Planning Your Audio Network

Every reliable concert audio network begins long before a single microphone is plugged in. Start with a thorough venue assessment—whether it’s a 2,000-seat theater, an open-air festival field, or a basketball arena—each environment presents unique challenges. Measure the distances between the stage, front-of-house (FOH) position, monitor world, broadcast trucks, and any delay towers. Create a scaled drawing marking every audio source location: handheld and headset microphones, instrument DI boxes, wireless receiver racks, playback computers, and outboard effects processors.

Determine the total number of network audio channels required. For Dante, AVB, or AES67, start with your microphone count and add at least 50% overhead for redundant mixes, monitor feeds, broadcast splits, and future expansion. Document the required sample rates (44.1 kHz, 48 kHz, 96 kHz) and bit depths (16, 24, or 32-bit float). This data directly drives bandwidth calculations and switch port counts. A 96 kHz 32-bit float stereo stream consumes roughly 6 Mbps, so a 64-channel stage box at that rate will need over 300 Mbps of clean network capacity.

Choosing a Network Topology

For live concerts, a star or redundant star topology using wired Ethernet remains the industry standard. When Wi‑Fi is unavoidable—for tablet‑based mixing, remote control surfaces, or monitoring apps—treat it strictly as a production control network, never for primary audio transport. Design a dedicated wired backbone using Cat6a or Cat7 shielded cable for 1 Gbps or 10 Gbps links. For distances over 100 meters between stage boxes and FOH, use single-mode or multimode fiber optic cabling with SFP+ transceivers. Fiber eliminates ground loop risks and is immune to EMI from lighting rigs.

Consider gigabit Ethernet the minimum; 10 Gbps is rapidly becoming standard for large festivals and broadcast simulcasts with multiple redundant streams. Build in Link Aggregation (LACP) between core switches to increase throughput and provide automatic failover. For highest reliability, deploy a fully redundant network with dual core switches, dual power supplies, and two separate cable paths from every critical device—stage boxes, consoles, wireless receiver racks. This way, if one switch or cable fails, the show continues without a glitch.

Power and Grounding

Dedicated power circuits are non‑negotiable. Separate all audio network gear from lighting dimmers, HVAC units, and large motor loads that inject electrical noise. Use power conditioners and uninterruptible power supplies (UPS) on every switch, router, and audio interface. A UPS with pure sine wave output and enough runtime for a graceful shutdown (at least 10 minutes) is essential. Implement a star‑ground scheme: run all equipment grounds back to a single point to prevent ground loops that cause hum, buzzing, and data errors. Test every outlet with a ground impedance meter before connecting anything. For outdoor events, use weatherproof power distribution and GFCI protection.

Securing the Network

A live concert network is a tempting target for interference, data theft, or malicious disruption. Layered security—from encryption to physical access controls—protects both the audio stream and the show’s integrity.

Encryption and Authentication

If Wi‑Fi is used, enable WPA3‑Enterprise with 802.1X authentication using a RADIUS server. For wired networks, deploy 802.1X port‑based Network Access Control (NAC) so only authorized devices can connect to switch ports. Pair this with MAC address filtering as a secondary layer. For remote access to network‑connected gear—such as remote console control or firmware updates—establish a VPN tunnel using IPsec or WireGuard. Never expose audio control interfaces (e.g., Dante Controller, console remote apps) to the public internet. If you must provide internet connectivity for streaming or social media, use a separate guest VLAN with a firewall between it and the audio network.

Network Segmentation with VLANs

Segment your audio traffic into dedicated VLANs. Create at least three logical networks:

  • Audio‑Data VLAN: carries all Dante, AVB, or AES67 audio streams. No other traffic allowed.
  • Control VLAN: for mixing consoles, stage‑box controllers, wireless receiver management software, and system tuning tools.
  • Guest / Administrative VLAN: for crew laptops, Wi‑Fi access points, internet connectivity, and streaming encoders.

Use Layer 3 switches or a dedicated firewall to enforce strict inter‑VLAN rules. The audio‑data VLAN should have no default gateway—traffic stays purely Layer 2 to minimize latency and security exposure. The control VLAN may have restricted access to the audio VLAN only on necessary ports (e.g., UDP 8700‑8700 for Dante audio streams, TCP 80/443 for web interfaces). Block all other traffic, including DHCP requests from unknown devices.

Firewall and Access Control Lists

Configure Access Control Lists (ACLs) on every managed switch and router. Allow only required IP addresses and port ranges. For Dante, typical ports include:

  • UDP 4444 (Dante discovery)
  • UDP 8700–8707 (audio streams, variable per system)
  • UDP 14336–14337 (Dante timing, PTP)

Block all other inbound traffic from the control VLAN into the audio VLAN. Deploy a hardware firewall at the network edge if the concert requires any internet connectivity. Configure deep packet inspection to detect and drop suspicious patterns. For extra security, use a dedicated security appliance like a pfSense or Untangle box between the guest VLAN and the audio network.

Physical Security

Lock network racks with tamper‑proof latches and security screws. Use port locks on all switches or disable unused ports to prevent rogue device insertion. Secure cabling runs with cable ties, velcro straps, and conduit to deter accidental disconnection or tripping. Assign a dedicated crew member to monitor network racks during load‑in, soundcheck, and performance. Use colored cables (e.g., red for audio data, blue for control) to make troubleshooting easier. Have a camera pointed at critical rack locations if the stage is large.

Implementing Reliable Hardware

Consumer‑grade network hardware has no place in a professional live‑sound environment. Invest in purpose‑built switches and routers designed for Audio Video Bridging (AVB) or Dante‑optimized configurations. Look for equipment with a proven track record on tour.

Switch Selection and Configuration

Choose managed Gigabit or 10 Gigabit switches with internal latency under 5 microseconds. Models specifically designed for audio professionals include the Luminex Gigacore series and NETGEAR AV‑Line switches. Ensure they support:

  • Quality of Service (QoS): Assign highest priority to audio traffic using IEEE 802.1p VLAN priority tags. For Dante, map the audio VLAN traffic to queue 4 (voice/video priority). For AVB, use the built-in stream reservation protocol.
  • IGMP Snooping: Mandatory for multicast audio protocols. This enables the switch to forward audio streams only to ports that are actually receiving them, reducing unnecessary traffic load.
  • Jumbo Frames: Setting MTU to 9000 bytes can reduce CPU overhead on endpoints. Test with your specific audio devices—some older interfaces have smaller buffer limits.
  • Spanning Tree Protocol (STP): Disable if using a simple star topology. For redundant setups, use Rapid Spanning Tree (RSTP) or Multiple Spanning Tree (MSTP) with careful tuning to avoid reconvergence delays longer than 1 second.

Configure every switch with a static IP address in the management VLAN. Disable unnecessary services: HTTP, Telnet, SNMP write access, DHCP server on data ports. Enable storm control to limit broadcast traffic to 10% of bandwidth. Use a configuration backup tool to snapshot settings before each tour date.

Cabling and Connectors

Use shielded Cat6a or Cat7 copper cable for all permanent runs. Shielded cable rejects electromagnetic interference (EMI) from lighting dimmer packs, power amplifiers, and heavy power cables. Terminate with shielded RJ45 connectors that provide 360‑degree grounding—avoid plastic plugs. For long runs (over 100 m) or environments with extreme EMI, use single‑mode or multimode fiber optic cable with SFP+ transceivers. Fiber also eliminates ground loops. Label both ends of every cable with printed, waterproof labels (use a P‑touch or similar). Create a cable schedule that matches your network diagram.

Network Timing and Clocking

Synchronize all audio devices to a common clock source. Most network audio protocols (Dante, AVB, AES67) use Precision Time Protocol (PTP) for synchronization. Designate one device as the grandmaster clock—ideally a dedicated master clock generator such as an Antelope Audio or Mutec unit, or the FOH console if it supports grandmaster mode. Ensure all switches are PTP‑aware and configured to support the correct PTP profile: IEEE 802.1AS for AVB, IEEE 1588v2 for Dante. Verify clock accuracy using manufacturer tools before the show—offset should remain under 50 microseconds. If using Dante, run Dante Controller’s latency and clock status view to confirm every device is synchronized.

Testing and Monitoring

Testing begins days before show day and continues through the final bow. Rigorous validation catches configuration errors, interference sources, and security gaps before they affect the audience.

Pre‑Show Network Validation

Use a network analyzer laptop with Wireshark to scan for unauthorized devices, duplicate IP addresses, and excessive broadcast traffic. Run throughput tests with iPerf3 between every critical pair of nodes: stage box to FOH console, wireless receivers to processing rack, delay rack switch to core. Confirm that QoS markings (DSCP or 802.1p) are preserved end‑to‑end. Apply a continuous audio test tone (1 kHz sine wave at –20 dBFS) and measure latency with tools like Audinate Dante Controller’s subscription view. Latency on a local gigabit network should remain under 1 ms round‑trip. Also check for jitter—anything over 0.2 ms may cause dropouts.

Carry a known‑good reference cable and a set of loopback jacks. Test each physical port by sending a signal from a source and verifying at the destination. Document all test results in a check‑off sheet for each venue.

Monitoring During the Event

Set up a dedicated monitoring station with a screen showing:

  • Switch port utilization and error counters: collisions, CRC errors, runts, giants.
  • Real‑time audio stream statistics: packet loss, jitter, clock offset for every device.
  • Security logs: failed authentication attempts, unauthorized DHCP requests.

Use SNMP‑based monitoring tools like PRTG or Nagios with custom templates for live sound. Alternatively, Dante Controller’s built‑in latency view and subscription window give instant insight. Assign a dedicated technician to watch this dashboard continuously during the performance. If packet loss exceeds 0.01% or jitter climbs above 1 ms, investigate immediately—audible glitches follow quickly. Have a second screen showing a waveform of the audio feed; any unexpected silence or clicks are red flags.

Emergency Procedures

Document a fallback plan and keep it printed in the network rack. If the primary network fails, have a secondary analog or redundant digital audio path ready. Pre‑configure a backup switch with identical settings and keep it powered off but patched into the cabling. Train at least two crew members on re‑routing cables, rebooting network devices, and switching to analog backup. Perform a full failover drill during rehearsals: simulate a switch failure by pulling the power cord. Time how long it takes to switch to the backup path; aim for under 30 seconds. Keep a spare switch, power supply, and patch cables in a labeled flight case within easy reach.

Conclusion

A secure, reliable audio network for live concerts demands meticulous planning, professional hardware, layered security, and disciplined monitoring. Start with a detailed venue assessment and network topology design that accounts for channel counts, distances, and redundancy. Implement VLAN segmentation, encryption, and strict access controls to protect audio data from interference or attack. Choose switches and cabling built for the rigors of touring and install them with proper grounding and clocking. Validate the system thoroughly before opening the gates, then monitor it vigilantly through every moment of the performance.

By committing to these practices, you ensure that the audience hears only the music—and that the network itself remains invisible, robust, and trustworthy. For further reading, explore Dante’s official network design guides and the Audio Engineering Society’s standards for networked audio. Also refer to the IEEE 802.1AS standard for time synchronization fundamentals.