42
Only traffic that belongs to the used IEDs in the system under test is recorded.
Only traffic whose destination MAC address, source IP address, and/or Ethertype
have been entered manually is recorded.
Note: Choosing “All” may produce a high amount of data, especially when recording
Sampled Values. Choosing "All" for generic Ethertypes will overrule all other filter
settings.
Example
You want to record on a PCAP file the traffic containing:
GOOSE mapped to “DANEO 1”
GOOSE captured on port A
Sampled Values from used IEDs
Traffic containing the sender IP address “10.10.5.33”
To meet the above requirements:
1. Enable recording on port A
2. In the GOOSE destination addresses, choose “Mapped”
3. In the Sampled Value destination addresses, choose “Used IEDs”
4. In the IP host addresses, choose “Custom”
5. Enter “10.10.5.33” in the appropriate field, and click and if required delete other existing IP
addresses in the list.
The result is a group of MAC addresses and one IP address that reveal the desired traffic as shown
below.
Figure 21: Traffic recording configuration (Filter details)