Emerson Exchange 365

• Not Answered

Which protocol/application uses UDP port 18507?

Hi,

Just got PCAPs from a customer to do research, found a lot of netflows are using UDP with port 18507 for both IPs.

Seems this is not a common SCADA protocol/application.

Do you guys know which Emerson's application is using UDP port 18507?

Thank you very much.

Logan

• 7 Jun 2016 4:39 PM
• Cancel

3 Replies

• Andre Dicaire

  

  • 7 Jun 2016 5:09 PM

  Logan,
  
  Most of DeltaV communications uses UDP. The network also makes use of Multi Cast packets for globally shared data, such that all nodes are both multi cast senders and receivers. Comparing DeltaV traffic to other systems is not appropriate. As a DCS, communication on the network is managed to be deterministic. This is accomplished by the DeltaV communication application, which uses UDP, since our application layer manages all aspects of communication determinism.
  
  The DeltaV Network is a very private network and part of the control system. I don't know what research you are doing, but I would involve Emerson in evaluating the performance of the DeltaV network. I would not recommend you do this in a vacuum. With the proliferation of malware, discussing any details of the DCS communication layer in an open forum doesn't sit right with me....

  Andre Dicaire

  • Cancel
• Ben Bishop

  

  • 7 Jun 2016 5:11 PM

  What is the goal of the network sniffing exercise?

  • Cancel
• Steve Linehan

  

  • 10 Jun 2016 12:11 PM

  In reply to Ben Bishop:

  Good call guys, In cases like this the answer should be get in touch with GSC.

  • Cancel