UniCA Release Notes (version 4.

8)
Summary of changes

Scheduled Changes for 2004

- IEC 61850; Update GOOSE with IEC 61850-8-1 IS grammar

- IEC 61850; Filter GOOSE messages on MAC-address
- IEC 61850; Extend the data model semantics (finally using SCL files)
- TASE.2: Improve the decode of TLS X.509 certificates

Changes in version 4.8.00 (Jan 2004)

- Fixed: Decode of large MMS PDU’s, like e.g. TASE.2 CreateDataSet request
- Improved: Display an error when TCP data has a sequence gap. Unfortunately UniCA
can reconstruct only simple sequence gap and retransmission situations
- When the analysis shows many retransmissions and sequence gaps we recommend
to investigate the router performance, network load and line quality.
- IEC 61850: If you select the “UCA 2.0”application setting, UniCA will use the
UcaDefaultObjects.cfg configuration file and for the “IEC 61850”setting the
IEC61850DefaultObjects.cfg file.
- Fixed: Increased the supported number of connections from 100 to 300 in one trace
- Changed the support e-mail address in the about box to: pc.helpdesk@kema.com
- We recommend 256 MB memory for smooth capture and analysis

Changes in version 4.7.6 (Dec 2003, internal version)

- IEC 61850; Update GOOSE with IEC 61850-8-1 FDIS grammar

Changes in version 4.7.5 (Nov 2003, internal version)

- TASE.2: Decode a part of the TLS and X.509 certificates (need to be improved to
display attr values)
- IEC 61850; Improved the display of ACSI services mapped on MMS read/write
- Display a warning when available physical memory is low when starting a capture;
stop a running capture when available physical memory is very low
- Fixed: incremental time causes infinite loop when first frame isn’t visible
- Fixed: increased stack size to handle large/complex MMS getVarAccessAttr PDU’s
- Fixed: save/restore “increase capture performance”default document setting, when
checked the trace file is saved in the UniCA.exe folder as
UniCA_SaveBeforeAnalysis.uca
- Fixed: cyclic buffering + event recording correctly saves the captured data to disc
(previously some files could be corrupted)

Changes in version 4.7.04 (Sep 2003, internal version)

- TASE.2; Capture TLS secured TASE.2 traffic and display uncrypted TLS messages
at transport layer just before the TASE.2 association (enable the TRA-layer and
search for TLS)

UniCA Release Notes 1/5

- Improved the decoding of ACSE authentication values. For example the AP_Title
value (43, 9999, 12) is now displayed as (1, 3, 9999, 12). The ASN.1 encoding
defines that the first number is multiplied by 40 and added with the second. This
process cannot uniquely be reversed! For example 163 can be 1,123; 2,83; 3,43 or
4,3. In this example UniCA will display 4,3.

Changes in version 4.7.03 (Aug 2003)

- IEC 61850; Updated GOOSE grammar

- IEC 61850; GOOSE with VLAN tagging (draft IEC 61850-8-1 FDIS grammar)
- Show multi MMS-PDU in one packet on Application layer in one line overview:

Changes in version 4.6.04 (June 2003)

- TASE.2; Support for TASE.2 second edition, added TimeTagExtended data types

Changes in version 4.6.02 (May 2003)

- 61850; fixed bug in ACSI decoding. Error message shown if object is missing from
object configuration file
- 61850: object configuration file updated

Changes in version 4.6.01 (May 2003)

- TASE.2; Added Data_DiscreteQ, and Data_DiscreteQ TimeTag class definitions to

the object configuration file
- TASE.2; Support for conformance block 7 events
- IEC 61850; UTC time display
- IEC 61850; Reporting model en control model services
- IEC 61850; Some data model (part 7-3 and 7-4) semantics
- IEC 61850; Application setting to switch between UCA2 and IEC 61850 semantics
- IEC 61850; Capture and analyse SNTP packets (shown on Transport and Appl. layer)
- IEC 61850; Use transfer time of first SNTP packet as time base to display time of day
- IEC 61850; New filter to display only GOOSE status number changes

UniCA Release Notes 2/5

- IEC 61850; Fixed binary time hours presentation
- Object configuration file GomsfeDefaultObjects.cfg replaced by
IEC61850DefaultObjects.cfg. For UCA communication, copy your previous
GomsfeDefaultObjects.cfg file to IEC61850DefaultObjects.cfg.
- Support *text1*text2* wildcard in the object configuration file, e.g.
VAR, *RWE*_STATUS_*, Data_DiscreteQ
- Display MMS Conclude messages on Application layer
- Single line overview now with more object name(s) on Application layer
- New shortcut F7 starts concurrent capture
- Double click on a frame selects it and toggles word wrap
- Support hardlock key (dongle) on USB-port and serial port
- UniCA starts in full-screen mode now
- Easy access to the UniCA user manual via About – User manual
- Some minor bug fixes

Changes in version 3.3.02 (October 2001)

- Cyclic buffering and event recording; This powerful new feature enables you to
capture network traffic unattended for a long period of time. If any interesting events
happens you can configure UniCA to automatically store the buffer to file in the
UniCA installation directory. Configurable events are:
- Frame errors on session and higher layer,
- New association,
- Specific text in the visible layers,
- Always save the buffer
- Single line overview now with object name(s)
- TASE.2 timestamp and quality bits are recognized and decoded even when not
defined in the object configuration file
- TASE.2 Start/Stop Transferset and IM TransferReport services are recognized
- Changed website to www.kemaconsulting.nl
- Pre-analysis errors on all protocol layers are merged and displayed on the Message
layer
- New UniCA User manual and Tutorial
- Support *text* wildcards in the object configuration file, e.g. VAR, *_STATUS_*,
Data_StateQ
- The capture dialog can be minimized/restored, resized and moved to improve the
visibility of the analysis window
- With File – Scan documents you can extract errors from multiple trace files
- With CRTL-F12 you can toggle the ASN.1 decoding at session layer (expert use only)

Changes in version 2.2.03 (June 2001)

- Block 4 information messages are displayed in ASCII

- Correct time stamping with 1ms resolution

Changes in version 2.2.02 (April 2001)

- Monitor the actual values of one or more variables (when monitoring enabled). Just
add ,MONITOR after a non-wildcard variable definition in the object configuration file
- Improved network load display during capture
- Improved decoding for TCP, TP0 and ACSE protocol

UniCA Release Notes 3/5

- About UniCA displays key and key driver errors if any
- Added FAQ at the end of this release notes page

Changes in version 2.2.01 (December 2000)

- Support added for Windows 2000

Changes in version 2.1.08 (September 2000)

- Support long (20 byte) OSI network addresses

- Display node names together with network addresses in filter and capture settings
dialog if configured in configuration file

Changes in version 2.1.07 (July 2000)

- Solved timestamp error on W95/W98 systems, accuracy now about 1 ms

- Solved ASN.1 indefinite length decoding bug
- Object decoding; support the ? wildcard character for variables in the config file
- Optimized Tase.2/Gomsfe object decoding resulting in faster file load and fast
scrolling, especially for large PDU's
- Support CASM/Gomsfe information reports decoding
- Improved object decoding on OSI and TCP/IP transport layer (solved most incorrect
error messages)
- Capture dialog shows the selected OSI, RFC1006, TCP/IP filter
- KEMA logo in the background

Changes in version 2.1.01 (April 2000)

- Tase.2/Gomsfe object decoding. UniCA decodes objects and displays (bitstring)

semantics that are configured in the object configuration file. To add new objects edit
the configuration file and reload it when done. See Settings-Application. Use Scan
document to automaticly add dataset definitions.
- The absolute time will be displayed as time of day
- Updated the help information and added protocols and abbreviations
- Readme in startmenu for easy access to a/o documentation
- Check network-MAC address can be enabled/disabled in Settings-Application
(disable this check for redundant Ethernets and data through firewalls)
- File-Properties displays the maximum and average network load of the document
- Decodes MMS PDU constructed from multiple TCP frames (solved bug)
- Updated the display of IP, TCP and OSI network and transport layers from
abbreviations into readable text
- Capture settings to capture the OSI profile, TCP/IP-RFC1006 profile and/or all TCP/IP
traffic

Known bugs

- GOMSFE: Goose user bitstring is truncated (over 300 chars on a single line!)
- When one Ethernet packet contains multiple MMS PDU's, UniCA displays only the
first PDU at Tase2/Casm/Acsi layer (workaround: look at MMS layer)

UniCA Release Notes 4/5

- UniCA does not decode a MMS PDU constructed from multiple TPDU frames that are
out of order (due to networking packet loss)
- The display of timestamps can change over different PC’s due to different
performance counter frequency’s
- Online help not updated (workaround: look at UniCA User Manual and release notes)

UniCA Release Notes 5/5