Common Terminology

Electrical Equipment

1. PLC

• Local automation, process controllers
• On-site control for production lines, pump stations, gate stations, etc.

RTU

• Data acquisition, communication
• Remote sensing stations for meteorology, hydrology, etc.

Relay

Sensor

IoT Card

• May have directional or bound devices

Protocols

Hardware Protocols

1. RS-485

• OSI physical layer differential signal twisted pair,
• Usually 2-wire half-duplex or 4-wire full-duplex
• No specified communication protocol
• The context is thatprotocols are mostlyModbus-RTU

RS-232 (Physical interface standard 9Pin or 20Pin)

Modbus-RTU

• Communication protocol based on RS-485
• Master-slave architecture

4-20mA

• Analog signal standard
• 4mA represents 0% and 20mA represents 100%

Software and Hardware Communication Protocols

1. TCP (OSI transport layer protocol)
2. MQTT (publish, subscribe)
3. OPC-UA (inquiry and publish, subscribe)
4. Modbus-TCP (inquiry)

Network Related

What to Do When the Link is Down

When the link is down, specific reasons can be addressed bytop-down orbottom-up troubleshooting.

1. Terminal Device

• Power supply
• Device configuration: IP, port, username, password
• 4G (is there an unpaid bill? Directional or bound devices?)

Firewall

• Network testing tools like Ping, Telnet, etc.
• Mock Client testing

Server

• Message specification?

Protocol Analysis

For standard protocols, different manufacturers have varying implementations. Using packet capture tools to analyze network protocols is particularly important. Protocol analysis consists of three parts: capturing packets typically usingtcpdump orWireshark, analyzing network protocols usually withWireshark, and reverse engineering network protocols typically usingImHex

1. Capture network traffic.tcpdump is a powerful network traffic analysis tool that can also store filtered network traffic to a file.

• For multiple network cards, be sure to select the correct one
• Filter by port
• Save to file

Analyze network protocols.Wireshark is a very powerful network packet analyzer that can quickly find and filter out terminal devices with existing issues through its built-in filters.

• <span>tcp contains "ascii"</span>
• <span>tcp contains FF:FF:FF</span>

• Port filtering
• src ip filtering
• Content filtering

Reverse engineer network protocols.ImHex is an excellent hex editor with built-in byte editing tools and pattern languages for convenient reverse analysis of packets.

Conclusion

Gained a horizontal understanding of devices, terminology, and protocols. Also learned how to troubleshoot common network issues. Finally, a brief introduction to the tools used for packet analysis was provided.