My IEC61850 IED not responding to ARP request

ARP
IEC61850
retag add tags

Hi, I have SEL451IED (IEC61850 server) which is connected in a network. Network has 2 other devices, one Dell PC (IEC61850 Client) and a Kalkitech SYNC (IEC61850 Client) device. IP address of the devices are SEL451- 10.0.1.214, DELL PC- 10.0.1.216, Kalkitech SYNC-10.0.1.215

Kalkitech SYNC sends an ARP request "215 2019-06-08 02:03:40.791639 KalkiCom_00:cf:4a Broadcast ARP 60 Who has 10.0.1.214? Tell 10.0.1.215", and SEL451 does not respond to the request.

When DELL PC sends an ARP request then SEL451 replies back as "234 2019-06-08 02:03:43.325118 Schweitz_00:38:ba Dell_b4:0d:18 ARP 60 10.0.1.214 is at 00:30:a7:00:38:ba"

Wireshark packet captured during this condition is available in this link : https://www.dropbox.com/s/njx3pb99n58... .

Is there any error in the ARP request send by Kalkitech SYNC ? Can you help?

Aravind

asked 2019-06-10 07:31:30 +0000

edit flag offensive 0 remove flag close merge delete

Comments

I don't know that device, but is it possible that it has a configuration setting that restricts the IP addresses it will respond to? I don't see anything wrong with the failing request.

grahamb (2019-06-10 14:04:47 +0000) edit

SEL doesn't block any IP addresses. However I tried with a different IP address in SYNC, still it didn't communicate with SEL.

Aravind (2019-06-18 12:31:14 +0000) edit

add a comment see more comments

Your problem is the capture setup. What I gauge from the capture is that it was taken on the Dell. So how is it supposed to see the unicast response from the SEL451 to the Kalkitech SYNC? When the network switch has already learned the MAC address of it the Kalkitech SYNC the switch port of the Dell won't get that frame, hence you cannot capture it.

So we're left with circumstantial evidence, the repeated ARP Request broadcast by the Kalkitech SYNC. But we don't know if either the SEL451 is not responding or the Kalkitech SYNC is not receiving it. The solution to that is to setup a capture point on the network switch, so you can actually see the ingress/egress traffic on the ports to and from the Kalkitech SYNC and SEL451.

Comments

I was using port mirroring during the capture.

Later I captured packets from SYNC using tcpdump. In this also SEL is not responding to ARP request. But at the same time I am able to ping other devices (WIndows PCs) in the same network from SYNC.

Aravind (2019-06-18 12:24:46 +0000) edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

My IEC61850 IED not responding to ARP request edit

Comments

1 Answer

Comments