Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

OT Device not pingable or reachable via FTP

Hello Guys

i have a OT Device where a FTP Service is running. A Windows Server connects to the server every 30min and downloads some data from the OT Device. The FTP Transfer is not always successful. Sometimes we get an error returned by our monitoring that it is not getting data from the OT Device.

I started a pcap and from the Server side i only saw TCP Syn and Retransmitted TCP Syn Packets. The Server and the OT Device are in a seperate subnet. I then sniffed at the switch with help of a mirror port. During the time i sniffed I tried a ping from the Windows Server to the OT FTP Device. I saw that the icmp ping requests were seen on the mirror port where the ot device was connected but at the same time I saw many "Who has Tell" messages followed by a " is at ......". Only after the ot device was rebooted the communication via ftp or ping was successful again and arp who has stopped showing up so often.

image description