The Role of Wireshark in Industrial Ethernet 17

The Role of Wireshark in Industrial Ethernet 17 June 2009 or “Why things just have to work!” Mike Hinz President | YR 20 SHARKFEST '09 Stanford University June 15 -18, 2009 SHARKFEST '09 | Stanford University | June 15– 18, 2009

YR 20 – Who We Are and What We Do • • • YR 20 Group – a Texas Corp. – Operating Cos in Houston, Texas and Aberdeen, Scotland Over 100 years of experience in mission critical networking and telecommunications Totally independent - objective, fact-based services completely aligned with our customers We operate utilizing our in-house tool-set backed up with years of hard experience to offer our customers optimal solutions to their networking and telecom needs Network Engineering and Analysis as a Service • No capital investment in equipment • We supply the expertise and equipment on a simple contractual basis • Full range of services – lab simulating and testing, incident and problem management, traffic engineering and capacity planning, equipment evaluation, application evaluation and optimization Sales or Leasing of Standards Based Network Data Capture Appliances • PCAP-Probe™ family • Standards based – Training and Support Available, Extremely Rugged with Remote Management – High Performance SHARKFEST '09 | Stanford University | June 15– 18, 2009

Industrial Ethernet and This Project Simply Stated – Industrial Ethernet must work Lives and huge economic values are at stake Focused on plant, process, and control Directly contributes to the revenue stream of an organization • Installation requires detailed approval by a classification society such as DNV, LR, ABS, etc. to get insurance • • – “There must be a tie-wrap on the cable every metre” • Likely to be in hazardous environments SHARKFEST '09 | Stanford University | June 15– 18, 2009

The Project – Why YR 20? • The MV Well Enhancer was conceived by Helix ESG to be the largest, most high tech offshore service vessel available • Very high market visibility • Helix ESG demanded that this vessel ‘simply must work!’ – Lives, Safety and Revenue were at all risk • YR 20 was identified as the Company that could make this happen. – Design, implementation, FAT, and ongoing support – We had the tools, technique, reputation and ability to get it done! SHARKFEST '09 | Stanford University | June 15– 18, 2009

The Project – MV Well Enhancer SHARKFEST '09 | Stanford University | June 15– 18, 2009

MV Well Enhancer SHARKFEST '09 | Stanford University | June 15– 18, 2009

What does it Compare To? SHARKFEST '09 | Stanford University | June 15– 18, 2009

MV Well Enhancer - Stats • 132 m long - 1 1/2 football pitches • 12, 000 ton displacement - more than a USN Ticonderoga Class Cruiser • Top of Tower is almost 50 m above sea-level (10 storey building). • Accommodation for 120 people. • Diesel electric power for propulsion and equipment with total of 15 MW of generation capacity in x 6 engines in x 3 engine rooms. • Dynamic Positioning Class 3. • 18 saturation divers in x 4 chambers living under pressure. x 2 ROVs. SHARKFEST '09 | Stanford University | June 15– 18, 2009

What Does This Network Compare To? A ship with crew Plus a power station Plus an airport Plus a hotel for 120 people Must cover the needs for work, safety, personal use, and regulatory • All over the equivalent of a poor rural DSL 512 k x 512 k 140, 000 km long!! • You cannot design this without knowing the traffic! • Wireshark is a key and critical item in getting it right! • • • SHARKFEST '09 | Stanford University | June 15– 18, 2009

How Does a Project Like This Start ? (1) A very pensive Mr. Everitt!! SHARKFEST '09 | Stanford University | June 15– 18, 2009

How Does a Project Like This Start ? (2) SHARKFEST '09 | Stanford University | June 15– 18, 2009

Here’s ONE of the Ending Points • 4 servers • Redundant Sat. Com • 2 x Sea. Tel Controller • 2 x Comtech modems • Redundant UPSs • Cisco switches and routers SHARKFEST '09 | Stanford University | June 15– 18, 2009

Ethernet Switch Cementing Controller SHARKFEST '09 | Stanford University | June 15– 18, 2009

Building Network Not Your Office Network! SHARKFEST '09 | Stanford University | June 15– 18, 2009

Cabling – Not Your Office Network! SHARKFEST '09 | Stanford University | June 15– 18, 2009

Cable Transit SHARKFEST '09 | Stanford University | June 15– 18, 2009

Stern of Vessel • Well Intervention Tower • Can handle 22 m tool strings • Kenz Crane • 20 Ethernet devices on Tower • 10 Ethernet devices on crane SHARKFEST '09 | Stanford University | June 15– 18, 2009

CCTV – Roof of Well Intervention Cabin • IP 67 • Industrial Ethernet • Video IP • Pan/Tilt/Zoom - IP SHARKFEST '09 | Stanford University | June 15– 18, 2009

Saturation Dive Control – 20 IP Devices SHARKFEST '09 | Stanford University | June 15– 18, 2009

Network Enclosure • Not your standard office! • Note Industrial Ethernet Switches • Note cable termination technique • ALL work MUST be approved by DNV • Det Norske Veritas SHARKFEST '09 | Stanford University | June 15– 18, 2009

Wireshark to Examine Traffic! SHARKFEST '09 | Stanford University | June 15– 18, 2009

YR 20 PCAP-Probe™ SHARKFEST '09 | Stanford University | June 15– 18, 2009

Wireshark Doesn’t do Analogue Telephony!! SHARKFEST '09 | Stanford University | June 15– 18, 2009

Pressured Accumulator Area – Cisco Kit SHARKFEST '09 | Stanford University | June 15– 18, 2009

KENZ Crane – ‘Drive by Wire’ • Crane by Wire • Cyber Chair • Networked into vessel • Visibility of Crane ops • Safety • Necessity for Ops SHARKFEST '09 | Stanford University | June 15– 18, 2009

Satellite Communications (1) SHARKFEST '09 | Stanford University | June 15– 18, 2009

Satellite Communications (2) SHARKFEST '09 | Stanford University | June 15– 18, 2009

Vessel Networks • Industrial Ethernet round vessel – total of 25 switches – Resilient gigabit core. • Approximately 100 miles of copper installed PLUS fibre! • Total of 25 configured VLANs of which about 8 are in service now. – VLANs for: • CCTV • General desktop PCs, printers, etc. About 40 devices. • Voice; About 30 Vo. IP devices. (there is a full general PBX on the vessel that is not connected). – About 60 CCTV channels incl. inside monitoring of winches, etc. , external monitoring for decks, cranes, etc. diver helmet video and audio feeds, ROV camera feeds, etc. • Control; x 5 separate VLANs for control systems – Likely to be more in the future – Ranges from Modbus/TCP, Profi. Net, etc to HTTP. • Dual VSAT antennae for shoreside link. SHARKFEST '09 | Stanford University | June 15– 18, 2009

Traffic Engineering • All traffic divided into classes at Layer 2 for LAN priority using IEEE 802. 1 P marking and Qo. S/queues in switches. • All traffic divided into classes at Layer 3 for VSAT WAN priority using Diff. Serv marking and Qo. S/queues in routers. – Note: LAN trunk capacity is 1 Gbps - no bottlenecks at this time. – Note: VSAT/WAN traffic capacity is symmetric 512 kbps - significant bottlenecks from start. – Have to deliver all the operational and social requirements for a very large industrial facility and the 120 people who live and work there over the equivalent of a very poor DSL service. This is commonly known in the offshore oil industry as the "elephant and the drinking straw" trick. – Simply would not be possible to do this correctly without tools like Wireshark. SHARKFEST '09 | Stanford University | June 15– 18, 2009

Tools • YR 20 PCAP-Probes™ to collect traffic 7 x 24 • Large amounts of data captured to be analyzed – Up to. 5 T / month • RSD to divide the traffic into Layer 2 or Layer 3 classes of traffic for examination • Wireshark for packet-level analysis • L 1 analysis for automated analysis of large volumes of traffic to spot problems • L 2 being developed and tested SHARKFEST '09 | Stanford University | June 15– 18, 2009

Commissioning Process • Proper Initial Design • FAT – Field Acceptance Testing • Use of all tools to confirm correct configuration and traffic flows at layers 2 and 3 • If operational problems occur traffic can be compared to commissioning traffic to see what's different. • Ability to respond very rapidly to operational issues SHARKFEST '09 | Stanford University | June 15– 18, 2009

Thanks to the Wireshark Community!! Without remarkable tools like Wireshark it simply would not be possible for us to design, build and operate systems like this for serious industrial use. SHARKFEST '09 | Stanford University | June 15– 18, 2009

Questions? Contact Us At The Following In the US 1718 Fry Road Suite 440 Houston, Texas 77084 832 -225 -1293 In the UK Unit 16, James Gregory Centre Aberdeen Science & Technology Park Balgownie Drive Aberdeen AB 22 8 GU UK 44 -1224 -355290 Web www. yr 20. com SHARKFEST '09 | Stanford University | June 15– 18, 2009