From 4SICS with ICS PCAP Files
I attended to the Swedish industrial cyber security conference 4SICS last month and brought back a bunch of PCAP files. Not just any PCAP files, but captured network traffic from the ICS lab that was set up in the Geek Lounge at 4SICS. These PCAP files are now made publicly available here, because captured network traffic from ICS/SCADA networks is a really scarce resource.
4SICS is the the leading Industrial Control System (ICS) security conference in Europe,
which brings in speakers and attendees from all around the world.
I tought a one-day class on analyzing network traffic
as part of the pre-conference training at 4SICS.
In this class we analyzed PCAP files containing industrial protocols,
such as Modbus/TCP and IEC-104. Unfortunately there aren't many capture files around that carry these protocols,
so the ICS analysis part in my class wasn't as advanced as I wanted it to be.
I have been aware of this limited access to ICS traffic for some time now, which is why I decided to work with the 4SICS crew in order to set up a sniffer in the ICS lab at the 4SICS conference. This lab contained devices such as PLCs, RTUs, servers, industrial network equipment (switches, firewalls, etc), which were available for hands-on "testing" by 4SICS attendees.
4SICS ICS Lab. Image Credit: 4SICS
The network TAP vendor Garland were Technology Partners at 4SICS, so I didn't even have to bring a network TAP to the lab. I just connected my sniffer machine and let it record for three days. Chris Sistrunk also joined the sniffing party later in the conference by connecting his SEL-3355, which runs SecurityOnion, to the network TAP.
Image Credit: Patrick Nixdorf
The 350MB of network traffic that was captured during the 4SICS conference is now publicly available here:
https://www.netresec.com/?page=PCAP4SICS
Enjoy!
Posted by Erik Hjelmvik on Wednesday, 04 November 2015 15:45:00 (UTC/GMT)
Tags: #ICS #SCADA #PCAP #4SICS #IEC-104 #Modbus #sniffer #PLC
