I am looking for more suggestions on finding the cause of a network storm that is taking down our production network. Removing the Control system from the network does not seem to resolve the issue. Once the storm occurs the only solution is to reboot the core switch.

Thanks

 

What kind of turbines do you have? On GE Mark6/6e control system there was a recent til/psb issued to prevent this. Other than the usual don't modify the factory settings, the gist of it was to reduce the number of cross over trunk lines in the network topology.

 

Problem solved, ran wireshark and found IT NAZ server was broadcasting on the production network.

 

Glad you found the problem. However, why on earth is your DCS directly connected to an external network without any DMZ or firewall? While you have been fairly lucky here, what would the consequences have been if your corporate network was hit by a virus or the deliberate target of a hacking attempt?

It sounds like you really need better separation between your DCS and corporate systems so this kind of thing cannot happen in the first place.

 

> It sounds like you really need better separation between your DCS and
> corporate systems so this kind of thing cannot happen in the first place.

Yes, we are in the process of moving from a default VLAN to a segregated VLAN. This is how the network was setup prior to my position.

Thanks for the feedback.