Hello Guys
i have a OT Device where a FTP Service is running. A Windows Server connects to the server every 30min and downloads some data from the OT Device. The FTP Transfer is not always successful. Sometimes we get an error returned by our monitoring that it is not getting data from the OT Device.
I started a pcap and from the Server side i only saw TCP Syn and Retransmitted TCP Syn Packets. The Server and the OT Device are in a seperate subnet. I then sniffed at the switch with help of a mirror port. During the time i sniffed I tried a ping from the Windows Server to the OT FTP Device. I saw that the icmp ping requests were seen on the mirror port where the ot device was connected but at the same time I saw many "Who has 172.16.1.254? Tell 172.16.1.250" messages followed by a "172.16.1.254 is at ......". Only after the ot device was rebooted the communication via ftp or ping was successful again and arp who has stopped showing up so often.
