP in the background
3. DHCP complete → close the socket, reopen in MACRAW mode, start sniffing
4. Main loop (Core 1) → check dhcpTaskRunning flag to avoid SPI bus conflicts

This is a practical pattern for time-slicing W5500 socket modes on a shared SPI bus in a multi-core ESP32 environment — the code itself is a useful reference.

Hardware Configuration

The board used is the LilyGo W5500-Lite (ESP32 + W5500 + SSD1306 OLED, integrated).

⚠️ The similarly named "T-ETH-Lite" uses a LAN8720/RTL8201 PHY — it is a different board and does not use a WIZnet chip. Don't confuse the two.

Software Stack

• OLED (U8g2, SSD1306): 4-page cycle — Topology / IP status / Traffic stats / QR code. Long text is scrolled with a marquee effect
• BLE (NimBLE-Arduino): Advertises as T-Lite-Sniffer; exposes SwitchName|PortID as a single characteristic (READ + NOTIFY)
• Web Bluetooth dashboard (src/webbt.html): A browser-based viewer that subscribes directly to the BLE characteristic

Comparison with Commercial Solutions

The feature this project replicates is handled in professional settings by equipment costing hundreds to thousands of dollars. The most representative product line is the NetAlly LinkRunnerAT series — from the company that built the world's first handheld network analyzer in 1993 (formerly Fluke Networks, then NETSCOUT, now NetAlly).

Price Comparison

Full product overview: https://www.netally.com/linkrunner-ethernet-testers/

Prices vary by distributor and bundle configuration — verify current pricing at the links above before publishing.

Feature Comparison

Key takeaway: This project reproduces exactly one feature from a commercial tester — switch/port/VLAN auto-identification — at roughly 1% of the cost. PoE testing, cable TDR, cloud reporting, and topology mapping are intentionally absent. Rather than positioning this as a replacement for commercial tools, it's best framed as a technical demo showing that WIZnet W5500's MACRAW capability alone is enough to build a practical field tool.

Summary

This project is a strong reference showing that the W5500 goes beyond being a simple TCP/UDP offload chip — it can serve as the foundation of a Layer 2 network diagnostic tool.