Open / standardized
GOOSE
Generic Object Oriented Substation Event messages carry time-critical protection status peer-to-peer on the station/process bus, republished rapidly on state change.
N/A — EtherType 0x88B8Ethernet Layer 2 multicastEncryption: No
How it works
A publisher multicasts a dataset; subscribers act on state changes. Sequence (sqNum) and state (stNum) counters detect loss and change.
Communication patternPublisher IED → multicast group → subscriber IEDs.
Fact sheet
TransportEthernet Layer 2 multicast
PortsN/A — EtherType 0x88B8
AuthenticationOptional (IEC 62351-6)
PurdueLevel 1 – Level 0
EnvironmentsSubstation protection schemes
DevicesProtective relay, Merging unit, Bay controller
IndustriesElectric Power
Why should I care?
Understanding GOOSE is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Trip / block signalling
- Interlocking
- Status distribution
Security concerns
- No routing boundary at Layer 2 — VLAN and port control carry the burden
- Spoofed publishers are a documented research concern
- Very tight timing budgets limit inline security devices
What normal looks like
- Fixed publisher MAC / appID inventory
- Low stNum change rate in steady state
What deserves attention
- New appID or publisher MAC
- stNum incrementing without a corresponding process event
Hunting ideas
- safety-system-anomalies
- new-device-control-zone
Defensive controls
- Strict VLAN and port security
- Publisher inventory baselining
- Physical access control to substation switches
Related ATT&CK for ICS techniques
T0855T0836
Sources & further reading