Wiresharking IEC - Revision history

Alfred: /* IEC61850 and Wireshark basics */

2016-05-13T08:31:35Z

IEC61850 and Wireshark basics

← Older revision		Revision as of 08:31, 13 May 2016
Line 50:		Line 50:
	MMS: Manufacturing Message Specification		MMS: Manufacturing Message Specification
	GOOSE: Generic Object Oriented Substation Events		GOOSE: Generic Object Oriented Substation Events

			NOTE: when 61850 capture is recorded after the protocol has initialised (not from the beginning), then Wireshark will not automatically detect the protocol as MMS.
			However, it is possible to change the "PRES" to "MMS" using the Wireshark menus:
			<pre>Go to Edit->preferences->protocol->PRES and edit the users context tale
			enter context = 3 and OID = 1.0.9506.2.3 and your trace will be dissected as MMS.</pre>


	Filter IEC61850 packets		Filter IEC61850 packets

Alfred: /* 61850 Wireshark capture side-by-side with console.log */

2015-08-26T10:48:22Z

61850 Wireshark capture side-by-side with console.log

← Older revision		Revision as of 10:48, 26 August 2015
Line 264:		Line 264:
	::::::::::::::::::::::::::::::::::''0-integrity = FALSE''		::::::::::::::::::::::::::::::::::''0-integrity = FALSE''
	::::::::::::::::::::::::::::::::::''1-GI enable =TRUE</small>''		::::::::::::::::::::::::::::::::::''1-GI enable =TRUE</small>''
	'''Step10. ~~For some reason,~~ RTU reads ConfRev parameter again:'''		'''Step10. RTU reads ConfRev parameter again (i.e to get it if RCB enabling fails):'''
	<pre>		<pre>
	48 2015-08-06 10:30:08.175876 10.0.0.104 172.16.1.3 MMS 131 confirmed-RequestPDU (MMS -> confirmedServiceRequest: read (4) (itemId: LLN0$BR$brcbEV103$ConfRev))		48 2015-08-06 10:30:08.175876 10.0.0.104 172.16.1.3 MMS 131 confirmed-RequestPDU (MMS -> confirmedServiceRequest: read (4) (itemId: LLN0$BR$brcbEV103$ConfRev))

Roland: /* 61850 Wireshark capture side-by-side with console.log */

2015-08-17T10:49:20Z

61850 Wireshark capture side-by-side with console.log

← Older revision		Revision as of 10:49, 17 August 2015
Line 258:		Line 258:
	2015-08-06 10:30:08.174 [INFO] Gateway.Port14 - RcbEnable: RCB attribute values: "","255Relay/LLN0$DS1",[0111111111],[011101],+60000,+2053,'0000000000000009'		2015-08-06 10:30:08.174 [INFO] Gateway.Port14 - RcbEnable: RCB attribute values: "","255Relay/LLN0$DS1",[0111111111],[011101],+60000,+2053,'0000000000000009'
	</pre>		</pre>
			::::::::::::::::::::::::::::::::::<small>''0-NOT used''
			::::::::::::::::::::::::::::::::::''1-data change=TRUE''
			::::::::::::::::::::::::::::::::::''1-quality change =TRUE''
			::::::::::::::::::::::::::::::::::''1-data update=TRUE''
			::::::::::::::::::::::::::::::::::''0-integrity = FALSE''
			::::::::::::::::::::::::::::::::::''1-GI enable =TRUE</small>''
	'''Step10. For some reason, RTU reads ConfRev parameter again:'''		'''Step10. For some reason, RTU reads ConfRev parameter again:'''
	<pre>		<pre>

Alfred: /* 61850 Wireshark capture side-by-side with console.log */

2015-08-11T08:54:22Z

61850 Wireshark capture side-by-side with console.log

← Older revision		Revision as of 08:54, 11 August 2015
Line 138:		Line 138:
	</pre>		</pre>
	The response contains all the item ID-s from 255Relay that are in dataset LLN0$DS1. The RTU logs this information as follows:		The response contains all the item ID-s from 255Relay that are in dataset LLN0$DS1. The RTU logs this information as follows:
	~~{{Collapse\|1=~~		<pre>
	2015-08-06 10:30:03.607 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/I3pMMXU1$MX$A$phsA		2015-08-06 10:30:03.607 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/I3pMMXU1$MX$A$phsA
	2015-08-06 10:30:03.609 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/I3pMMXU1$MX$A$phsB		2015-08-06 10:30:03.609 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/I3pMMXU1$MX$A$phsB
Line 160:		Line 160:
	2015-08-06 10:30:04.324 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/VI1GGIO137$ST$SPCSO		2015-08-06 10:30:04.324 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/VI1GGIO137$ST$SPCSO
	2015-08-06 10:30:04.364 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/SIpMMXU23$MX$A		2015-08-06 10:30:04.364 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/SIpMMXU23$MX$A
	~~\|2=Optional custom heading}}~~		</pre>
	'''Step 5. RTU sends a request for getNameList (IEC61850 GetDataSetDirectory)'''		'''Step 5. RTU sends a request for getNameList (IEC61850 GetDataSetDirectory)'''
	<pre>		<pre>

Alfred: /* 61850 Wireshark capture side-by-side with console.log */

2015-08-11T08:53:32Z

61850 Wireshark capture side-by-side with console.log

← Older revision		Revision as of 08:53, 11 August 2015
Line 139:		Line 139:
	The response contains all the item ID-s from 255Relay that are in dataset LLN0$DS1. The RTU logs this information as follows:		The response contains all the item ID-s from 255Relay that are in dataset LLN0$DS1. The RTU logs this information as follows:
	{{Collapse\|1=		{{Collapse\|1=
	~~<pre>~~
	2015-08-06 10:30:03.607 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/I3pMMXU1$MX$A$phsA		2015-08-06 10:30:03.607 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/I3pMMXU1$MX$A$phsA
	2015-08-06 10:30:03.609 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/I3pMMXU1$MX$A$phsB		2015-08-06 10:30:03.609 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/I3pMMXU1$MX$A$phsB
Line 161:		Line 160:
	2015-08-06 10:30:04.324 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/VI1GGIO137$ST$SPCSO		2015-08-06 10:30:04.324 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/VI1GGIO137$ST$SPCSO
	2015-08-06 10:30:04.364 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/SIpMMXU23$MX$A		2015-08-06 10:30:04.364 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/SIpMMXU23$MX$A
	~~</pre>~~		\|2=Optional custom heading}}
	~~Discussion text to be put into box.~~\|2=Optional custom heading}}
	'''Step 5. RTU sends a request for getNameList (IEC61850 GetDataSetDirectory)'''		'''Step 5. RTU sends a request for getNameList (IEC61850 GetDataSetDirectory)'''
	<pre>		<pre>

Alfred: /* 61850 Wireshark capture side-by-side with console.log */

2015-08-11T08:52:35Z

61850 Wireshark capture side-by-side with console.log

← Older revision		Revision as of 08:52, 11 August 2015
Line 138:		Line 138:
	</pre>		</pre>
	The response contains all the item ID-s from 255Relay that are in dataset LLN0$DS1. The RTU logs this information as follows:		The response contains all the item ID-s from 255Relay that are in dataset LLN0$DS1. The RTU logs this information as follows:
			{{Collapse\|1=
	<pre>		<pre>
	2015-08-06 10:30:03.607 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/I3pMMXU1$MX$A$phsA		2015-08-06 10:30:03.607 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/I3pMMXU1$MX$A$phsA
Line 161:		Line 162:
	2015-08-06 10:30:04.364 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/SIpMMXU23$MX$A		2015-08-06 10:30:04.364 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/SIpMMXU23$MX$A
	</pre>		</pre>
			Discussion text to be put into box.\|2=Optional custom heading}}
	'''Step 5. RTU sends a request for getNameList (IEC61850 GetDataSetDirectory)'''		'''Step 5. RTU sends a request for getNameList (IEC61850 GetDataSetDirectory)'''
	<pre>		<pre>

Alfred: /* 61850 Wireshark capture side-by-side with console.log */

2015-08-07T12:11:10Z

61850 Wireshark capture side-by-side with console.log

← Older revision		Revision as of 12:11, 7 August 2015
Line 202:		Line 202:
	31 2015-08-06 10:30:06.747774 172.16.1.3 10.0.0.104 MMS 86 confirmed-ResponsePDU ( MMS -> confirmedServiceResponse: read (4) (AccessResult: success (1), integer: 0))		31 2015-08-06 10:30:06.747774 172.16.1.3 10.0.0.104 MMS 86 confirmed-ResponsePDU ( MMS -> confirmedServiceResponse: read (4) (AccessResult: success (1), integer: 0))
	</pre>		</pre>
	About ResvTms: ~~Owner is set by the server to indicate~~ the reservation of a control block by a peculiar client.		About ResvTms: Indicates the reservation of a control block by a peculiar client. Read http://tissue.iec61850.com/tissue/300
	About configuring Vamp devices regarding ResvTms:		About configuring Vamp devices regarding ResvTms:
	<pre>		<pre>

Alfred: /* 61850 Wireshark capture side-by-side with console.log */

2015-08-07T11:14:46Z

61850 Wireshark capture side-by-side with console.log

← Older revision		Revision as of 11:14, 7 August 2015
Line 161:		Line 161:
	2015-08-06 10:30:04.364 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/SIpMMXU23$MX$A		2015-08-06 10:30:04.364 [INFO] Gateway.Port14 - LD=255Relay LN=LLN0 DataSet=DS1 member=255Relay/SIpMMXU23$MX$A
	</pre>		</pre>
	'''Step 5. RTU sends a request for getNameList'''		'''Step 5. RTU sends a request for getNameList (IEC61850 GetDataSetDirectory)'''
	<pre>		<pre>
	21 2015-08-06 10:30:04.404171 10.0.0.104 172.16.1.3 MMS 90 confirmed-RequestPDU ( MMS -> confirmedServiceRequest: getNameList (1))		21 2015-08-06 10:30:04.404171 10.0.0.104 172.16.1.3 MMS 90 confirmed-RequestPDU ( MMS -> confirmedServiceRequest: getNameList (1))
Line 192:		Line 192:
	2015-08-06 10:30:04.906 [INFO] Gateway.Port14 - "255Relay/LLN0$DS1" member=255Relay/SIpMMXU23$MX$A		2015-08-06 10:30:04.906 [INFO] Gateway.Port14 - "255Relay/LLN0$DS1" member=255Relay/SIpMMXU23$MX$A
	</pre>		</pre>
	'''Step 6. RTU reads the LLN0$BR$brcbEV103$RptEna ~~item~~:'''		'''Step 6. RTU reads the LLN0$BR$brcbEV103$RptEna and LLN0$BR$brcbEV103$ResvTms items:'''
	<pre>		<pre>
	25 2015-08-06 10:30:05.956536 10.0.0.104 172.16.1.3 MMS 130 confirmed-RequestPDU ( MMS -> confirmedServiceRequest: read (4) (domainId: 255Relay, itemId: LLN0$BR$brcbEV103$RptEna))		25 2015-08-06 10:30:05.956536 10.0.0.104 172.16.1.3 MMS 130 confirmed-RequestPDU ( MMS -> confirmedServiceRequest: read (4) (domainId: 255Relay, itemId: LLN0$BR$brcbEV103$RptEna))
Line 203:		Line 203:
	</pre>		</pre>
	About ResvTms: Owner is set by the server to indicate the reservation of a control block by a peculiar client.		About ResvTms: Owner is set by the server to indicate the reservation of a control block by a peculiar client.

	~~1) if the server implements resvTms - Owner is set when resvTms is not 0.~~

	~~2) if the server does not implement revsTms over the communication - Owner is set as soon as a BRCB is exclusively owned by a client.~~

	~~3) Owner is set as long as resv is set in a URCB, i.e. as long as the URCB is exclusively owned by a client.~~

	About configuring Vamp devices regarding ResvTms:		About configuring Vamp devices regarding ResvTms:
	<pre>		<pre>

Alfred at 11:08, 7 August 2015

2015-08-07T11:08:29Z

← Older revision		Revision as of 11:08, 7 August 2015
Line 1:		Line 1:
	====		==Wireshark and IEC60870-5-104, IEC61850==
	Some basic filters for analysing wireshark logs in case of IEC protocols.<br />		Some basic filters and examples for analysing wireshark logs in case of IEC protocols.<br />

Alfred at 11:07, 7 August 2015

2015-08-07T11:07:14Z

← Older revision		Revision as of 11:07, 7 August 2015
Line 1:		Line 1:
			====
	Some basic filters for analysing wireshark logs in case of IEC protocols.<br />		Some basic filters for analysing wireshark logs in case of IEC protocols.<br />