3

I'm analysing some communication issues that we have between a server (SCADA) and remote terminal units (RTU) that we have in the field. The communications are IEC104 protocol which use TCP/IP. The IEC104 protocol have its hown numbering mecanism. So when an IEC104 message (APDU) is lost it is detected.

The problem we have is that, sometimes, IEC104 APDU comming from the RTU are lost (hole in the numbering) but the underlying TCP sequence number is correct. I analyzed this with wireshark.

The connection is going trough several routers and firewalls and radio. NAT is also used at one point.

I'm trying to find out if the problem is in the RTU or in the network.

My understanding of the TCP protocol is that it does a check end-to-end. The paquets are numbered on each end of the connection and acknowledge also on each end. If this is the case then the problem is in the RTU and the IEC104 numbering.

Am I wrong? Is there cases where equipements on the network (routers, firewalls with NAT) could renumber the TCP sequence? If this is the case then the problem would be in the network. In my opinion it is not the case because routers, firewalls work on layer 3 (network/IP). It should not touch the TCP layer...but I'm not up to date with the latest inovations :)

Could some specialist give their advice?

Thanks

Alex

1

sometimes, IEC104 APDU comming from the RTU are lost (hole in the numbering) but the underlying TCP sequence number is correct.

Then, the sender's stack doesn't ever see that APDU, ie. there's a problem above TCP.

I'm assuming there's no malicious MitM removing APDUs and filling the hole with some other data. Since TCP tracks transmitted vs received bytes it's really hard to swap real data for fake. And it's impossible by accident or chance.

My understanding of the TCP protocol is that it does a check end-to-end. The paquets are numbered on each end of the connection and acknowledge also on each end. If this is the case then the problem is in the RTU and the IEC104 numbering.

Yes, that is absolutely correct. Firewalls or NAT router do not renumber TCP segments in any case. Even if fragmentation takes place, that's in the network layer and entirely transparent to TCP and above.

2
  • Hi Zac, I was not expeting an answer after such long period :) – Qlex Feb 17 at 15:07
  • 1
    Anyway thanks for your answer. Problem came from defect batteries. Those RTUs are located in a city at the border of a desert in Africa; Temperature can reach 50°C. Not good for the life of the batteries. When power was low, communication module and radio were still lable to work (TCP numbering correct) but something was going wrong in RTU (APDU numbering incorrect). Replacing the batteries solved the problem for a while ... – Qlex Feb 17 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.