ICSNPP-Synchrophasor

Industrial Control Systems Network Protocol Parsers (ICSNPP) - Synchrophasor Data Transfer for Power Systems (C37.118) over TCP and UDP.

Overview

ICSNPP-Synchrophasor is a Zeek plugin (written in Spicy) for parsing and logging fields used by the Synchrophasor protocol as presented in IEEE standard C37.118, defining a transmission format for reporting synchronized phasor measurements in power systems.

This parser produces the following log files, defined in analyzer/main.zeek:

• synchrophasor.log
• synchrophasor_cmd.log
• synchrophasor_hdr.log
• synchrophasor_cfg.log
• synchrophasor_cfg_detail.log
• synchrophasor_data.log
• synchrophasor_data_detail.log

For additional information on this log file, see the Logging Capabilities section below.

Installation

Package Manager

This script is available as a package for Zeek Package Manager. Zeek includes Spicy support by default as of v6.0.0.

$ zkg refresh
$ zkg install icsnpp-synchrophasor

If this package is installed from ZKG, it will be added to the available plugins. This can be tested by running zeek -NN. If installed correctly, users will see ANALYZER_SPICY_SYNCHROPHASOR_TCP and ANALYZER_SPICY_SYNCHROPHASOR_UDP under the list of Zeek::Spicy analyzers.

If users have ZKG configured to load packages (see @load packages in the ZKG Quickstart Guide), this plugin and these scripts will automatically be loaded and ready to go.

Installation (via git clone)

git clone https://github.com/cisagov/icsnpp-synchrophasor.git
cd icsnpp-synchrophasor
mkdir build && cd build && cmake .. && make && cd ..

From here you can install the locally built files through zkg install ./icsnpp-synchrophasor and run it like you would normally.

Or you can manually run the parser without installing it: zeek ./build/synchrophasor.hlto ./analyzer/__load__.zeek -Cr <pcap>

Logging Capabilities

Synchrophasor Log (synchrophasor.log)

Overview

This log summarizes, by connection, Synchrophasor frames transmitted over 4712/tcp or 4713/udp to synchrophasor.log. The port can be overriden by redefining the synchrophasor_ports_tcp and synchrophasor_ports_udp variables, respectively, e.g.:

$ zeek -C -r synchrophasor_tcp.pcap local "SYNCHROPHASOR::synchrophasor_ports_tcp={ 40712/tcp }"

Fields Captured

• The history field is comprised of letters representing commands specified in observed command frames in the order they were transmitted (e.g., 2Dd):
  • d - turn off transmission of data frames
  • D - turn on transmission of data frames
  • h - send HDR frame
  • 1 - send CFG-1 frame
  • 2 - send CFG-2 frame
  • 3 - send CFG-3 frame
  • e - extended frame

Synchrophasor Command Frame Log (synchrophasor_cmd.log)

Overview

This log summarizes synchrophasor Command frames.

Fields Captured

Synchrophasor Header Frame Log (synchrophasor_hdr.log)

Overview

This log summarizes synchrophasor Header frames.

Fields Captured

Synchrophasor Configuration Frame Log (synchrophasor_cfg.log)

Overview

This log summarizes synchrophasor Configuration (CFG-1, CFG-2, and CFG-3) frames.

Fields Captured

Synchrophasor Configuration PMU Details (synchrophasor_cfg_detail.log)

Overview

This log lists the per-PMU details from synchrophasor Configuration (CFG-1, CFG-2, and CFG-3) frames. As this can be very verbose, this log file is disabled by default. Users can enable it by appending SYNCHROPHASOR::log_cfg_detail=T to the zeek command on the command line or by adding redef SYNCHROPHASOR::log_cfg_detail = T; to the local.zeek file.

Fields Captured

Most of the fields listed here are optional. Many may be unused during communication depending on device configuration. See IEEE Std C37.118.2-2011 for more details.

Synchrophasor Data Frame Log (synchrophasor_data.log)

Overview

This log summarizes synchrophasor Data frames. As this can be very verbose, this log file is disabled by default. You can enable it by appending SYNCHROPHASOR::log_data_frame=T to your zeek command on the command line or by adding redef SYNCHROPHASOR::log_data_frame = T; to your local.zeek file.

Fields Captured

Synchrophasor Data PMU Details Log (synchrophasor_data_detail.log)

Overview

This log lists the per-PMU details from synchrophasor Data frames. As this can be very verbose, this log file is disabled by default. You can enable it by appending SYNCHROPHASOR::log_data_detail=T to your zeek command on the command line or by adding redef SYNCHROPHASOR::log_data_detail = T; to your local.zeek file. Note that log_data_frame described above must also be set to T for log_data_detail to take effect.

Most of the fields listed here are optional. Many may be unused during communication depending on device configuration. See IEEE Std C37.118.2-2011 for more details.

Fields Captured

ICSNPP Packages

All ICSNPP Packages:

• ICSNPP

Other Software

Idaho National Laboratory is a national research facility with a focus on development of software and toolchains to improve the security of criticial infrastructure environments around the world. Please review our other software and scientific offerings at:

Primary Technology Overview Page

Supported Open Source Software

Raw Experiment Open Source Software

License

Copyright 2023 Battelle Energy Alliance, LLC. Released under the terms of the 3-Clause BSD License (see LICENSE).