TCP/IP - Science topic

Can we model cyber attacks in such simulated power grid communication networks?

Are you trying to classify all the possible ways people might make mistakes in writing computer programs?

dear Abolfazl Najafi thanks a lot for this suggestion

i think there is a lack time between opensees anb matlab run time it means when tcl try to write text file, matlab needs to read more data in text file and give error

after all i think working with python and openseespy library is the best choice for this goal.

wish you best

https://www.hindawi.com/journals/scn/2021/7142048/

you can use other artificial methods based on scripts that attempt to extract content from web pages HTML parsing

The use of web APIs causes complications due to robotic controls and access restrictions.

Good luck

cmcmd ('setprojectdir', PathToData);

Hi.,

There are a number of methods to avoid detection, one being configuring the ... Keywords: receive-only, cables, sniffing, network taps, uni-directional cables..

Refer this link:

I didn't check in detail, but the limitation might stem from limitations in memory (RAM): the "mature" network stacks/protocols haven't exactly been designed with low resource consumption in mind.

Thus you may consider to use an ESP32: basically an ESP8266 "on steroids", it sports a dual-core microcontroller and significantly more memory at about the sme price.

Hi,

MQTT over TCP. The Message Management Service (MMS) supports native MQTT over TCP as a network transport method. For more information, please refer to theMQTT specification . To send data to the MMS through MQTT, a device needs toconnect to an MQTT broker and then send MQTT-compliant messages over this connection.

MQTT. MQTT (Message Queuing Telemetry Transport) is an ISO standard (ISO/IEC PRF 20922) publish-subscribe-based messaging protocol. It works on top of theTCP/IP protocol. ... MQTT-SN is a variation of the main protocol aimed at embedded devices on non-TCP/IP networks, such as Zigbee.

In a non-local network context, each FIB entry contains a name prefix and a network interface (which represents a next hop). When running over IP, the network interface could be represented as an IP tunnel to the next hop.

In a local network, if NDN is running directly over link protocol (like Ethernet), then yes, the local FIB entry may contain a link protocol MAC addr.

Specifically, for wireless local network, researchers from Stony Brook University found there is no need for a per-host addr, so they are developing a name-based link layer protocol which focus on the data name instead of a per-host MAC addr.

I highly recommend you to switch to OMNeT++ if you can. I was struggling to model some network with NS-3 for two weeks while I did it in OMNeT++ in two days.

Hi Acram,

My knowledge about GPS satellite tracking is based only on my personal experience. About 7 years ago (in the summer of 2012) me and around 10 my friends (scientists, journalists and crew members) were lost in the Chukchi Sea during an Arctic expedition. We were on the high-speed inflatable boat far away from the mother vessel (ESPY, GP). The main way of communication between the boat and the vessel was VHF marine radio. But it was completely useless, because we were around 30-40 miles away and the communication could not be established (the VHF capabilities is good for up to 10-15-20 miles depending on both antennas altitude). So the big problem was that we knew our GPS coordinates, but we didn't know the actual vessel coordinates to calculate our course and distance to salvation. We didn't even know the general direction where the vessel could be - is it North, South, East or West. We were completely lost...

And then a small device called "Yellow Brick" saves us (I believe it was some pre-version of this one: https://www.ybtracking.com/products-yb3). This small device has GPS receiver but also was capable to send and receive short emails (like SMS) to/from Inmarsat or Iridium satellites. So we on the lost boat could send email to the radio officer on the vessel and he could respond to us. This device also periodically sent the GPS coordinates by email to someone so he could constantly track your location.

In conclusion - depending on the desired geographic coverage and the application needs you should subscribe to a Satellite Communication Service. The major global providers are Inmarsat, Iridium and VSAT. If you don't need a global coverage then satellites on geostationary orbit could be used and may be the expenditure will be lower.

IPS = Intrusion Prevention System, stop any sort of intrusion before it happens

IDS = Intrusion Detection System, detect intrusions after they happen

The blacklist rules you are talking about would most often be implemented in a firewall (as it is usually the first appliance to see a request from the outside). Firewalls could technically be considered an Intrusion Prevention Device since it is preventing the outside requests from entering the network.

Common Intrusion Detection Services include honey-pots or internal network analysis tools. These tools are employed within a network to try to detect any bad behavior that has made its way past the firewall and other IPSs. Honey-pots are systems made to look like regular computers and offer up 'vulnerable' services that seem very enticing for hackers but everyday operations within the network will not interact with the honeypot. Once a hacker begins attacking the honey-pot the alarms will go off and the administrators will know that an intruder is in the network.

To answer your followup question: that specific botnet may have only used those 80 common queries but other botnets can(and probably will) use many other different queries. Telling your IPS system(firewall) to block those specific queries is a good start, but in order to battle more and more botnets you need to start thinking about the behavior and timing of the attacks as well as the source location of the attacks.

I would recommend looking up Bro and Snort for Intrusion Detection Systems, they are very powerful and opensource products that can be deployed on a raspberry pi or other compute device.

updated bi-monthly

OSI was too generic and never really practical for networking equipment vendors, i believe. To understand this just take a modern application that runs over a network and try to identify which part of this application runs in each of the three top layers of the OSI model (session, presentation, application). It will be confusing. Instead the TCP/IP protocol suite combines these three layers into a single application layer. The bottom OSI layers (PHY, data-link, network, transport) are more easily comparable with the ones in TCP/IP suite (link (OSI PHY+data link), internet/IP (OSI network), transport/TCP/UDP but there are still some differences. TCP/IP is the protocol suite that the Internet and modern networks/inter-nets are using. Note also that TCP/IP predates OSI.

Hi Ihab,

What kind of problems did you encountered ? Which sources did you try ?

Is there a reason not to use C ? I think the most complete lib is libmodbus on Github : https://github.com/stephane/libmodbus

Have you tried this:

?

Dear Mohammad Noormohammadpour,

this problem can be solved by the Congestion Control (CC) according to the concept ECN (Explicit Congestion Notification). The general concept of ECN was specified by the IETF in document RFC 3168.

The principle of ECN describes my article "ECN - Explicit Congestion Notification" (in German).

The section "Grundlegende Idee der Überlastvermeidung mit ECN --- Basic idea of overload avoidance with ECN, Pages 6 and 7" and Fig. 006175 are very important. Further figures 006176, ..., 006179 explain the concept ECN exactly.

CC according to ECN can be briefly summarized as follows (Fig., Pages 6 and 7):

Good luck and best regards

Anatol Badach

The Best networking protocol for vehicles are stationary is:

In standards for VANET (Safety applications) WSMP(Wave Short Message Protocol) is defined.

For Non safety application generally prefer IPv6

Solution to my own problem:

I got the solution of my question.

I used Python code to insert queries into remote PostgreSQL database. I used following line in PostgreSQL to connect with database.

If you use above approach then all the data will be sent in encrypted form. If you use the approach given below in python code then all the data will be sent in decrypted form. You can easily read all queries in Wireshark.

Same is the case in C-Code as well.

Decrypted data

Encrypted Data

ESP 8266 wifi.

Yes of course. On a Linux based Access Point you can use tools like IW to get information about connected devices like number of transmitted/received bytes, signal strength, etc. See below an example output of my AP (wlan0 interface). Here you see the statistics for each associated client station (identified by their MAC address).

1/ Call: iw dev wlan0 station dump

Station 70:d4:f2:90:40:6e (on wlan0)

inactive time: 1530 ms

rx bytes: 2272

rx packets: 27

tx bytes: 2280

tx packets: 17

tx retries: 0

tx failed: 0

signal: -47 [-75, -47] dBm

signal avg: -48 [-77, -48] dBm

tx bitrate: 21.7 MBit/s MCS 2 short GI

rx bitrate: 2.0 MBit/s

authorized: yes

authenticated: yes

preamble: short

WMM/WME: yes

MFP: no

TDLS peer: no

Station 90:18:7c:dd:68:bf (on wlan0)

inactive time: 120 ms

rx bytes: 12583

rx packets: 239

tx bytes: 8702

tx packets: 64

tx retries: 0

tx failed: 0

signal: -46 [-65, -46] dBm

signal avg: -44 [-62, -44] dBm

tx bitrate: 57.8 MBit/s MCS 5 short GI

rx bitrate: 72.2 MBit/s MCS 7 short GI

authorized: yes

authenticated: yes

preamble: short

WMM/WME: yes

MFP: no

TDLS peer: no

On client side you can also get important information like the quality of the WiFi link, AP ESSID/BSSID, ...

2/ Call: iwinfo wlan0 info

wlan0 ESSID: "tplink18"

Access Point: 64:66:B3:CE:21:DB

Mode: Master Channel: 6 (2.437 GHz)

Tx-Power: 20 dBm Link Quality: 64/70

Signal: -46 dBm Noise: -95 dBm

Bit Rate: 39.7 MBit/s

Encryption: none

Type: nl80211 HW Mode(s): 802.11bgn

Hardware: unknown [Generic MAC80211]

TX power offset: unknown

Frequency offset: unknown

Supports VAPs: yes

Best,

Tolja

So I will answer this question now that I have solved the issue for anyone else requiring it. 

The DISP subroutine allows the user to modify the boundary conditions at the given nodes. The nodes have to be set to be user-defined in the model or if working with the input file (which I hate) then the boundary is specified as: 

*Boundary, user

This has to be done to use the DISP. It's a shame there is very poor documentation on ABAQUS subroutines and turorials for using them.

Next the UEXTERNALDB allows you access to the LOP variable which informs on when the subroutines are called. It should be used to know when to open references, files, connections. Typically LOP=0 is the start of an analysis or LOP=5 is the start of a restart analysis and these should be used to open the references/files/connections. LOP=6 should be used to close these references.

Next the external communication -  UEXTERNALDB gives the ability to write to file and read from the file by default but that functionality can be extended using an external winsock library which I found very useful (this library is ws2_32 which is part of the Visual Studio package so no need to add new modules. The initialisation, send, receive, closeconnection functions can be written in the same subroutine file as the DISP and UEXTERNALDB).

The winsock library allows me to open a connection to a server (at LOP=0) then feed current state of the system in real time at increment start to the server that replies with target boundary conditions that then feed to the DISP subroutine using common global variables.

This has been tested so far and it is fully functional and working. Have not got around to extracting current reaction forces yet with GETVRM or something similar but it should be easier to accomplish now. Hopefully, this gets someone through difficulties experienced.

i thinks timing delay in SCADA networks has to do with the complex digital to analog signal conversation. i.e from the digital circuitry to the  mechatronic automation system

Hi Amin,

If you're running your simulation on a desktop you can make use of MATLABs string processing tools (like you would use in your script) by using the coder.extrinsic functionality, see link below.

Alternatively, if your model is compiled and coder.extrinsic won't work then you can user cover.ceval to call the standard C string processing tools such as sscanf. See second link below.

Finally, if neither of these work for you, you could write your own string to number parser, by using the fact that Simulink treats strings like an array of bytes with ASCII encoding (i.e. 49 = 1, 50 = 2, etc...). But this should only be a last resort!

I hope this helps,

Owen

You can perform remote debugging of your system with System Console. Debug equipment deployed in

the field through an existing TCP/IP connection. Run a network stack on either a Nios II processor or a

hard processor system (HPS) and piggyback on an existing remote administration setup. This application

note focuses on the case of using an Altera SoC.

You might want to take a look at these:

I don't know that jitter itself would be a big factor, but for sure latency is, at least for efficient use of TCP/IP. UDP, depending exactly how it is used, might not be impacted negatively. When using geosynchronous satellites, anyway, certain accommodations need to be made for the much longer RTT experienced, compared with terrestrial systems.

Another possible problem is your uplink speed. It might be very different from the downlink speed, which also impacts on TCP efficiency.

But I don't think jitter would necessarily be a problem particular to satellite.

there are simple books from cisco, such as, DSL and Fiber-Optic Technologies. in the first chpters they talk about what you are asking for

I am not very proficient on GNU / LINUX C or C++ compilers, but for example, in old WIndows MS C/C++ compiler there was TWO libraries for TCP/IP (winsocks.h and wsock32.h) corresponding to GNU's sockets.h . Winsocks.h was an OLD version, and less effcient implementation of TCP/IP stack. May be your trouble has some relation with different "versions" of sockets.h 

beacon message used wireless short message (WSM) , it not used ip packet. MAC layer is responsible for broadcast. and the reason for using broadcasting mechanism because it don not require managing  routing and maintaing topology and address resolution. where these are challenging in VANET because of its high dynamic toplolgy

I've developed network drivers for some of our SpaceWire products in the past.  The STAR-Dundee Brick and Router/Router Mk2 can be used on TCP/IP networks under Linux.  Very good for multiplayer gaming over SpaceWire :-)  There's no standard for transporting TCP/IP over SpaceWire, though, or for address resolution (SpaceWire to/from IP address), so our implementation probably won't work with other implementations.

Note that in the above case SpaceWire and Ethernet are being used in the same way.  The TCP/IP protocols are network and transport protocols running over these two physical layers.  SpaceWire provides a number of features which means it's not necessary to use additional protocols on top of SpaceWire, but that doesn't mean they can't still be used.

TCP/IP is very heavyweight for use onboard a spacecraft.  Networks on spacecraft tend to be reasonably small, using only one or two bus types, and encounter very few errors.  TCP/IP is designed to transport data between multiple networks, of different types, and with the possibility for packets to be lost, delivered out of sequence, or delivered with errors.  The minimum header size of a TCP/IP packet is 40 bytes, which is quite an overhead if you're sending small amounts of data, for example.

UDP and TCP are used in different situations for different applications. Applications requiring high reliability such as a 1GB file transfer are done by ftp using TCP. As now if  some packets are lost the whole 1GB transfer will be useless as it will end up in a corrupt file. UDP is unreliable and connection less which suits real time applications such as VOIP and streaming. Packet loss upto certain limit in these applications are not as critical as in a file transfer. Because even if a few packets are lost  you will fee glitches in your streaming or VOIP but still you will be able to run your video or voice.  Secondly TCP has many variants depending upon how they react to packet loss by controling its window size. You also need to consider that behavior when evaluating it. 

There are 2 commands that could help you. These are netstat and tcpdump. Check out the links in order to see how they are used.

Regards,

Andrés Miguel 

Depending on what you want to modify exactly, it could also be implemented in the device driver. I guess the unifying module for the WLAN MAC is mac80211 in Linux:

If it is not implemented there, I can definitely support the recommendation of Luis on OpenFWWF.

thanks alan it was a nice application......

i had build the mechanism in java but it is not real time...

so for my second task i will look forward with your sugestion

Well I never used Omnet++( as indicated in the topics), so I don't know specifically for Omnet. However, you could use ns-3 and increase the size of the parameters. The advantage is that you can inject real world traffic (i.e. traffic gennerators and traces), because ns-3 has mechanisms to handle real packets. Even more, if you use ns-3 + DCE, you can use real protocol implementations (linux + quagaa) and then change the parameters of those applications, what would be more realist than simple simulations.

Hi,

This is usually the error that you get when there is either:

1)Another process/service listening on that port

2)You have a heavily utilized server

More info from Microsoft here:

Easy enough: StrongSwan