Usb Control Port; Capturing Network Traffic; Taps And Mirror Ports - Omicron DANEO 400 User Manual

DANEO 400
The process ports A and B are supported by dedicated hardware and have a higher performance than
the control port ETH. When capturing traffic with high bandwidth or high packet rate (for example,
multiple SV streams) it is preferred to use the process ports.
4.2

USB control port

DANEO 400 can also be controlled via the USB port that is also located in the CONTROL group on
the front panel.
The control via the USB port is a convenient option when the controlling PC is located close enough to
DANEO 400. The control connection is immediately established and no setting of an IP address is
required. Additionally, an Ethernet port otherwise required for the control becomes available for
capturing traffic or connecting a PTP clock for time synchronization.
4.3

Capturing network traffic

4.3.1

Taps and mirror ports

In Ethernet networks, there is a significant difference between multicast traffic and unicast traffic.
Multicast is used, for example, for GOOSE and Sampled Values. Unless dedicated filters are set up,
the Ethernet switches will replicate all such received traffic and forward it to all connected links. So any
device can receive GOOSE and Sampled Values without further efforts.
With unicast traffic, the circumstances are different. IP traffic, which is used for example for the
IEC 61850 client/server communication, is of this kind. The communication is performed between
devices explicitly addressing each other. The data packets are forwarded as unicast traffic and that
means that the corresponding Ethernet packets are only forwarded on those links that actually
establish the path between the involved end points (for example, the client and the server). This
exclusive forwarding is the achievement of the Ethernet switch. Without special precautions, a capture
device like DANEO 400, connected to an arbitrary port on an Ethernet switch, will not receive the
packets to be analyzed.
There are two means of accessing unicast traffic: mirror ports and taps.
 A tap is a device that is inserted into a network link and that replicates the traffic going over the
link to additional monitor ports, from where it can be received for further processing.
 A mirror port can be typically found on managed Ethernet switches and such a port can be
configured to replicate the traffic from other specified ports on the switch, similar as if a tap was
used. The configuration of such a port requires access rights to administer the switch and
possibly dedicated software for administering the switch. The setup, the exact behavior, and the
performance of such mirror ports vary between different models of switches.
As mentioned on section 4.1.1, DANEO 400 can operate itself as a tap when the process ports A and
B are configured accordingly.
14