I'm analysing some communication issues that we have between a server (SCADA) and remote terminal units (RTU) that we have in the field. The communications are IEC104 protocol which use TCP/IP. The IEC104 protocol have its hown numbering mecanism. So when an IEC104 message (APDU) is lost it is detected.
The problem we have is that, sometimes, IEC104 APDU comming from the RTU are lost (hole in the numbering) but the underlying TCP sequence number is correct. I analyzed this with wireshark.
The connection is going trough several routers and firewalls and radio. NAT is also used at one point.
I'm trying to find out if the problem is in the RTU or in the network.
My understanding of the TCP protocol is that it does a check end-to-end. The paquets are numbered on each end of the connection and acknowledge also on each end. If this is the case then the problem is in the RTU and the IEC104 numbering.
Am I wrong? Is there cases where equipements on the network (routers, firewalls with NAT) could renumber the TCP sequence? If this is the case then the problem would be in the network. In my opinion it is not the case because routers, firewalls work on layer 3 (network/IP). It should not touch the TCP layer...but I'm not up to date with the latest inovations :)
Could some specialist give their advice?