The Role of Wireshark in Industrial Ethernet
or “Why things just have to work!”
17 June 2009
Mike Hinz
President | YR20
SHARKFEST '09
Stanford University
June 15-18, 2009
SHARKFEST '09 | Stanford University | June 15 –18, 2009
YR20 – Who We Are and What We Do
•
•
•
•
•
•
YR20 Group – a Texas Corp. – Operating Cos in Houston, Texas and Aberdeen, Scotland
Over 100 years of experience in mission critical networking and telecommunications
Totally independent - objective, fact-based services completely aligned with our
customers
We operate utilizing our in-house tool-set backed up with years of hard experience to
offer our customers optimal solutions to their networking and telecom needs
Network Engineering and Analysis as a Service
• No capital investment in equipment
• We supply the expertise and equipment on a simple contractual basis
• Full range of services – lab simulating and testing, incident and problem
management, traffic engineering and capacity planning, equipment evaluation,
application evaluation and optimization
Sales or Leasing of Standards Based Network Data Capture Appliances
• PCAP-Probe™ family
• Standards based – Training and Support Available, Extremely Rugged with Remote
Management – High Performance
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Industrial Ethernet and This Project
•
•
•
•
Simply Stated – Industrial Ethernet must work
Lives and huge economic values are at stake
Focused on plant, process, and control
Directly contributes to the revenue stream of an
organization
• Installation requires detailed approval by a
classification society such as DNV, LR, ABS, etc. to get
insurance
– “There must be a tie-wrap on the cable every metre”
• Likely to be in hazardous environments
SHARKFEST '09 | Stanford University | June 15 –18, 2009
The Project – Why YR20?
• The MV Well Enhancer was conceived by Helix ESG to
be the largest, most high tech offshore service vessel
available
• Very high market visibility
• Helix ESG demanded that this vessel ‘simply must
work!’
– Lives, Safety and Revenue were at all risk
• YR20 was identified as the Company that could make
this happen.
– Design, implementation, FAT, and ongoing support
– We had the tools, technique, reputation and ability to get
it done!
SHARKFEST '09 | Stanford University | June 15 –18, 2009
The Project – MV Well Enhancer
SHARKFEST '09 | Stanford University | June 15 –18, 2009
MV Well Enhancer
SHARKFEST '09 | Stanford University | June 15 –18, 2009
What does it Compare To?
SHARKFEST '09 | Stanford University | June 15 –18, 2009
MV Well Enhancer - Stats
• 132m long - 1 1/2 football pitches
• 12,000 ton displacement - more than a USN Ticonderoga Class
Cruiser
• Top of Tower is almost 50m above sea-level (10 storey
building).
• Accommodation for 120 people.
• Diesel electric power for propulsion and equipment with total
of 15MW of generation capacity in x6 engines in x3 engine
rooms.
• Dynamic Positioning Class 3.
• 18 saturation divers in x4 chambers living under pressure.
x2 ROVs.
SHARKFEST '09 | Stanford University | June 15 –18, 2009
What Does This Network Compare To?
•
•
•
•
•
A ship with crew
Plus a power station
Plus an airport
Plus a hotel for 120 people
Must cover the needs for work, safety, personal use,
and regulatory
• All over the equivalent of a poor rural DSL 512k x
512k 140,000 km long!!
• You cannot design this without knowing the traffic!
• Wireshark is a key and critical item in getting it right!
SHARKFEST '09 | Stanford University | June 15 –18, 2009
How Does a Project Like This Start ? (1)
A very pensive Mr. Everitt!!
SHARKFEST '09 | Stanford University | June 15 –18, 2009
How Does a Project Like This Start ? (2)
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Here’s ONE of the Ending Points
•4 servers
•Redundant SatCom
•2x SeaTel Controller
•2x Comtech modems
•Redundant UPSs
•Cisco switches and routers
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Ethernet Switch Cementing Controller
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Building Network
Not Your Office Network!
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Cabling – Not Your Office Network!
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Cable Transit
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Stern of Vessel
•Well Intervention Tower
•Can handle 22m tool strings
•Kenz Crane
•20 Ethernet devices on Tower
•10 Ethernet devices on crane
SHARKFEST '09 | Stanford University | June 15 –18, 2009
CCTV – Roof of Well Intervention Cabin
•IP67
•Industrial Ethernet
•Video IP
•Pan/Tilt/Zoom - IP
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Saturation Dive Control – 20 IP Devices
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Network Enclosure
•Not your standard office!
•Note Industrial Ethernet Switches
•Note cable termination technique
•ALL work MUST be approved by DNV
•Det Norske Veritas
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Wireshark to Examine Traffic!
SHARKFEST '09 | Stanford University | June 15 –18, 2009
YR20 PCAP-Probe™
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Wireshark
Doesn’t do Analogue Telephony!!
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Pressured Accumulator Area – Cisco Kit
SHARKFEST '09 | Stanford University | June 15 –18, 2009
KENZ Crane – ‘Drive by Wire’
•Crane by Wire
•Cyber Chair
•Networked into vessel
•Visibility of Crane ops
•Safety
•Necessity for Ops
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Satellite Communications (1)
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Satellite Communications (2)
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Vessel Networks
• Industrial Ethernet round vessel
– total of 25 switches
– Resilient gigabit core.
• Approximately 100 miles of copper installed PLUS fibre!
• Total of 25 configured VLANs of which about 8 are in service now.
– VLANs for:
• General desktop PCs, printers, etc. About 40 devices.
• Voice; About 30 VoIP devices. (there is a full general PBX on the vessel that is not
connected).
• CCTV
– About 60 CCTV channels incl. inside monitoring of winches, etc., external
monitoring for decks, cranes, etc. diver helmet video and audio feeds, ROV
camera feeds, etc.
• Control; x5 separate VLANs for control systems
– Likely to be more in the future
– Ranges from Modbus/TCP, ProfiNet, etc to HTTP.
• Dual VSAT antennae for shoreside link.
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Traffic Engineering
• All traffic divided into classes at Layer 2 for LAN priority using
IEEE 802.1P marking and QoS/queues in switches.
• All traffic divided into classes at Layer 3 for VSAT WAN priority
using DiffServ marking and QoS/queues in routers.
– Note: LAN trunk capacity is 1Gbps - no bottlenecks at this time.
– Note: VSAT/WAN traffic capacity is symmetric 512kbps - significant
bottlenecks from start.
– Have to deliver all the operational and social requirements for a very
large industrial facility and the 120 people who live and work there
over the equivalent of a very poor DSL service. This is commonly
known in the offshore oil industry as the "elephant and the drinking
straw" trick.
– Simply would not be possible to do this correctly without tools like
Wireshark.
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Tools
• YR20 PCAP-Probes™ to collect traffic 7x24
• Large amounts of data captured to be analyzed
– Up to .5 T / month
• RSD to divide the traffic into Layer 2 or Layer 3
classes of traffic for examination
• Wireshark for packet-level analysis
• L1 analysis for automated analysis of large volumes
of traffic to spot problems
• L2 being developed and tested
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Commissioning Process
• Proper Initial Design
• FAT – Field Acceptance Testing
• Use of all tools to confirm correct configuration and
traffic flows at layers 2 and 3
• If operational problems occur traffic can be
compared to commissioning traffic to see what's
different.
• Ability to respond very rapidly to operational issues
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Thanks to the Wireshark Community!!
Without remarkable tools like Wireshark it
simply would not be possible for us to
design, build and operate systems like this
for serious industrial use.
SHARKFEST '09 | Stanford University | June 15 –18, 2009
Questions?
Contact Us At The Following
In the US
1718 Fry Road
Suite 440
Houston, Texas 77084
832-225-1293
In the UK
Unit 16, James Gregory Centre
Aberdeen Science & Technology Park
Balgownie Drive
Aberdeen AB22 8GU UK
44-1224-355290
Web
www.yr20.com
SHARKFEST '09 | Stanford University | June 15 –18, 2009