# Future Industrial Networks in Process Automation: Goals, Challenges, and Future Directions
## 2 A Case Study: Iggesund Paperboard
### Traffic Analysis  
To have a complete view of the OT network traffic flows, we captured the traffic during paperboard production using a traffic recorder connected to both the primary and the backup network at the same time. On each of the connected ports from the recorder, traffic mirroring was enabled, such that all traffic in that switch was mirrored to the traffic recorder. The limitation of this capturing method is that it is not sure that all traffic flows in the ring network were captured. However, due to the large distances and different rooms, it was not possible to mirror the traffic from all switches in both the primary and backup network concurrently. Although not a perfect method, it was the only viable solution and provided as much insight as possible into an OT core network during production. The data set contains both the primary and secondary network during 12 h with a size of 60 GB. One of the fundamental analyses is the number of traffic flows and what nodes are contributing to the network. Figure 5 aims to visualize the communication flows as colored lines per VLAN and colored dots as nodes in the corresponding VLANs. The network comprises 337 unique communication flows, representing the communication between nodes and control systems. Unique communication flows for each node vary from 1 to 108, which is a maximum of 107 communication destinations for the control system. In this figure, we can clearly see that there are two communication flows clusters. The two larger structures in the figure show that the controllers communicate with the connectivity server, which is illustrated as a virtualization platform in Figure 4. The other large portion of flows represents the case when operator stations and engineering stations are communicating with the connectivity server. The connectivity server is a gateway between the control network and the server network. The connectivity server provides protocol translation from various controller protocols used and provides an open platform communication interface for the server network. The connectivity server also creates a boundary between real-time traffic and relaxing timing requirements to the server network. A pragmatic approach towards the evolution of the process industry is to characterize various traffic flows and identify appropriate traffic classifications to map the flows into the correct traffic type. Figure 6 shows the traffic load over one second per VLAN. It can be seen that there are a few VLANs with a consistent amount of traffic over time, and some vary a lot over time. The VLANs with a steady amount of traffic are most likely handling periodic transmissions to and from the controllers, e.g., control network traffic. VLANs  
Figure 5: Traffic flows from one of the paperboard machines during recording hours. with a fluctuating network load are more difficult to classify in this way, as they might contain both periodic and aperiodic traffic. Those VLANs require a more in-depth analysis in order to be classified correctly. As previously mentioned, the control networks should have predictable network utilization over time. Figure 7 illustrates this expected behavior with a limited range in both packet size and the number of packets per second, as well as the contribution of different protocols in the VLAN. In Figure 8, the number of packets and the amount of data transmitted in the server network (VLAN-F) is shown as well as the distribution of different protocols. In this VLAN, it can be observed that both the number of transmitted packets and the average size of the payload vary over time. However, from the lower part of the figure, it can be seen that approximately 2000 packets per second is a base-load, with occasional traffic peaks. This behavior could be explained by the fact that the operator stations are subscribing for periodic status updates with a limited variation in packet size, from connectivity servers. The periodic updates would then serve as the base-load in the server network.