You Name It,
We Analyze It!
Jim Gilsinn
Kenexis Consulting Corporation

You Name It, We Analyze It!

1
Industrial Network Types & Metrics:
Publish/Subscribe

• Publish/subscribe or peer-to-peer communications
• Main performance metric: Cyclic frequency variability/jitter
• Real-time EtherNet/IP™ uses publish/subscribe
• Requested/Accepted Packet Interval (RPI/API)
• Measured Packet Interval (MPI)
You Name It, We Analyze It!

2
Industrial Network Types & Metrics:
Publish/Subscribe
Subscriber

TSub_Com_Init

Publisher

TPub_Com_Init
TPub_1
TPub_2

TSub_M

.
.
.

• Difference between
TPub_Com_Init & TSub_Com_Init
is network roundtrip delay
• TPub_Com_Init, TSub_Com_Init
not important
• Variability in TPub much
more important
• Theoretically, TPub doesn’t
need to match Tsub

TPub_N-1
TPub_N
You Name It, We Analyze It!

• In production systems,
they are the same

3
Performance Testing Methodology:
Performance Metrics

• Command/response or master/slave communications
• Main performance metric: Latency
• Large numbers of protocols use this
• Most (All?) PC-based server/client protocols – HTTP(S), (S)FTP, etc.
• Most industrial protocols – Modbus/TCP, Profinet, Ethercat, etc.
You Name It, We Analyze It!

4
Industrial Network Types & Metrics:
Command/Response
Commander

TCom_Delay_1

Responder

TRes_1

• Difference between
TCom_Delay & TRes is
network roundtrip delay
• Latency in TCom & TRes
important

TCom_1
TCom_Delay_2

TRes_2

TCom_2

You Name It, We Analyze It!

5
Isolating Traffic Streams
• Isolating traffic streams can be tricky
• 10’s – 100’s of traffic streams in production environment
• Your Wireshark Fu must be strong!
• Usually requires additional post-processing
• Multiple streams can exist between same devices

You Name It, We Analyze It!

6
Isolating Traffic Streams
• Traffic pairs
•
•
•
•

Source IP/MAC address
Destination IP/MAC address
Source TCP/UDP port
Destination TCP/UDP port

• Publish/Subscribe
• Communication stream ID
• Sequence number (optional)

• Command/Response
• Command message/field
• Response message/field
• Message ID (optional)
You Name It, We Analyze It!

7
Test Time vs. Packet Interval
Measured Packet Interval (ms)

~62 sec test
Mean MPI = 2ms
Min ~ 1.2
Max ~ 2.9

Test Time (s)

You Name It, We Analyze It!

8
Time Plot for Command/Response

Regular Pattern to Delayed Packets
Regular Pattern of Minimal Delayed Packets

You Name It, We Analyze It!

9
Command/Response Timing Plots
• Quick succession of command/response packets
• Minimal delay in command/response sequence
• Apparently large delay in a single packet
• Example: Rockwell tag reads

Delay Until Next Time Sequence
Quick Succession Read Commands
You Name It, We Analyze It!

10
Next Steps
• Streamline traffic stream processing
• Develop better command/response code
• Build more mathematical statistical models
• Add graphical modeling of time & frequency domain
• Add more industrial protocols and obtain example files
•
•
•
•
•

Modbus
Profinet
DNP3
61850
And others…
You Name It, We Analyze It!

11
Questions
• Contact Me
•
•
•
•
•
•

Jim Gilsinn
301-706-9985 or 614-323-2254
jim.gilsinn@kenexis.com
Twitter – @JimGilsinn
LinkedIn – http://www.linkedin.com/in/jimgilsinn/
SlideShare – http://www.slideshare.net/gilsinnj

You Name It, We Analyze It!

12

More Related Content

PPTX
ICS Performance Lab
PPTX
Network Security: Protecting SOHO Networks
PPTX
Spirent: The Internet of Things: The Expanded Security Perimeter
PDF
Spirent Accelerating SDN and NFV Deployments
PPT
Chapter12
PDF
Stinson post si and verification
PDF
Production Ready Microservices at Scale
PPT
Time Critical Networks
ICS Performance Lab
Network Security: Protecting SOHO Networks
Spirent: The Internet of Things: The Expanded Security Perimeter
Spirent Accelerating SDN and NFV Deployments
Chapter12
Stinson post si and verification
Production Ready Microservices at Scale
Time Critical Networks

What's hot (20)

PPTX
Protecting Your IP with Perforce Helix and Interset
PPTX
Free training on NCM - Discovery & Disaster recovery
PPT
Validating Next Generation CPUs
PDF
Understanding Hacker Tools and Techniques: A live Demonstration
PPT
Chapter08
PDF
Daniel Cross, Electronics Engineer
PDF
HIS 2015: Prof. Mark Little - Open Source Challenges in the Enterprise
PPTX
Network and server performance monitoring training
PDF
Securing your telco cloud
PDF
Embedded Webinar #17 "Low-level Network Testing in Embedded Devices Development"
PDF
IEEE Buenaventura cs Chapter March 9 2016 v4
DOC
sree profile
PDF
Come See What’s Cooking in My Lab
PDF
The Cortex-A15 Verification Story
PPT
PDF
Securing NFV and SDN Integrated OpenStack Cloud: Challenges and Solutions
PDF
Enterprise Network Monitoring Software by ServicePilot
PPT
Virtual Private Network
PPT
DHS ICS Security Presentation
PPTX
Software Defined Network - SDN
Protecting Your IP with Perforce Helix and Interset
Free training on NCM - Discovery & Disaster recovery
Validating Next Generation CPUs
Understanding Hacker Tools and Techniques: A live Demonstration
Chapter08
Daniel Cross, Electronics Engineer
HIS 2015: Prof. Mark Little - Open Source Challenges in the Enterprise
Network and server performance monitoring training
Securing your telco cloud
Embedded Webinar #17 "Low-level Network Testing in Embedded Devices Development"
IEEE Buenaventura cs Chapter March 9 2016 v4
sree profile
Come See What’s Cooking in My Lab
The Cortex-A15 Verification Story
Securing NFV and SDN Integrated OpenStack Cloud: Challenges and Solutions
Enterprise Network Monitoring Software by ServicePilot
Virtual Private Network
DHS ICS Security Presentation
Software Defined Network - SDN
Ad

Viewers also liked (15)

PPTX
A Child Like Approach to Grid Cybersecurity
PPTX
Wireshark Network Protocol Analyzer
PDF
The 4horsemen of ics secapocalypse
PPTX
SANS ICS Security Survey Report 2016
PPTX
Using Cyber-Vulnerability Assessment (CVA) to Optimize Control System Upgrade...
PPTX
Practical Approaches to Securely Integrating Business and Production
PPTX
Low-Cost ICS Network Performance Testing
PPTX
Integrating the Alphabet Soup of Standards
PPTX
Network Reliability Monitoring for ICS: Going Beyond NSM and SIEM
PPTX
Cook Like a Hacker!
PPTX
Dubai Cyber Security 01 Ics Scada Cyber Security Solutions and Challenges...
PPTX
Evaluating System-Level Cyber Security vs. ANSI/ISA-62443-3-3
PPTX
Cyber & Process Attack Scenarios for ICS
PPTX
Test Tool for Industrial Ethernet Network Performance (June 2009)
PPTX
Network Packet Analysis with Wireshark
A Child Like Approach to Grid Cybersecurity
Wireshark Network Protocol Analyzer
The 4horsemen of ics secapocalypse
SANS ICS Security Survey Report 2016
Using Cyber-Vulnerability Assessment (CVA) to Optimize Control System Upgrade...
Practical Approaches to Securely Integrating Business and Production
Low-Cost ICS Network Performance Testing
Integrating the Alphabet Soup of Standards
Network Reliability Monitoring for ICS: Going Beyond NSM and SIEM
Cook Like a Hacker!
Dubai Cyber Security 01 Ics Scada Cyber Security Solutions and Challenges...
Evaluating System-Level Cyber Security vs. ANSI/ISA-62443-3-3
Cyber & Process Attack Scenarios for ICS
Test Tool for Industrial Ethernet Network Performance (June 2009)
Network Packet Analysis with Wireshark
Ad

Similar to You name it, we analyze it (20)

PDF
S4x14 Session: You Name It; We Analyze It
PPT
2015 02 24 lmtv baselining
PDF
Network performance overview
PPT
Presentations on basic understanding of networm management
PPT
Network protocol
PDF
Where can buy Special Edition Using TCP IP Niit (Usa) Inc. ebook with cheap p...
PPTX
TCP/IP
PDF
Complete Download Special Edition Using TCP IP Niit (Usa) Inc. PDF All Chapters
PDF
Iic tsn testbed_char_mapping_of_converged_traffic_types_whitepaper_20180328
PPTX
PPTX
Chapter04
PDF
Module 1 slides
DOCX
Proposal for System Analysis and Desing
DOCX
Networking Fundamentals
PPTX
Packet Analysis - Course Technology Computing Conference
PPTX
Advanced Network Chapter I: Which is very best lecture note
PPT
Learn TransportLayer of the OSI model to day with me.
PDF
Design, implementation and evaluation of icmp based available network bandwid...
PDF
CISSP Week 5
PPTX
network monitoring system ppt
S4x14 Session: You Name It; We Analyze It
2015 02 24 lmtv baselining
Network performance overview
Presentations on basic understanding of networm management
Network protocol
Where can buy Special Edition Using TCP IP Niit (Usa) Inc. ebook with cheap p...
TCP/IP
Complete Download Special Edition Using TCP IP Niit (Usa) Inc. PDF All Chapters
Iic tsn testbed_char_mapping_of_converged_traffic_types_whitepaper_20180328
Chapter04
Module 1 slides
Proposal for System Analysis and Desing
Networking Fundamentals
Packet Analysis - Course Technology Computing Conference
Advanced Network Chapter I: Which is very best lecture note
Learn TransportLayer of the OSI model to day with me.
Design, implementation and evaluation of icmp based available network bandwid...
CISSP Week 5
network monitoring system ppt

Recently uploaded (20)

PPT
Module 1.ppt Iot fundamentals and Architecture
PDF
Produktkatalog für HOBO Datenlogger, Wetterstationen, Sensoren, Software und ...
PDF
A contest of sentiment analysis: k-nearest neighbor versus neural network
PPTX
Configure Apache Mutual Authentication
PDF
OpenACC and Open Hackathons Monthly Highlights July 2025
PPTX
GROUP4NURSINGINFORMATICSREPORT-2 PRESENTATION
PDF
Hybrid horned lizard optimization algorithm-aquila optimizer for DC motor
PDF
How ambidextrous entrepreneurial leaders react to the artificial intelligence...
PDF
A review of recent deep learning applications in wood surface defect identifi...
PPTX
Training Program for knowledge in solar cell and solar industry
PPTX
AI IN MARKETING- PRESENTED BY ANWAR KABIR 1st June 2025.pptx
PDF
Credit Without Borders: AI and Financial Inclusion in Bangladesh
PDF
STKI Israel Market Study 2025 version august
PPTX
Microsoft Excel 365/2024 Beginner's training
PDF
sbt 2.0: go big (Scala Days 2025 edition)
PDF
Developing a website for English-speaking practice to English as a foreign la...
PDF
sustainability-14-14877-v2.pddhzftheheeeee
PDF
Enhancing plagiarism detection using data pre-processing and machine learning...
PDF
“A New Era of 3D Sensing: Transforming Industries and Creating Opportunities,...
PPTX
TEXTILE technology diploma scope and career opportunities
Module 1.ppt Iot fundamentals and Architecture
Produktkatalog für HOBO Datenlogger, Wetterstationen, Sensoren, Software und ...
A contest of sentiment analysis: k-nearest neighbor versus neural network
Configure Apache Mutual Authentication
OpenACC and Open Hackathons Monthly Highlights July 2025
GROUP4NURSINGINFORMATICSREPORT-2 PRESENTATION
Hybrid horned lizard optimization algorithm-aquila optimizer for DC motor
How ambidextrous entrepreneurial leaders react to the artificial intelligence...
A review of recent deep learning applications in wood surface defect identifi...
Training Program for knowledge in solar cell and solar industry
AI IN MARKETING- PRESENTED BY ANWAR KABIR 1st June 2025.pptx
Credit Without Borders: AI and Financial Inclusion in Bangladesh
STKI Israel Market Study 2025 version august
Microsoft Excel 365/2024 Beginner's training
sbt 2.0: go big (Scala Days 2025 edition)
Developing a website for English-speaking practice to English as a foreign la...
sustainability-14-14877-v2.pddhzftheheeeee
Enhancing plagiarism detection using data pre-processing and machine learning...
“A New Era of 3D Sensing: Transforming Industries and Creating Opportunities,...
TEXTILE technology diploma scope and career opportunities

You name it, we analyze it

  • 1. You Name It, We Analyze It! Jim Gilsinn Kenexis Consulting Corporation You Name It, We Analyze It! 1
  • 2. Industrial Network Types & Metrics: Publish/Subscribe • Publish/subscribe or peer-to-peer communications • Main performance metric: Cyclic frequency variability/jitter • Real-time EtherNet/IP™ uses publish/subscribe • Requested/Accepted Packet Interval (RPI/API) • Measured Packet Interval (MPI) You Name It, We Analyze It! 2
  • 3. Industrial Network Types & Metrics: Publish/Subscribe Subscriber TSub_Com_Init Publisher TPub_Com_Init TPub_1 TPub_2 TSub_M . . . • Difference between TPub_Com_Init & TSub_Com_Init is network roundtrip delay • TPub_Com_Init, TSub_Com_Init not important • Variability in TPub much more important • Theoretically, TPub doesn’t need to match Tsub TPub_N-1 TPub_N You Name It, We Analyze It! • In production systems, they are the same 3
  • 4. Performance Testing Methodology: Performance Metrics • Command/response or master/slave communications • Main performance metric: Latency • Large numbers of protocols use this • Most (All?) PC-based server/client protocols – HTTP(S), (S)FTP, etc. • Most industrial protocols – Modbus/TCP, Profinet, Ethercat, etc. You Name It, We Analyze It! 4
  • 5. Industrial Network Types & Metrics: Command/Response Commander TCom_Delay_1 Responder TRes_1 • Difference between TCom_Delay & TRes is network roundtrip delay • Latency in TCom & TRes important TCom_1 TCom_Delay_2 TRes_2 TCom_2 You Name It, We Analyze It! 5
  • 6. Isolating Traffic Streams • Isolating traffic streams can be tricky • 10’s – 100’s of traffic streams in production environment • Your Wireshark Fu must be strong! • Usually requires additional post-processing • Multiple streams can exist between same devices You Name It, We Analyze It! 6
  • 7. Isolating Traffic Streams • Traffic pairs • • • • Source IP/MAC address Destination IP/MAC address Source TCP/UDP port Destination TCP/UDP port • Publish/Subscribe • Communication stream ID • Sequence number (optional) • Command/Response • Command message/field • Response message/field • Message ID (optional) You Name It, We Analyze It! 7
  • 8. Test Time vs. Packet Interval Measured Packet Interval (ms) ~62 sec test Mean MPI = 2ms Min ~ 1.2 Max ~ 2.9 Test Time (s) You Name It, We Analyze It! 8
  • 9. Time Plot for Command/Response Regular Pattern to Delayed Packets Regular Pattern of Minimal Delayed Packets You Name It, We Analyze It! 9
  • 10. Command/Response Timing Plots • Quick succession of command/response packets • Minimal delay in command/response sequence • Apparently large delay in a single packet • Example: Rockwell tag reads Delay Until Next Time Sequence Quick Succession Read Commands You Name It, We Analyze It! 10
  • 11. Next Steps • Streamline traffic stream processing • Develop better command/response code • Build more mathematical statistical models • Add graphical modeling of time & frequency domain • Add more industrial protocols and obtain example files • • • • • Modbus Profinet DNP3 61850 And others… You Name It, We Analyze It! 11
  • 12. Questions • Contact Me • • • • • • Jim Gilsinn 301-706-9985 or 614-323-2254 [email protected] Twitter – @JimGilsinn LinkedIn – http://www.linkedin.com/in/jimgilsinn/ SlideShare – http://www.slideshare.net/gilsinnj You Name It, We Analyze It! 12