3

I have a 24 port Cisco 3560G switch that I'm using to try and pass broadcasted Ethernet packets. I have a computer plugged into one port, and a IEC-61850 GOOSE publisher plugged into another port. Both devices have an IP address assigned, and I can ping each from the other. However, when I run tcpdump on the computer I'm not seeing the broadcasted GOOSE messages from the publisher device.

If I directly connect the two machines, I can see the GOOSE messages with tcpdump. I can also replace the Cisco switch with a simple NetGear 4-port switch and still see the GOOSE packets.

I need to use the Cisco switch such that I can leverage VLANs to eventually get the GOOSE packets to machines connected to other switches, but first I need to get this simple test case working.

Any ideas?

Improve this question
11
  • It's worth noting that GOOSE is a Layer 2 protocol, which is why my question focuses on broadcasting Ethernet packets.
    – Bryan
    Commented Oct 23, 2013 at 20:46
  • What's the tcpdump syntax you're using to capture the frames?
    – John Jensen
    Commented Oct 23, 2013 at 20:53
  • Did you run span on the Cisco device to see if the data is transiting the switch properly? While tcpdump is a great tool, it has it's limitations. Configurations of the switchports, log entries from the swtich, and examples from the working capture may be helpful as well.
    – YLearn
    Commented Oct 23, 2013 at 20:55
  • 1
    The switch does not have storm control or other security features configured?
    – Daniel Dib
    Commented Oct 23, 2013 at 20:58
  • 1
    It does not have storm control configured that I know of... I can post the running config if you like.
    – Bryan
    Commented Oct 23, 2013 at 21:00

1 Answer 1

Reset to default
7

GOOSE uses VLAN and priority tagging as per IEEE 802.1Q to have separate virtual network within the same physical network and sets appropriate message priority level. -- wikipedia

That would suggest this traffic is actually within a VLAN. So even if it is broadcast (or multicast), it's only going to go where that VLAN goes.

tcpdump has a rather annoying feature of not showing vlan tags unless you get rather verbose with it. Use wireshark (or tshark) and look at the complete contents (every. single. bit.) in each frame. Also note, many modern NICs process the vlan tag internally, so the OS doesn't normally see them -- the interface must be in promiscuous mode to turn that off. (and some drivers continue to eat them even then.)

Improve this answer
5
  • So if GOOSE is 802.1q tagging packets, I would expect the switch to drop them as malformed because the switchport is only configured as an access port. Look for drop counters on the ingress switchport?
    – Jason Seemann
    Commented Oct 24, 2013 at 1:35
  • If it were an old (very old) switch, then maybe. A 3560 knows what 802.1q is, and should simply ignore the tagged frames on access ports. (note: a 2924 will crash if sent a tagged packet on an access port. nice bug!)
    – Ricky
    Commented Oct 24, 2013 at 1:44
  • I think we're saying the same thing Ricky - if the Switch ignores the tagged frames, then they aren't going to get to the other switchports, which means the application isn't going to work, and the remote side won't see them in a sniffer trace because they never get there
    – Jason Seemann
    Commented Oct 24, 2013 at 1:47
  • Thanks for posting an answer Ricky. So... my GOOSE device has both its VLAN and Priority Tagging set to 0. Might this be what's causing the issue? I could have sworn it'd worked in the past, but perhaps not. As I said in my OP, things worked fine when using a dinky little Netgear 4 port switch. As such, I figured it should work with the 3560 when the ports were in basic switchport mode. Perhaps this isn't the case since the 3560 is VLAN-capable?
    – Bryan
    Commented Oct 24, 2013 at 3:18
  • hey @RickyBeam - i have a special request. Could you create the tag "iec61850" for us, since you have the required 300 reputation, this would be nice. There are quite some questions out there, but its hard to find them since there is no common tag for them. thanks in advance!
    – Gewure
    Commented May 3, 2017 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.