Live or replay
Inspect an authorized Npcap adapter or replay PCAP/PCAPNG captures without changing the original packet evidence.
SCL and stream identity
Compare destination address, APPID, VLAN, svID, dataset, confRev, mapping, and engineering scaling.
Trust permission
Determine whether the stream may feed measurement, pickup, and virtual trip while retaining diagnostic visibility.
Investigation sequence
Move from transport evidence to measurement admission.
- Confirm the capture interface or replay file and authorized test scope.
- Identify the intended stream by destination MAC, APPID, VLAN,
svID, and dataset. - Import SCL when trusted SCL-bound operation is required.
- Verify channel mapping and scaling provenance before interpreting magnitudes.
- Review
smpCntcontinuity, duplicate/out-of-order telemetry, freshness, and IEC 61850 quality. - Confirm that a complete measurement window exists.
- Compare the resulting trust permissions with waveform, phasor, pickup, and trip behavior.
Admission model
Different faults produce different restraints.
| Evidence | Engineering concern | Expected consequence |
|---|---|---|
| Unknown mapping | Channel meaning cannot be established | Measurement blocked |
| Unresolved scaling | Engineering magnitude lacks provenance | Trip permission removed |
Recent smpCnt gap | Window continuity is not clean | Pickup may remain visible; new trip restrained |
| Non-zero quality | Publisher marks one or more values questionable or invalid | Trip permission removed |
| SCL mismatch | Observed stream identity differs from intended configuration | Trip permission removed |
| Duplicate or out-of-order frame | Transport telemetry is inconsistent | Counted as evidence; payload samples rejected |
| Stale live stream | Recent data is no longer arriving | Measurement blocked or held according to current trust state |
Key design rule: rejected duplicate and out-of-order frames remain visible in telemetry, but their payload samples do not enter RMS, waveform, phasor, or protection buffers.
Live-network boundary: Npcap is required separately for live SV capture. Internal feeder/Transformer/AVR workflows and PCAP replay do not require it.