Net.Shark tap

Protocol sniffing is a common practice in IEC 61850 substations with Net.Shark, which filters, captures and forwards Ethernet packets including PTP, NTP, GOOSE, SV or MMS protocols. It is ideal for field use as it is a self-contained device with batteries, screen and keyboard that can be connected to any point on the network, no matter how small, high or hidden.

IEC-61850 Commissioning

IEC 61850 protocols are used to perform mission-critical tasks:

Protection: to detect faults

Control: to adjust settings

Synchronisation: to ensure time alignment

Monitoring: to detect anomalies

Metering: to bill customers

If these tasks are to be commissioned, it is important to use taps to monitor relevant traffic without introducing additional points of failure, traffic degradation or security vulnerabilities into the utility's network.

Tap anywhere

The physical connections between network Clocks, IEDs, Switchgear, Circuit Breakers and Bay Controllers are often located in small, hard-to-reach panels, making it difficult to connect other devices.

This is why we have developed Net.Shark, a lightweight and portable tap that reaches anywhere on the network and captures Ethernet packets by firmware, ensuring that none are lost or cause interference or errors to other traffic.

Taps vs. Laptops

Some laptops claim to be good taps, but don't have a dual port, so can't capture in full duplex, and aren't powerful enough to capture thousands of messages in real time at wire speed without losing packets. The solution is always a tap, because it works through firmware, not software. Net.Shark is ideal for field capture as it does not require a host to configure and run.

Applications

Net.Shark is the right choice for the field, and especially for engineers migrating to the new IEC-61850 substations:

IEC 61850 Commissioning

IEC 61850 Troubleshooting

IEC 61850 Monitoring

IEC 61850 Capture

IED acceptance

Proactive maintenance

Key Features

Net.Shark is powerful, lightweight and can capture in full-duplex mode at wire speed and for more than 12 hours on battery power:

Filters by IEC-61850 protocol, MAC, IP, VLAN, MPLS, TOS, TCP, UDP, arbitrary

Operates at wirespeed with 100% packet inspection

Zero interruption, zero delay, zero packet loss

Compliance traffic stored on SD card or copied to LAN

PCAP format support

Jitter-free time stamps

VNC remote control

Full duplex capture

Optical / electrical ports