HVAC Traces

August 8, 2019 ยท View on GitHub

This repository contains pcap traces of the HVAC system of a university. Its goal is to provide the research community interested in automation system security with real network traffic to evaluate, validate Network Intrustion Detection System. A detailed description of the system is presented here

For privacy sake, the IP addresses have been anonymized with Crypto-PAN and the packet payload have been truncated.

IP Addresses of Interest

IP AddressesComponent Type
252.103.119.187Gateway
252.103.119.36Control Server
252.103.119.173S7 Client
252.103.119.156S7 Server
252.103.120.7HMI
252.103.120.20HMI
252.103.120.30HMI
252.103.119.185HMI
252.103.119.175HMI
252.103.120.18Gateway
252.103.120.15Gateway
252.103.120.8Gateway
252.103.120.13Gateway
252.103.120.169Gateway
252.103.120.48HMI
252.103.120.14Gateway
252.103.120.9Gateway
252.103.117.244Gateway
252.103.119.160Netbios Node
206.120.97.255Broadcast IP
252.103.120.32Netbios Node
136.253.241DNS Server
133.136.250.44Update Server
252.103.120.22HMI
252.103.120.172Netbios Node
252.103.120.10Netbios Node
208.103.225.198SSDP Multicast
133.136.250.40Update Server
114.185.182.52NTP Server
252.103.107.188Netbios Node
252.103.120.34Netbios Node
252.103.120.33Netbios Node
252.102.233.48HTTP Server

Uncommon Ports

Port numberProtocol
50540DCE/RPC
54540DCE/RPC
55844DCE/RPC
49885DCE/RPC
58658DCE/RPC
56427DCE/RPC
62868DCE/RPC
59303DCE/RPC
53566DCE/RPC
50000Proprietary
2499Proprietary
889Update via HTTP

You can find the traces here traces