Network and IT Basics for SCADA Engineers

An IPv4 address (for example 10.13.0.14) identifies a device on a network. The subnet mask (255.255.255.128, also written /25) divides the address into a network part and a device part. Together they define the subnet: the range of addresses the device treats as directly reachable — for 10.13.0.14/25 that is 10.13.0.0 to 10.13.0.127.

The first address of a subnet (the network address) and the last (the broadcast address) cannot be given to a device. A 169.254.x.x address means the adapter asked for an address from a DHCP server and got no answer — on a substation network, devices normally have static addresses.

To send a packet, a device checks whether the destination is inside its own subnet, using its own mask. If it is, the device sends directly. If not, it sends the packet to its default gateway (a router), which forwards it. A device without a gateway can only reach its own subnet.

Because each device uses its own mask, two devices can disagree. A laptop on /24 may think an IED is local while the IED on /25 thinks the laptop is remote and sends its reply to the router: the requests arrive, the replies are lost, and ping simply times out. The SCADA Connectivity Assistant checks this from both sides. On a laptop with several adapters, route print shows which adapter and gateway Windows really uses.

On the local network, frames are delivered by MAC address, the hardware address of the network interface. Before sending to a local IP address, a device asks 'who has this IP?' with an ARP broadcast; the owner answers with its MAC address. arp -a shows the answers this PC has received.

If ping fails but arp -a shows the IED's MAC address, the IED is on the network and simply does not answer ping. If there is no ARP entry, the IED never answered at the Ethernet level: it is off, unplugged, on another VLAN or has another address. Two devices with the same IP address cause intermittent faults; Windows marks its own address '(Duplicate)' and logs event 4199.

A VLAN divides one physical switch network into separate logical networks. Each switch port has an untagged (native) VLAN for devices that do not tag their frames, and may carry other VLANs tagged with a 4-byte IEEE 802.1Q header that holds the VLAN ID and a priority from 0 to 7.

Two devices on different VLANs cannot talk directly even if their IP addresses match — a common cause of 'everything looks right but nothing answers'. GOOSE and sampled values are normally tagged with their own VLAN and priority 4 or higher, so switches queue them ahead of other traffic; every port and uplink on their path must carry that VLAN.

GOOSE and sampled values are Layer 2 multicast frames (EtherType 0x88B8 and 0x88BA) sent to 01-0C-CD-… addresses. They have no IP address, are never routed, and a ping test says nothing about them. Switches flood multicast to every port in the VLAN unless static multicast filters limit it.

IGMP snooping, which many engineers expect to control multicast, only applies to IP multicast (01-00-5E-… addresses); it does not filter GOOSE or SV. Diagnose GOOSE with captures, the subscriber's supervision (LGOS) and the switch VLAN and filter configuration.

Services listen on numbered ports: IEC 61850 MMS on TCP 102, IEC 60870-5-104 on TCP 2404, DNP3 on TCP 20000, Modbus TCP on TCP 502, OPC UA on TCP 4840, NTP on UDP 123, SNMP on UDP 161 and 162, Remote Desktop on TCP 3389, and the DCOM endpoint mapper used by OPC DA on TCP 135 plus dynamic ports.

When a connection fails, the error tells you a lot. 'Connection refused' (Windows error 10061) means the device answered but nothing listens on that port: the service is off, the port is wrong, or the client limit is reached. 'Timed out' (10060), or SYN_SENT in netstat, means no answer at all: the device is unreachable or a firewall drops the packets.

DNS translates names into IP addresses. Substation devices are usually addressed by IP, but domain logon, historians and services configured by name depend on DNS. nslookup shows whether a name resolves and which DNS server answered; 'Server: UnKnown' only means the DNS server has no name for itself.

DHCP hands out addresses automatically. It is convenient on office networks but unusual on substation networks, where addresses are fixed in the IP register so that every device can be found and configured.

Every event, alarm and disturbance record carries a time stamp, so all devices must agree on the time. Windows computers synchronise with the Windows Time service using NTP, either to a configured server (the station clock) or, in a domain, to the domain controllers. w32tm /query /status shows the source; 'Local CMOS Clock' means it is not synchronised at all.

IEDs typically use SNTP (millisecond-level accuracy) or PTP to IEC/IEEE 61850-9-3 (sub-microsecond, needed for sampled values). Know which device time-stamps an event — the IED at source, or SCADA on receipt — before blaming a clock. Kerberos refuses domain logon when clocks differ by more than 5 minutes by default.

SNMP lets a management system read counters from switches, clocks, firewalls and servers: link state, speed, errors, discards, temperature. Each value has an OID; the common ones are standard (IF-MIB for interfaces, BRIDGE-MIB for spanning tree, LLDP-MIB for neighbours).

A few counters find most cabling faults: receive (CRC) errors point to a cable, connector or SFP; half duplex with late collisions is a duplex mismatch; output discards mean congestion; frequent spanning-tree topology changes mean a flapping link. SNMPv1 and v2c send their community string in clear text; SNMPv3 with authentication and encryption (authPriv) is the secure choice.

SCADA servers run their software as Windows services that depend on each other, on databases and on licence servers. When something stops, the System event log usually says why: 7000 (failed to start), 7031 (terminated unexpectedly), 7009 (start timed out), 1053 (did not respond in time).

When a computer is slow, measure before guessing: Task Manager for a first look, then a Performance Monitor log of CPU, memory, disk latency and available disk space. Disk latency above about 20 ms, available memory below about 10 % of RAM, or a process whose memory keeps growing are the usual causes; scheduled antivirus scans during operation are a frequent one.

In a Windows domain, workstations trust the domain controllers through a secure channel based on a computer account password. Restoring a workstation from an old image or snapshot breaks it, and logon fails with 'the trust relationship between this workstation and the primary domain failed' (error 1789) until it is repaired.

Slow logon on SCADA workstations is very often Group Policy waiting for a domain controller that the network has not yet made reachable at start-up (events 1129 and 5719). Switch ports to workstations configured as edge (portfast) ports and correct DNS settings usually fix it.

OPC UA, HTTPS device interfaces, VPNs and IEC 62351 secured protocols use X.509 certificates to prove identity and encrypt traffic. A certificate has a validity period, a key, a signature from its issuer and names it is valid for. Expired certificates, untrusted self-signed certificates and name mismatches are the common failures, and the error rarely says which.

For OPC UA, the application instance certificate carries the ApplicationUri in its subject alternative name, and each side must trust the other's certificate (or its issuing CA). Track expiry dates in the asset register and renew well before they run out.