NetSim Cyber Q&A

Q1. What is NetSim Cyber?

NetSim Cyber is a platform to model, simulate and analyse cyber attacks on power-system communication networks. It sits between a source device and a destination device, and intercepts the protocol traffic between them. It applies the configured attack logic to specific protocol fields, then forwards the result.

The supported traffic is IEEE C37.118 synchrophasor, IEC 61850 GOOSE, R-GOOSE, MMS and Sampled Values, and Modbus TCP. It also includes DNP3, IEC 60870-5-104 and custom TCP/IP protocols. The source can be a PMU, IED, RTU, PLC, relay or simulator. The destination can be a PDC, SCADA master, HMI, subscriber or control application.

Q2. What is a protocol-aware cyber attack simulator, and why does it matter for OT?

A protocol-aware simulator parses the structure of the industrial protocol. It does not treat packets as opaque byte streams. An attack can therefore target a field that carries physical meaning: a phasor magnitude, a ROCOF value, a Modbus holding register, a GOOSE stNum.

This matters because the most damaging grid attacks do not break communication. They keep the session alive and change the values inside valid frames. For the receiver, the link is healthy but the data is wrong. Monitoring finds this case much less easily than a dropped session.

Q3. Does NetSim Cyber perform penetration testing, exploit devices, or deploy malware?

No. NetSim Cyber works on an assume-breach premise: it starts once the adversary already has a position on the OT network. Initial access, through phishing, IT compromise or an insider, is out of scope. It stays with your IT security and red teams.

NetSim Cyber models what an adversary does after that point, and the effect on the power system. All of it runs in a controlled laboratory environment.

Q4. Does NetSim Cyber simulate the power system itself?

NetSim Cyber ships with built-in protocol simulators that generate and receive standards-conformant traffic for each supported protocol. You can therefore build a complete attack testbed in software. These simulators are measurement generators. Their values come from configurable value and waveform models, such as:

• constant and sine profiles
• physics-informed frequency, voltage and load-flow angle behaviour

The values do not come from a load-flow or electromagnetic-transient solution of an electrical network model.

That is enough to develop an attack, validate protocol parsing, generate datasets and test whether a receiving application reacts. If the study needs full grid dynamics, pair NetSim Cyber with a real-time simulator such as RTDS, OPAL-RT or Typhoon HIL. The real-time simulator is the digital twin of the power system. NetSim Cyber is the digital twin of the communication and cyber layer. Together they form the complete cyber-physical testbed.

Q5. Who uses NetSim Cyber?

• Utilities and national grid operators that assess the attack impact on production infrastructure.
• Protection, SCADA and substation automation engineers who validate relay logic and process-bus integrity.
• OT and ICS cybersecurity teams that validate protocol-aware detection and countermeasures.
• Cyber-physical power system researchers and laboratory integrators.
• Defence and critical-infrastructure agencies that prepare for cyber-kinetic scenarios.
• Product validation teams that test devices, simulators and protocol implementations.
• Universities and training organisations that teach CPPS security with reproducible experiments.

Q13. Which protocols and standards are supported?

• IEEE C37.118 synchrophasor, 2005 and 2011 profiles. The 2024 model is supported as a variant.
• IEC 61850 GOOSE, Routed GOOSE, MMS and Sampled Values.
• Modbus TCP.
• DNP3, IEEE 1815.
• IEC 60870-5-104.
• User-defined TCP/IP protocols, through the custom attacker API.

Q14. What is in the attack library?

The library has signal-level attacks and network or protocol-level attacks, in five categories: data integrity, timing, availability, replay and protocol-field manipulation.

The documented attack types are:

• Signal changes: noise injection, ramp, increment and decrement, pulse or surge.
• Frequency and ROCOF manipulation.
• Time-synchronisation and timestamp attacks.
• Replay, fixed delay and PER-based packet drop.
• Speed and bandwidth suppression, and packet manipulation.
• DoS, virtual SYN flood, real SYN flood and RST flood.

With the per-protocol variants in the attacker interfaces, the library has more than forty attacks.

The availability attacks use parameters, not brute force:

• Speed, in Mbps, sets an effective bandwidth ceiling.
• Fixed delay, in milliseconds, shifts the forwarding time.
• Packet error rate sets the drop probability for each packet.

Q15. How do I test a false data injection attack on a PMU to PDC synchrophasor stream?

Put the Threat Agent between the PMU (or PMU simulator) and the PDC. Filter on the synchrophasor port. Select the IEEE C37.118 attacker with the matching profile. The attacker has three tabs:

• Automatic: increment bias, decrement bias, pulse or surge, ramp or drift, and noise or jitter (proportional-range, Gaussian, uniform or spike). It also has angle bias, frequency override, whole-second SOC shift and sub-second fine time shift. It can change the STAT sync-error, data-modified and config-changed status bits. The 2011 profile adds FRACSEC time-quality corruption. A packet attack probability applies to eligible attacks.
• Manual: enable individual phasor rows and enter replacement magnitude and angle values, with optional frequency and ROCOF overrides.
• Replay: record live phasor values or replay them from a CSV containing magnitude, angle in degrees, frequency and ROCOF.

Sequencing note: start NetSim Cyber and get the attacker ready before PMU traffic starts. The first configuration frame loads the stream layout and the phasor list into the attacker. Until the attacker receives this frame, you cannot target stations and phasors.

Q16. What can be attacked in IEC 61850 GOOSE and Sampled Values traffic?

GOOSE: stNum, sqNum and timeAllowedToLive overrides, the simulation flag, and dataset values of boolean, float and unsigned type. The attacker reaches them through BER tag parsing and allData field discovery.

Sampled Values: smpCnt and smpSynch overrides and the seqData payload, including Va, Vb, Vc, Vn and Ia through In, at 80 or 256 samples per period.

These attacks support false breaker trip indication, corrupted protection relay logic and process-bus integrity testing. The simulation flag is important by itself, because it tells test traffic from live traffic on a substation bus.

Q17. What can be attacked in Modbus TCP and DNP3?

Modbus TCP: register increment and decrement, ramp drift, jitter, fixed-value injection, manual override by register address, and coil or discrete bit set, clear and flip. The attacker parses the MBAP header and rebuilds the response. It targets function codes FC01 to FC04. The built-in simulator covers FC01 to FC06, FC15 and FC16.

DNP3. The attacks are:

• False data injection into analog inputs, binary inputs and counters.
• Replay through the interceptor path.
• Unauthorised direct-operate and select-operate control with CROB objects.
• Link-status reconnaissance and integrity polling.
• Time-skew writes, and unsolicited responses set to on or off.
• Cold and warm restart, and DoS flooding.

The frame starts at 0x05 0x64, with header and block CRCs. The attacker parses transport segmentation and object groups, and supports both solicited and unsolicited modes.

Q18. What can be attacked in IEC 60870-5-104 telecontrol traffic?

These attacks apply to the master to controlled-station link over TCP 2404:

• telemetry value modification
• status indication manipulation
• replay of valid messages
• delay of telecontrol messages
• packet drop
• time-tag manipulation

The information objects involved are single-point and double-point indications, measured values, commands, integrated totals and time-tagged events. Study the effect on control-centre visibility and on how the station interprets commands. Industroyer2 operated in the same area.

Q19. Can I write my own attack for a proprietary or novel protocol?

Yes, through the custom payload modifier API. You implement a single Python callback:

def modify_payload(ipv4, ipv6, tcp, udp, payload, iopath):

The callback runs on each packet that matches the Application Traffic Filter. Inspect and rewrite the writable payload buffer in place. Return True if you modified it, and False if you did not. Import the file through Import Custom Attacker in the Select Attack Protocol window. The iopath argument gives access to the simulation I/O path for logs, configuration files or external attack parameters.

You can therefore model novel and proprietary attack logic without changes to the core engine.

Q24. Can I reproduce documented real-world grid attack campaigns?

Yes, you can reproduce their protocol behaviour in a lab. The 2015 Ukraine attack and Industroyer, also known as CrashOverride, operated on IEC-101, IEC-104 and IEC 61850. In 2022, attackers reworked Industroyer2 against IEC-104 substation control traffic in Ukraine. FrostyGoop abused Modbus TCP against OT controllers in 2024 to cut heating to civilians in winter.

The NetSim Cyber attack library contains each of these protocol interactions. You can recreate the same manipulations safely and repeatedly against your own monitoring stack. NetSim Cyber reproduces the protocol-level effect, not the malware or the intrusion route that delivered it.

Q25. How do I use NetSim Cyber to validate an IDS or train a detection model?

Run the same scenario with the attack off and then on, and capture both. You control the attack start, stop, type and parameters, and each has a timestamp. The traffic is therefore labelled from the start. Supervised anomaly and intrusion detection models need this labelled traffic.

The same runs answer the operational question directly: did your IDS, your SOC playbook and your analysts flag a stream that stayed valid on the wire? The scenarios are reproducible. You can therefore measure a detection improvement against the identical attack, not against a new one.

Q26. What does a result actually look like?

Take a ramp attack on a Modbus TCP holding register that carries Voltage Phase A. Before the attack, the master reads a stable 109.97 to 110.04 V, a spread of 0.07 V. During the ramp injection, the same register climbs from 109.97 to 110.39 V, a continuous linear drift of 0.42 V.

During the full run, there is no protocol error, no dropped session and no transport-layer alarm. Detection must come from the data itself. The exercise shows this.

Q27. Where does NetSim Cyber fit in red team and blue team work?

It is the reproducible adversary. On the red side, it supplies:

• protocol-aware attacks
• wire-valid packets that standard monitoring does not flag
• timestamped scenarios, generated on demand
• safe recreations of real campaigns

On the blue side, you can tune IDS, IPS and anomaly detection, exercise SOC playbooks and train analysts. You can also build labelled data for detection models, and run device, vendor and product security tests. One controllable adversary lets you train, test and prove the defence before it goes live.

Q28. What does NetSim Cyber not do?

• It does not solve the electrical power system. Grid dynamics come from a paired real-time simulator, as described in Q4.
• It does not cover initial access, exploitation or malware delivery.
• The current release does not support cyber attack detection algorithms. They are under development.
• The current release does not support cyber attack countermeasures. They are under development.

Detection stays the job of the tools and the people that the platform tests. This division of labour is intentional.

Q29. How is an evaluation arranged?

Write to sales for an evaluation. A typical evaluation starts on one system with the built-in simulators, where you build a scenario and validate an attack. It then moves to a distributed setup against your own relays, SCADA master or real-time simulator. The NetSim Cyber product page covers the feature set, the architecture and the publication list in more detail.