Net.Shark tap

Protocol sniffing is a common practice in IEC 61850 substations with Net.Shark, which filters, captures and forwards Ethernet packets including PTP, NTP, GOOSE, SV or MMS protocols. It is ideal for field use as it is a self-contained device with batteries, screen and keyboard that can be connected to any point on the network, no matter how small, high or hidden.

IEC-61850 Commissioning

IEC 61850 protocols are used to perform mission-critical tasks:

• Protection: to detect faults
• Control: to adjust settings
• Synchronisation: to ensure time alignment
• Monitoring: to detect anomalies
• Metering: to bill customers

If these tasks are to be commissioned, it is important to use taps to monitor relevant traffic without introducing additional points of failure, traffic degradation or security vulnerabilities into the utility's network.

Tap anywhere

The physical connections between network Clocks, IEDs, Switchgear, Circuit Breakers and Bay Controllers are often located in small, hard-to-reach panels, making it difficult to connect other devices.

This is why we have developed Net.Shark, a lightweight and portable tap that reaches anywhere on the network and captures Ethernet packets by firmware, ensuring that none are lost or cause interference or errors to other traffic.

Taps vs. Laptops

Some laptops claim to be good taps, but don't have a dual port, so can't capture in full duplex, and aren't powerful enough to capture thousands of messages in real time at wire speed without losing packets. The solution is always a tap, because it works through firmware, not software. Net.Shark is ideal for field capture as it does not require a host to configure and run.

Fig 1. Compare Net.Shark features vs. Laptop and Tap.

Applications

Net.Shark is the right choice for the field, and especially for engineers migrating to the new IEC-61850 substations:

• IEC 61850 Commissioning
• IEC 61850 Troubleshooting
• IEC 61850 Monitoring
• IEC 61850 Capture
• IED acceptance
• Proactive maintenance

Key Features

Net.Shark is powerful, lightweight and can capture in full-duplex mode at wire speed and for more than 12 hours on battery power:

• Filters by IEC-61850 protocol, MAC, IP, VLAN, MPLS, TOS, TCP, UDP, arbitrary
• Operates at wirespeed with 100% packet inspection
• Zero interruption, zero delay, zero packet loss
• Compliance traffic stored on SD card or copied to LAN
• PCAP format support
• Jitter-free time stamps
• VNC remote control
• Full duplex capture
• Optical / electrical ports

Fig 2. Net.Shark in operation capturing IEC-61850 GOOSE messages.