SimFlex™ Protocol Analyzer User Manual
Contents
1. Frame Time abs Destination mac Source p Destination p Protocol Length Information Remarks 1 10 12201311 20 16 202000 0002249024 r ARP 60 Whohas 1921680254 Tell 19 Pa o 2 10 12201311 20 16 359000 00 02 84 90 2 4 01 0c cd 01 00 03 Goose 410 The fret GOOSE message 3 10 12201311 20 16 387000 be 30 5b e4 80 63 01 00 5e 00 00 01 0 0 0 0 224001 IGMP 60 Membership Query general Frame Length s4 4 10122013 1120 16 287000 bc 30 5b e4 80 63 333300000001 IcMpve es Mulicast Listener Query EE REI Ec ud EIN cree 5 101220131120 16414000 5 26 0a 7e 28 02 33 33 0657c5 ICMPV6 86 Muticast Listener Report 6 1 122013 112016414000 5c 26 08 7e e8 02 33 33 00 00 00 0 ICMPV6 86 Mulicast Listener Report ae 7 10 12201311 20 16 415000 5 26 0a 7e e8 02 33 33 00 00 00 ICMPV6 86 Mukicast Listener Report s Bre Fort 56383 56383 Dst Por 8 10122013 112016424000 d45e39337750 RAR AAR ARP 42 Whohas 10201220 Tell 10 20 1 44 9 1 122013 112016424000 00 09 2e4f 1b 5a d45e 29537750 ARP amp amp 1020 1220is at 00 09 8efi 1b 5a ETHERNET FRA 10 10122013 1120 16424000 d4be d9 93 77b0 00 09 2e 1b 58 1020 1 panico tcp es 56383 gt 102 SYN Seq 0 Win 8192 Len 0 MSS 1 T1 10122013 11 20 16 427000 00 09 2e4t 1b 53 d4bed933772. Figure 5 2 Select Monitoring Tools Performance Monitor Right click in the form and select Add Counters Open in frame Available counters the GridClone group click on the sign Select the counters you want to add use Ctrl for multi select e CFR Capture Frame Rate e DFR Dissector Frame Rate e DFRD Dissector Frame Rate Detail e MEM used MEMory Click the Add button Click the OK button You can double click in the counter table at the bottom to change the properties Set the scale for GridClone MEM to 0 000001 set the units to MegaByte 6 Use case Starting and stopping SimFlex Protocol Analyzer 6 1 Verify the capture of network traffic from an IED Make sure that both IED and the PC that is running the SimFlex Protocol Analyzer are connected to the same network and that they are in the same IP address range Example IED IP address 192 168 0 100 mask 255 255 255 0 SimFlex Protocol Analyzer IP address 192 168 0 90 mask 255 255 255 0 In the Windows Network and Sharing Center you can check which adapter e g a network interface card or NIC is connecting your PC with the network You can also change add IP addresses if needed This name is used in Windows 7 Different versions of the Windows OS might have different names for this dialog Please check your Windows user manual for more information on how to change network paramet
3. 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual 2 3 Next issue Activate next frame that has an issue found by Analyze IEC 61850 Annotation Reverse look up on all captured MMS GOOSE and sampled value packages After activating this function the information column in the Capture View will show the IEC 61850 service names and most important parameters and or values Create Pattern Create a reference file that stores IEC 61850 annotation for all MMS frames in the current capture file The Protocol Analyzer will automatically set the filter to MMS add IEC Annotation if not already done and store the generic part of this annotation in a file The filename is constructed from the opened file The date time part will be removed A sequence number will be added in brackets The extension is of the newly created reference file is ref The file will be created in the same folder as the opened file Match Pattern This button is enabled if there is at least one reference file in the opened file s folder that matches the filename as described at the Create Pattern button A temporary reference file will be created and it will be compared to all the matching reference files Matching results are logged Mismatches are shown as remarks Auto scroll Switch to turn on dark or off light automatic scroll If turned on the Capture View will automatically scroll to show the last captured frame Capture
4. 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual Once the CodeMeter Control Center is started open it from the system tray and check that there is a license shown in the left part of the dialog Make sure you have inserted the USB license key in one of the available USB ports In case you are running a trial version of the SimFlex Protocol Analyzer If there is no license shown select File gt Import License from the menu and locate the lic file in the Protocol Analyzer folder In the folder where you installed the program e g C Program Files GridClone Note that the CodeMeter Control Center might have a filter like WibuCmRaU Change it to or lic to make the license file visible Once the license file has been selected and opened it should be visible in the CodeMeter Control Center To be sure the license is activated stop and start the CodeMeter Control Center service by pressing Process Stop CodeMeter Service and then Process Start CodeMeter Service Finally re start the Protocol Analyzer If the problem persists please contact GridClone for support 8 Additional Information In this section you will find information on additional topics 8 1 File name conventions Any log file is either e A file that contains the information that was logged to the Log View see also Figure 2 1 These log files have the following format SimFlex Protocol Analyzer Log yyyymmdd
5. Date By Subject 0 1 August 9 2013 EM Initial version 0 2 October 4 2013 EM User manual for the BETA version 1 0 November 15 2013 WvE User manual for the 1 0 version 1 1 December 20 2013 WvE User manual for the 1 1 version 2011 2014 GridClone B V
6. MMS MMS protocol GOOSE GOOSE protocol SV SV Examples of some filter expressions Note braces are included for readability Filter expression gt equivalent MMS gt protocol mms MMS or GOOSE gt protocol mms or protocol goose 4 3 Error reporting When an error is found while evaluating a filter expression a message is written to the log with information on the location where the error is found and what was expected The message includes the number of characters already recognised the next part in the filter expression that is not recognised and a list of parts that is acceptable at that point The list of acceptable parts can take more than one line of text Acceptable parts are recognised by a dot in front of a term in capitals referring to acceptable text e g NE means expecting ne Iz or lt gt An example Filter expression protocol is GOOSE the error is in the key word is which is not defined Error message FILTER ERROR after position 9 token LITERAL is expected token for comparator EQ NE An EQ eq or or an NE ne or lt gt text is expected but the literal text is is found Another example Filter expression myerror GOOSE the error is in the key word myerror which is not a valid attribute for a frame Error message FILTER ERROR after position 0 token LITERAL
7. hhmmss log e The SimFlex Protocol Analyzer also stores information to disk in case problems occur in the program This information is stored in a so called Error Log file Error log files are always needed by the GridClone Development Team for trouble shooting These Error Log files have the following format SimFlex Protocol Analyzer ErrorLog yyyymmdd hhmmss log 8 2 Used abbreviations DUT Device Under Test GOOSE Generic Object Oriented System Event GUI Graphical User Interface IEC The International Electrotechnical Commission managing international standards See also http www iec ch IEC 61850 The IEC 61850 standard IED Intelligent Electronic Device MMS Manufacturer Message Specification or ISO 9506 NIC Network Interface Card UCA The UCA International Users Group See also http www ucaiug org OSI Open Systems Interconnection See also http en wikipedia org wiki OSI model 8 3 Referenced documents IEC 61850 IEC 61850 2003 MMS ISO 9506 2003 as used by IEC 61850 8 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual Getting started SimFlex Protocol Analyzer pdf 8 4 Referenced tools Client Simulator For conformance testing of IEC 61850 server devices This program is a member of the SimFlex tool platform SCL Checker For conformance testing of an SCL file This program is a member of the SimFlex tool platform 8 5 User Manual version history Version
8. e Merge Capture Files With this function the user can merge two capture files into a single capture file Both pcap files as well as pcapng files can be merged into a single file The Protocol Analyzer proposes a name for the merged file based on the file name of the first capture file The user can change the name of the merged file For more information on merging capture files please check chapter 6 4 e Save As saves the currently opened capture file with a different file name e Save Selected Frames saves the currently selected frames to a new pcap or pcapng file Multiple frames can be selected in the Capture View as follows o Left click on a frame and then press the SHIFT key and left click on another frame All frames between the first and second chosen frames are now highlighted and will be saved by the Save selected frame function o Left click on a frame and then press and hold the CTRL button Left click on a second third etc frame The selected frames are now highlighted and will be saved by the Save selected frame function e Exit closes the program 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual 2 1 2 Menu Edit In the Edit menu the following actions can be executed Settings opens the application settings dialog For detailed information see chapter Error Reference source not found Mark Unmark marks or unmarks the currently selected frames in the Captu
9. myerror expected token for term equation protocol equation operand comparator literal protocol MMS GOOSE SV operand PROTOCOL IP IPFROM IPTO MAC MACFROM MACTO REMARK An error at this particular location at the start of an equation shows a large list of possible key words to start an equation with It is also recognisable from the error message that the key words are organised in particular groups Any text defined by capitalised words with a dot in front of it is acceptable 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual Dots in front of a lower case word do identify groups of acceptable key words The bar in the error message can be read as or 4 4 Some pitfalls and useful filter expressions MMS or GOOSE Any MMS or GOOSE frame GOOSE and IP 10 20 1 220 gt Any GOOSE frame from or to 10 20 1 120 follow stream filter GOOSE and remark USER gt Any GOOSE frame with a remark made by some user Remark USER or remark GOOSE gt Any frame with a remark made by some user or by the analysis on GOOSE attributes Protocol GOOSE gt All non GOOSE frame MMS and GOOSE gt Noting A frame cannot be MMS and GOOSE at the same time Protocol SV and protocol SV gt Nothing A frame cannot be a sampled value and not be a sampled value Protocol SV or protocol SV gt Everything A frame is always a
10. APP application layer Remarks that are added to the frame are listed at the end 2 5 Log View In this section all actions that are stored in the log file that was created running SimFlex Protocol Analyzer are listed 2 6 Status Bar e File full path name of the capture file that is created or opened e M currently used memory in MB e Cr NIC Capture rate in frames per second e Dr Dissector rate in frames per second The memory use capture rate and dissector rate can be visualized in a time graph by clicking on one of the indicators or by using Windows performance monitor See chapter 5 3 Configuring the SimFlex Protocol Analyzer To configure the application open the Settings dialog by selecting menu Edit Settings The Settings dialog has several tabs each containing a group of settings The setting groups are described in the next chapters 3 1 Settings General 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual In the General settings the user can specify the following settings 3 2 Capture Interface 1 this is the first port on a network interface card NIC that is used to capture Ethernet packets Capture Interface 2 this is an additional NIC that is used to capture Ethernet packets If specified the Capture View will show the Ethernet packets captured from both specified interfaces Show Performance graphics at start capture If checked when Start Captur
11. View A list of captured frames in the opened file is displayed The list can be filtered The Time columns that are displayed can be set in the View menu Other columns are fixed The Capture View shows global information from captured frames Detailed information will be shown in the Detail View for the active frame The frame you click is active marked by the arrow in column 1 and selected marked by highlighting Multiple frame selection can be done like this e Left click on a frame and then press the SHIFT key and left click on another frame All frames between the first and second chosen frames are now highlighted and selected e Left click on a frame and then press and hold the CTRL button Left click on a second third etc frame The selected frames are now highlighted and selected 2 3 1 Columns 1 untitled Shows an arrow at the selected frame Frame The sequence number of the frame in the opened file Time abs The absolute date time the frame is captured Time rel The time of the captured frame relative to the first captured frame the first captured frame might not be visible due to user applied filters Time diff The difference time between displayed frames Source mac The mac address of the sending device Destination mac The mac address of the receiving device Source ip The ip address of the sending device Destination ip The address of the receiving devi
12. t rdeclone SimFlex Protocol Analyzer User Manual SimFlex Protocol Analyzer User Manual 1 1 1 1 2 1 3 1 4 1 5 2 1 2 1 1 2 1 2 2 1 3 2 1 4 2 2 2 2 1 2 2 2 2 2 3 2 3 2 3 1 2 3 2 2 4 2 5 2 6 3 1 3 2 4 1 4 2 4 3 44 5 1 5 2 Index A tiem td acetone etudes f o aet Sere e et ton etait 1 What is SimFlex Protocol Analyzer accette reetan enne nennen neris sns nnn n nnns 3 Benefits sce RI Re URINE RR d e e Ue I ds 3 Applications sire nene E 3 Key Features ut tnter e ae e euet a exa a aeta qu de aide t ee ewe aa ean a ege cat aa d tected chua ee da vaa E e Rue rp dd 3 Basic skillirequirernents ii eto ee te er ee REESE ER NES 4 SimFlex Protocol Analyzer overview cccccccccceceessssssssecececeseseaaeseeeescessneaeeeeeeseeeseeseaaeaeeeeseneses 4 Mente MS etin n qe hie epe en 5 M nu SEile sie torret teet tede ted erste ee a ave eatur ead e aee gt dett ae Peto aee oae tes 5 ME E 6 Men s View aD LE 6 Men Helps niei bete eb ete EI 6 Toolbar items denen A ET ENT a exa a a ie A 7 Toolbar BUON Scion a 7 Toolbar Capture View Filter iere t A ASE IAD ae 7 Toolbar Other vas 7 Capture MAA a es 8 A tetas oett tte mp niet TA 8 Right clickoptions 53 oe ete ette a ts 9 Detail View DRIN e eR RR NU RI ERU ds 9 Log VIEW eee E edm ee iu qm eae a ue RR 9 crt EE 9 Configuring the SimFlex Protocol Analyzer sssesesseseeee eene nennen nnne n
13. 50 1020 1 Tce 62 102 gt 56383 SYN ACK Seq 0 Ack 1 Win 32767 L mm 1 11 20 16 427000 d4be d9 93 771 9 8etf lb 5a 10 20 cP 54 56383 gt 102 ACK Seq Len 0 13 101220131120 16427000 d4be d9 33 7750 00 09 2e 1b 5a 1020 1 DATA 76 CR TPDU sroref 00021 detref 0000 34 1012 2013 11 20 16 435000 00093e5 1b5 d4be d9 93 7750 1020 14 DATA 76 CC TPDU sroref 0x8400 dstref 0x0021 15 1012 2013 11 20 16 435000 d4be d9 93 77b0 00 09 8eff 1b 5a 1020 1 MMs 245 intiate RequesiPDU 16 101220131120 16440000 00 09 8e 1b 5a d4bed93377b0 10201220 1020724 mms 215 miiete ResponsePDU 17 10 1220131120 16457000 68 05 0a 0145 85 33335434c 7 ICMPVG 86 Muticast Listener Report 18 10122013 1120 16457000 68 05 c8 0115 85 33 33 00 01 00 03 ICMPVE 86 Muiticast Listener Report 3471218 Sage aes Carona 19 10 12201311 20 16 462000 d4be 99 33 7750 00 09 2e f 1b 53 1020144 10201220 MMS 76 conclude RequestPDU Eier 20 10122013 112016467000 00 09 8et1b 5e d4be 9537750 1020 1220 1020144 mms 76 conclude ResponsePDU 13 47 11 761 argument ct 21 10122013 11 20 16 467000 d4be d9 93 77b0 00 09 8eff 1b 5a 1020144 10201220 ACSE 79 ReleaseRequest omal 3 1 22 10 12 2013 112016472000 00 09 8e 1b 5a d4be d9 93 77b0 10 20 1220 10 20 144 ACSE 79 Relesse Response notfinished SAM on 1 Hato 23 10122013 11 20 16 472000 d4be d9 937750 00 09 2e4 1b 5a 1020 144 10201220 ACE 74 FINISH FN S
14. PDU d FexEd2 TestLab TestBe 24 10122013 112016472000 d45e43377b0 00098e 15e 1020 144 10201220 TCP 54 56383 102 FIN ACK Seq 281 Ack 232 Win 663 25 10122013 112016475000 00 09 2e4f 1b 52 d4be i9537750 1020 1220 1020 144 TCP amp 0 _ TCP ZeroWindow 102 gt 56383 ACK Seq 232 Ack 26 10122013 11 20 16 479000 00 09 8ei1b 5e d be 95377b0 10201220 1020144 TCP amp 0 1025 56383 FIN PSH ACK Seq 232 Ack 282 Wi 27 10122013 112016479000 d4be d9 93 77b0 00098ef1b5e 1020 144 10201220 TCP 54 56383 102 ACK Seq 282 Ack 233 Win 66304 L 28 10122013 1120 16518000 00 30 a7 00 8f 9b 01 0c 04 01 00 07 194 GOOSE SEL 2411 ICFG LLNOSGOSGooseDSet 13 The frst GOOSE message 29 10 122013 11 20 16 583000 00 0a de 14 73 81 01 80 2 00 00 00 60 RST Root 32768 0 00 0a de 14 73 80 Cost 0 13 47 13 774 End Goose M 4 of2 b bi File C ProgramData Microsoft Corporation SimFlexEd2 TestLab TestBenches TESTBENCH_0 Pre Tesf 1 20 13 pcap Ide M 39 Cr 0 Dr O Figure 2 1 2 1 Menu items The following menu items are available Ele Edit View Help M Each menu item is described in the next chapters 2 1 1 Menu File In the File menu the most common file actions can be executed e Open opens a previously created capture file The SimFlex Protocol Analyzer can open pcap and pcapng files e Open Recent opens one of the most recently opened capture files
15. Windows help file that can be easily browsed using the available Contents Index and Search tabs About opens the About dialog that shows information regarding the SimFlex Protocol Analyzer version number copyright etc In the About dialog there is a link to the GridClone website and also a link to generate a standard email to the GridClone Support Team in case you have questions or comments regarding the product Figure 2 2 shows an example of the About dialog 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual 2 2 About SimFlex Protocol Analyzer 5 xl SimFlex Protocol Analyzer Product SimFlex Protocol Analyzer mM t igclone Build Number 1 0 5065 27494 f O Licensed to General Licence Website www aridclone com Copyright 2011 2013 GridClone B V Email support amp gridclone com GridClone B V Figure 2 2 Toolbar items The toolbar is fixed It contains buttons that provides an easy way to handle the Protocol Analyzer and a filter for filtering the items that are listed in the Capture View parts 2 2 1 a BO 2 2 2 Toolbar Buttons El Open Capture File opens a previously created capture file The SimFlex Protocol Analyzer can open pcap and pcapng files El Save Capture File saves the currently opened capture file with a different file name O Start Capture Create a new capture file and start capturing Pause Capt
16. addresses is to be applied A single IP address can be specified or a source and destination IP address Stop Condition File Size specify the maximum file size that will be the stop condition for capturing Stop Condition Packet Count specify the number of packets to be captured before the capturing will stop automatically Stop Condition Relative Time specify the duration of capturing after starting Stop Condition Absolute Time specify the time to stop capturing 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual icixi General Capture Capture Filter Stop Condition 2 i Fd aos gt File Size kilobytes 000 I Packet Count 110000 Disabled C IP Address Source or Destination C Disabled IP Address V Source 192 168 1 10 C Relative Time seconds AAA IV Destination 192 168 13 Absolute Time fhmm ss Figure 3 2 4 GridClone Analyzer Filter Language A filter is an expression of logical conditions The result of applying a filter on a frame is evaluating all logical conditions which results in TRUE or FALSE A filter is a free text string For the technical inclined person the filter is in the disjunctive normal form which means it is a sequence of terms with OR operations were each term is a sequence of sub terms with AND operations Each sub term is a logical equation resulting in TRUE or FALSE The filter expression d
17. ce Protocol The top layer protocol in the captured Ethernet packet Length The total packet size in bytes 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual e Information A brief summary of information from the frame s top layer protocol e Remarks The result of the packet analysis and user remarks 2 3 2 Right click options e Follow Unfollow To change the Capture View Filter add or remove filtering on the addresses or protocol of the active frame Only enabled if the active cell the cell in which the right mouse button is released contains a mac or ip address or a protocol e Mark Unmark Toggles the background color for all selected frames between white and yellow pink orange for frames that have a remark e Save Selected Frames saves the currently selected frames to a new pcap or pcapng file Multiple frames can be selected in the Capture View as follows e Add Remark To add a remark to the active frame 2 4 Detail View Detailed information on the active frame is displayed In the View menu Dissect Option the General information and the Frame information sections can be switched on off The other sections can be shown hidden by the buttons below These buttons refer to the layers in the OSI model 1 PHY physical layer 2 LNK data link layer 3 NET network layer 4 TRA transport layer 5 SES session layer 6 PRE presentation layer 7
18. d setup your copy of the SimFlex Protocol Analyzer 7 1 2 How can I check if a device IED or DUT is available on the network See that your DUT is turned on and connected to the same LAN as your Protocol Analyzer Find out the IP address of the DUT A simple test to check if the DUT is connected and within range of the Client Simulator is to open a Windows Command Window cmd exe and typing the following instruction at the caret EN C Windows system32 cmd exe e mm C gt ping 192 168 6 166 The IP address behind the ping command shall be the IP address of the DUT In case the DUT is visible it will react with positive responds Next be sure that you selected the appropriate network interface in the Configuration Dialog of the Protocol Analyzer Try to capture network traffic and check for frames with the IP number of the DUT as source 7 1 3 The Protocol Analyzer does not start or complains about the license In the system tray check if the CodeMeter service is running clicking on the small system tray arrow If the CodeMeter is not visible it could be that it is not running or that the service is running but the CodeMeter program is not visible a Inthe first case re install the Protocol Analyzer and make sure the CodeMeter software installs correctly b In the second case press Windows Start button and locate the CodeMeter installation Then start the CodeMeter Control Center manually
19. e Merged Capture File C ProgramData GridClone SimFlex Protocol Analyzer File1 Merged pcapng Figure 6 1 1 Select the first capture file Click the ellipses button on the right side of the First Capture File text box Select a capture file from the Open dialog that appears and click the Open button 2 Select the second capture file Click the ellipses button on the right side of the Second Capture File text box Select a capture file from the Open dialog that appears and click the Open button NOTE The SimFlex Protocol Analyzer automatically generates a file name for the merged capture files 3 Change or enter the file name for the merged capture file You can directly change the file name in the text box or click the button on the right side of the Merged Capture File text box Enter a file name 4 Click OK button to create the merged capture file 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual 7 Frequently Asked Questions FAQ This chapter provides some frequently asked questions and theirs answers Check this section before you contact GridClone for support on your question 7 1 General 7 1 1 How to install the SimFlex Protocol Analyzer Read the Getting started document that comes with the program for a detailed description of the installation procedure If you do not have administrator rights on your PC please contact your IT department to initially install an
20. e is pressed the Performance SimFlex Protocol Analyzer form see chapter 5 1 will be shown Application base directory this is the base directory that is used to store network capture files and log files Prefix the user can specify a prefix that will be used in combination with the automatically generated file name The total file name is therefore constructed as follows prefix yyyy mm dd hh mm ss extension icii General Capture Capture Interface 1 2 D4 BE D9 93 77 B0 Intel R 82579LM Gigabit Network Connection Local Area Connection 2 zi Capture Interface 2 3 00 10 18 AF D9 CB Broadcom NebXreme Gigabit Ethemet Local Area Connection zi IV Show Performance graphics at start capture File Settings Application base directory C ProgremData GridClone SimFlex Protocol Analyzer Filename prefix Prefix Figure 3 1 Settings Capture The tab for Capture Settings provides the user control over what is captured and when it is captured The following settings are available Capture Filter Protocol the SimFlex Protocol Analyzer can filter specific Ethernet packets right at the capture port Therefor these filters are called capture filters similar to the display filters that can be selected in the main window Currently the capture filters that can be selected are GOOSE GSE Management or SAV Capture Filter IP Address filtering the user can specify if filtering on IP
21. eceesesaeeeeseaaeeeeeeaas 17 yEeMESCIIC E 17 7 1 1 How to install the SimFlex Protocol AnalyZer cccccconononocnnnnnnnononnnnnnnnnnnonnnnn nennen enne nnns 17 7 1 2 How can check if a device IED or DUT is available on the network ssss 17 7 1 3 The Protocol Analyzer does not start or complains about the license sseseses 17 8 Additiorial Information t er eee ete ete n e teca 18 8 1 Filename conventions tete tecti tenu terre dette pe qe do A 18 8 2 Used abbreviations ertt eet reete t eter Ee ertt eer ele teen 18 8 3 Referenced documents di e n RAS Ie eU o naa 18 8 4 Referenced tools oe ee ndo e ert eig t e apr er deir e Feder eem has 19 8 5 User Manual version history ccccccssssssccecececsesesseseceeeceseeaaeseseescessesaaaeseceseeceseesaeaeeeeseeseeseneass 19 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual Introduction 1 1 What is SimFlex Protocol Analyzer The SimFlex IEC 61850 Protocol Analyzer is a tool for analyzing network traffic between IEC 61850 based clients and servers IEDs This software tool is designed for analyzing IEC 61850 data and its mapping on MMS ISO 9506 The Analyzer captures any Ethernet network packet but has special decoding and analysis features for the following packets e MMS e GOOSE e GOOSE Management e Sampled Values data The SimFlex IEC 61850 Protocol Analyze
22. ennt nnn enn 9 Settings General e Eure E A EA isis 9 Settings Capt re ocu scene tee ipe E 10 GridClone Analyzer Filter Language cccsccccccecessessnsecececssessceeeeeeecesseseeaeeeeeeeseesenseasaeeeeseesees 11 Filter language keywords oret eee e ee eee eie cda 11 NOR 13 ll A A E A E E EA 13 Some pitfalls and useful filter expressions ooooocccnncnonononannnnnononannnnnnnnnonononononnnonnnnnnnnnannnnnnnnnnnos 14 Performance MOnItOF ren teh cei tede ente ir dec 14 SimFlex Protocol Analyzer performance MONItOS ccccccccccecssssssaecececesessscnsaeeeseseseessesseaeeeeess 14 Windows performance MONItON ccccccccccecessessnececececessessaeeeeeceseeseaaeseseeseesseesesasaeeeeeeesenseaaees 14 Use case Starting and stopping SimFlex Protocol Analyzer essen 15 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual 6 1 Verify the capture of network traffic from an lED cccconnnococconnncconononnnnnononnnanon non cnnnnnnnnananananoss 15 6 2 Start SimFlex Protocol Analyzer ccccccccccccsssssesscecececesessaeseeeesceesesesaesecessecesseseaeaeeeeseesseseaeas 16 6 3 Configure the right network adapter in SimFlex Protocol Analyzer seseeeese 16 6 4 Merge Capture Fils cocina atate E pe ue rs Pe E sal e e EDO Ta va ER PRAE Tug es 16 7 Frequently Asked Questions FAQ ccccccccesssscecssssececsssseceesssececsesaeceesesaeceesesae
23. ers 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual Please consult your system administrator or an Ethernet expert before changing network parameters NOTE Please check your Windows OS manual on how to change the IP address and network mask 6 2 Start SimFlex Protocol Analyzer Open the SimFlex Protocol Analyzer as you would normally open any Windows application You may find a link under the Start menu in the GridClone folder Another way to start the program is to double click the SimFlex Client Simulator icon on the desktop available when this option was selected during the installation of the software 6 3 Configure the right network adapter in SimFlex Protocol Analyzer Please check chapter Error Reference source not found for more information on how to configure the network interface cards NICs in the SimFlex Protocol Analyzer 6 4 Merge Capture Files The SimFlex Protocol Analyzer has a feature to merge network capture files This enables the user to merge two previously created network captures into a single pcap or pcapng file To execute the merge function please select menu File Merge Capture Files and perform the following steps LI x m Source Capture Files First Capture File C Program Data GridClone SimFlex Protocol Analyzer File 1 pcapng es Second Capture File C ProgramData GridClone SimFlex Protocol Analyzer File2 pcapng m Merged Capture Fil
24. g traffic between IEC 61850 devices and systems Key features of the SimFlex Protocol Analyzer include e Assistance for test cases from the UCA International Users Group detailed test procedures based on IEC61850 10 e Through a flexible interface any network traffic can be analyzed quickly and thoroughly e Logging of analysis progress and analysis results in human readable text format 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual e Network traffic is captured in PCAP format that can be read by other tools such as Wireshark e Advanced GOOSE engine enables analyzing GOOSE messages including faulty ones as assistance for negative testing e Visual representation of network traffic between IED s The SimFlex Protocol Analyzer provides a simple graphical user interface GUI for analyzing IEC 61850 network traffic Many of the features of the program are available through an intuitive tool bar 1 5 Basic skill requirements The SimFlex Protocol Analyzer has been designed to be user friendly The GUI is showing the most important functions that the average user needs in daily use The program is therefore easy to learn The program also provides the IEC 61850 and MMS specific information in the most human readable way For the user it is therefore no longer needed to translate the MMS services into IEC 61850 services or vice versa The program already has done this job for you However as the functi
25. ide in an equation is free text In most cases it is clear what kind of text is appropriate in combination with an item on the left side It does not make sense to put IP numbers on the right side when the keyword on the left side is protocol For the keyword remark the values on the left side should be the originator of the remark e g USER for all remarks made by a user or GOOSE for remarks made by the GOOSE analysis Left side value Acceptable right side values case insensitive case insensitive protocol Any protocol name e g MMS GOOSE SV HTTP UDP NTP etc mac Any mac address mac to eth to mac from eth from mac src eth src mac dst eth dst ip Any IP address ip to ip from ip src ip dst 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual Left side value Acceptable right side values case insensitive case insensitive remark Origin of the remark e g USER GOOSE etc 4 2 Shortcuts Some equations for protocols connected with the IEC 61850 can be abbreviated to short forms The known protocols within the IEC 61850 for with this is possible are MMS GOOSE and SV The equation for testing a protocol on equality can be abbreviated by just mentioning the protocol name Equation Abbreviated form Case insensitive Case insensitive protocol
26. ilter expressions Note the braces are included for readability Filter expression gt Meaning Protocol mms gt Show all frames with protocol equals to MMS protocol EQ MMS or protocol EQ GOOSE gt Show all frames with protocol equals to MMS or GOOSE remark user and remark goose gt Show all frames with a remark made by a user of by the GOOSE analysis 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual ip 10 20 1 220 and protocol GOOSE or gt Show all frames from to IP 10 20 1 220 with protocol GOOSE ip 10 20 1 123 and protocol MMS or from to IP 10 20 1 123 with protocol MMS The last expression without braces as used in the program reads as ip 10 20 1 220 and protocol GOOSE or ip 10 10 1 123 and protocol MMS The item on the left side frame attributes in an equation can take the following values Name Value a Meaning Case insensitive PROTOCOL protocol The top protocol recognised for the frame MAC mac The mac address with the frame to or from MACTO mac to The to mac address with the frame MACFROM mac from The from mac address with the frame IP ip The IP address with the frame to or from IPTO ip to The to IP address with the frame IPFROM ip from The from IP address with the frame REMARK remark The remark made to the frame The item on the right s
27. oes not use braces or Y but for clarity in this text we use braces All parts ina filter expression are case insensitive White space a blank is used between several key words in the expression The sequence protocol MAC is recognised as protocol MAC and is acceptable as a filter expression while protocol MAC no spaces used is also recognised as protocol MAC and is acceptable as a filter expression However if logical operator is used then white space must be used before and after it 4 1 Filter language keywords A filter expression is a sequence of terms with OR operations gt term OR term OR A term is a sequence of sub terms with AND operations gt term AND term AND A sub term is an equation gt x y x ley A filter expression uses the two logical operators OR and AND and two equation operators equals and not equals A number of synonyms are accepted for the operators see the list below Name Mua e Meaning Case insensitive OR OR Or operation AND AND amp amp amp And operation EQ EQ Equality equation NE NE lt gt Inequality equation An equation needs a value on the left side and one on the right side The value on the left side is a reference to an attribute for the frame to be tested the value on the right side is the particular value to test for Examples of some f
28. on of a Protocol Analyzer is analyzing Ethernet network traffic some basic Ethernet knowledge will be needed to understand the communication captured from the network In case problems exists in IEC 61850 clients or servers that result in problems in network communication then a deeper knowledge of MMS and IEC 61850 is needed to understand the cause of the problem The SimFlex Protocol Analyzer will help the user in finding and understanding the problem easier 2 SimFlex Protocol Analyzer overview After startup of the application the main window is shown see Figure 2 1 The main window has the following sections 1 The Program Menu all program functions can be accessed from this menu 2 The Tool Bar the tool bar provides quick access to frequently used functions like start stop capturing and display filters 3 The Capture View this view shows the list of captured Ethernet packets Based on the applied capture filters and display filters the Capture View can show filtered information 4 Detail View this view shows the contents of a single Ethernet frame The user can filter specific frame information by applying the filter buttons below the view 5 Log View this view shows general program logging information 6 Status Bar 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual SimFlex Protocol Analyzer Ele Edt Vew Heb jni x
29. r is an easy to use tool with advanced capabilities that enables utilities manufacturers system integrators and conformance test laboratories to view and analyze network traffic between IEC 61850 based clients and server devices The SimFlex IEC 61850 Protocol Analyzer is a member of the SimFlex platform This platform provides tools for simulating and testing IEC 61850 clients and servers The Analyzer is easy to use and its intuitive graphical user interface enables to quickly analyze network traffic This makes the SimFlex IEC 61850 Protocol Analyzer an excellent software solution for the electrical power industry 1 2 Benefits The main benefits of using the SimFlex Protocol Analyzer are e Fast and flexible capturing of network traffic from IEC 61850 based clients and servers IEDs e Find errors in MMS GOOSE and Sampled Value communication fast e Not only network sniffing but also real analysis e Assistance during the verification of IEC 61850 implementations e Focused on IEC 61850 and MMS network communication 1 3 Applications The SimFlex Protocol Analyzer has a wide range of applications e Assistance in IEC 61850 conformance testing e IED product development e GOOSE publishing and subscribing e Network traffic analysis e Assistance in preparation for UCA International Users Group based IED certification 1 4 KeyFeatures The SimFlex Protocol Analyzer is designed to be an all round tool in analyzin
30. re View Marked frames will have a yellow background color or orange when they also contain a remark Add Remark to frame opens a dialog that can be used to add a remark to the active frame Frames that contain remarks will have a pink background color Find frame opens a dialog that can be used for finding text in Capture view It will activate the next or previous if search up is checked frame that contains the specified text in one of the visible columns This command can also be started by pressing Ctrl F when the Capture view is activated 2 1 3 Menu View In the View menu the following actions can be executed Display Absolute Time Adds a column in the Capture View that shows the absolute time of the captured frame This column is enabled by default Display Relative Time Adds a column in the Capture View that shows the time of the captured frame relative to the first captured frame the first captured frame might not be visible due to user applied filters Display Difference Time Adds a column in the Capture View that shows the difference time between displayed frames Detail General Information Displays the General Information section in the Detail View Detail Frame Information Displays the Frame Information section in the Detail View 2 1 4 Menu Help In the Help menu the following actions can be executed User Manual opens the on line user manual The on line user manual is a
31. sampled value or not a sampled value 5 Performance Monitor The memory use capture rate and dissector rate can be visualized by the SimFlex Protocol Analyzer or using Windows performance monitor 5 1 SimFlex Protocol Analyzer performance monitor This monitor will be shown when Start Capture is clicked To start it manually click on one of the indicators in the toolbar in the bottom right corner The window will be displayed modal Only one window is activated Click in the window SimFlex Protocol Analyzer performance monitor 80 A 250 60 gt 2007 3 e e 40 1502 g 100 20 50 0 had 0 Iv MED Iv cu IV Dra Iv Da0 QO cance Figure 5 1 Checkboxes can be used to display or hide the indicators in the graph e M currently used memory in MB e Cr NIC Capture rate in frames per second e Dr Dissector rate in frames per second e Drd Dissector rate detail in frames per second The graph will automatically change scale when needed When the lines reach the end the first 2096 will be removed The window is sizable Scales will automatically be updated after scaling 5 2 Windows performance monitor To start this application open the start menu and type in the Search programs and files the first characters of the application name performance monitor Click or enter to run 2011 2014 GridClone B V SimFlex Protocol Analyzer User Manual
32. ure Resume Capture Stop capturing continue capturing in the opened file Stop Capture Stop capturing EM Enable Disable Device 1 If there are two capture interface devices set see 3 1 settings general this button can be used to disable capturing from the first defined interface device Enable Disable Device 2 If there are two capture interface devices set see 3 1 settings general this button can be used to disable capturing from the second defined interface device Toolbar Capture View Filter Filter Po Clear rms coose Y sv 2 2 3 Capture View Filter Editable combo box Enables the user to define a filter for the frames that are displayed in the Capture View The syntax that is required is documented in chapter 4 The button will open online help on this chapter Previously used filters are stored in the user s registry and are available in the combo list Clear Clears the Capture View Filter All captured frames will be listed MMS Toggles MMS in the Capture View Filter Green gt MMS will be listed GOOSE Toggles GOOSE in the Capture View Filter Green gt GOOSE will be listed SV Toggles SV in the Capture View Filter Green SAV will be listed Toolbar Other Analyze Check all captured GOOSE streams sampled value streams and client server communication on correct protocol behavior Previous issue Activate previous frame that has an issue found by Analyze
Download Pdf Manuals
Related Search