Hi all,
I have an E7495A that I purchased a few years ago off of eBay used that I've used successfully for one- and two-port measurements, distance to fault, and as a general spectrum analyzer. It has come in very handy for all of these functions. I decided recently to extend its functionality by purchasing a power probe, the Agilent 8481H (-10 to +35dBm), from eBay. The seller claimed that it was working, and seems reputable, however, after running the 'zero' and 'calibrate' functions, this power sensor reads around -19dBm with the power reference turned on (and the sensor hooked directly to the power reference output). From reading the manual, I believe it should read 0dBm (1mW @ 50 Hz is the rated output). It
does read very low with the power reference turned off (about -40dBm).
For lack of any other useful instrumentation, I tried measuring the power output using an RTL-SDR and about 39dB of attenuators chained together. The RTL-SDR showed -28.94dB of input power (appearing as a peak at around 50 MHz), which gives +10.09dBm coming out of the '7495A... or 10mW instead of 1mW (a ten-fold increase).
I did do a continuity check of the probe cable, and it seems OK.
For lack of instrumentation to check with (I do not have another power meter or probe), I'd like to check the power sensor reading using not the power reference port, but the E7495A's built in generator (if possible). I am able to telnet into the instrument (thanks to info on this thread). I have seen some of the Java GUI reversing bits on this thread as well, so I was curious to try to find out if there is a back-door way of commanding the power reference on while the spectrum analyzer is running, or likewise turning the generator on when the power meter application is running.
To that end, I found this bit in PowerMeterScreen.class:
MenuItem createPowerRefButton()
{
return new MultiStateActuatorButton(PowerMeterMeasurementSettings.instance().getPmRef(), getContextString("powerMeterCalibrate.powerRef"));
}
If I dig into MultiStateActuatorButton, I can see that the first argument to the constructor is a 'ListActuator' that the MultiStateActuatorButton uses to "do the thing" when the button is pressed:
public MultiStateActuatorButton(ListActuator paramListActuator, String paramString)
{
super(paramListActuator.getLabel(), paramString);
this._actuator = paramListActuator;
addActionListener(this);
}
public void actionPerformed(ActionEvent paramActionEvent)
{
if (!isFocused()) {
getMenuPanel().focusButton(this);
}
this._actuator.increment(); <<< The magic
repaint();
}
Skipping some in-between stuff, the getPmRef() method returns this:
private ListActuator _pmRef = new ListActuator("pwrMeter", "pmRef", Text.SCREEN_POWER_POWER_REF, new Value[] { Value.createValue(Text.ON, 1), Value.createValue(Text.OFF, 0) });
where the ListActuator constructor takes these args:
String paramString1, String paramString2, String paramString3, Value[] paramArrayOfValue
I got kind of lost reading through ListActuator, but it looks like ListActuator ultimately sends a command to the elgato server with the send() method of the WebPlugConversion() class.
It looks like WebPlugConversion then uses the Command() class to build a string that it sends:
public static Command makeSetCommand(String paramString)
{
Command localCommand = new Command("set");
if (!paramString.equals("global")) {
localCommand.addProperty("topic", paramString);
}
return localCommand;
}
I likewise got a little lost trying to figure out what the final command string ends up looking like. However, after digging through this thread some more, I came across
reply #126, where user DogP shared some observations:
I also took a look at the remote GUI... [... snip ...]
I was interested in how it communicated, so I sniffed the packets. It looks like most stuff goes over port 5028. The commands and acknowledgements go over TCP, and the spectrum display data goes over UDP. It looks like there’s some status (power, GPS, etc) coming out 1027 as well.
[... snip ...]
The commands going over 5028 don't look to be any standard I'm familiar with. Some examples are (without the quotes, <\n> is hex 0A): “cmd: local<\n><\n>”, "cmd: set<\n>topic: display.global<\n>printFilter: 0<\n><\n>", etc. If you dig through the elgato binary, you can see a bunch of available commands (and you can test them out using nc).
Armed with this information (namely, what port to look at), I found that if you telnet into port 5028, pressing buttons on the front panel has the effect of the system echoing on that port these commands. So, if I turn the power meter on through the front panel, I see:
cmd: set
topic: pwrMeter
pmRef: 0
get printed to the terminal.
I am able to make the ‘get’ commands work: if I type (for example)
cmd: get
topic: spectrum
cf:
the instrument responds with:
cmd: set
topic: spectrum
cf: 1955000
However, I can’t seem to get ‘set’ commands to work—attempting to change any parameter causes the instrument to do… nothing.
The only command other than ‘get’ that works is ‘cmd: closeGui’, which causes the connection to be closed by the host (instrument). I’ll note that when I first connect to this port, the instrument prints:
cmd: remote
cmd: setActive
meas:
cmd: notifyEvent
event: startupComplete
I was hoping to use Wireshark to capture commands sent by the Java GUI running on my PC, but I can’t seem to get the GUI to work quite 100%. It starts (in a very old Debian Squeeze VM running in a Windows host by way of VirtualBox), but hangs at “Please wait while the measurement is loading…”. It does work insofar as the GUI running on my PC does show the correct instrument mode (i.e., main menu, spectrum analyzer, power meter, etc.). User DogP’s aforementioned post did mention
[…] the remote GUI […] didn't seem to work on Windows with Java 8 (even using the commands further up in the thread). Rather than dig into it, I installed Java 1.4.2 in a VM, grabbed the jre directory, and explicitly ran RemoteGui.jar using that version of java ("jre\bin\java -jar RemoteGui.jar"). [...] It looks like most stuff goes over port 5028. The commands and acknowledgements go over TCP, and the spectrum display data goes over UDP. […]
I had to make sure Windows allowed the data through the firewall (without it, the TCP commands would go through, but the UDP data wouldn’t, so the GUI would never show the spectrum). Also, Windows 7 temporarily goes back to basic graphics (disabling Aero) when you run Java 1.4.2.
I tried installing JRE 1.4.2_20, but invoking the application with the command line given earlier in this thread failed with
Exception in thread "main" java.lang.NoClassDefFoundError: elgato/gui/MainWindow
I found that this works instead, though:
java.exe -Dserver=192.168.1.186 -DlocalAddress=192.168.1.1 -classpath "./*" elgato.gui.MainWindow
However, clicking around in the Java GUI doesn't do anything. I did try copying over the RemoteGUI.jar file, but this causes its own problems. I
am able to change the spectrum analyzer center frequency by pressing the 'up' and 'down' arrows on my computer, and I can sniff out the 'cmd: set' command that are being sent when I do this in Wireshark.
I'll note also that my instrument has a significantly newer version of SW than what's available for download from Keysight's site (A.06.00, from 2006, instead of A.01.60, from 2003).
Anyway, I thought I'd share that progress, and ask a few questions:
- Does anyone know why the power ref output might be generating 10mW instead of 1mW?
- Does anyone already know of a back-door way of doing what I'm trying to accomplish?
- Any ideas why the instrument doesn't like my 'cmd: set' commands?
Home
Help
Search
Login
Register
