Subscriber Discussion

Do I Have A Ghost, Or A Bad Wire? Strange Access Control Errors

Avatar
Scott Bradford
Feb 26, 2018
IPVMU Certified

Hello everyone. I've been working on this all morning and I'm lost.   I have a controlled room inside another room.  I had a badge read on the interior room at 5:30 am this morning, but no one scanned in the 'outside' room for at least 48 hours leading up to it. I've looked at the video of the camera aiming at that door and I've got nothing. So, either someone is tele-porting into the interior room or I have a ghost. 

 

 

 

OR:   (my current theory).   

 

The badge reader that is on that door is an OLD prox reader (say 10 years).  The wiring leading from that reader to the node is about the same I'd assume.   System is S2.  Now, the reason this is sticking out to me is because my system is calling it an 'unknown' card/person.  I've been getting these unknown reads on this reader (but not the one on the outside door) randomly for some time. Randomly meaning literally at all hours of the night and day, from 11pm to 5am, on weekends when no one is here, etc. 

 

So, is it possible that I've got a short in the Wiegand wires from the reader to the node, or a rat chewing on the wire and causing the short and inducing some sort of Wiegand signal that the S2 node is trying to interpret as a card read?

 

Or should I call Ghostbusters?

 

 

Avatar
Brian Rhodes
Feb 26, 2018
IPVMU Certified

The reader itself could be 'going bad'.  The specific failure mode of of a bogus wiegand string isn't too far fetched, because a 5VDC current on both green and white wires is expected.  If the reader is dying and that normal voltage drops to 0.00 sporadically, the controller may report this as 'unknown' (but in reality it isn't even close to being a legitimate read).

(4)
UI
Undisclosed Integrator #1
Feb 26, 2018

I have seen the shorting issue cause a panel to think a random card is being read repetitively. Maybe you are seeing the beginning of an issue with the cable. 

What is S2 reading the card number as? 

(1)
Avatar
Jeff Kaproth
Feb 26, 2018

What is the wire used for the reader?  is it shielded?  Induced voltages from surrounding environmentals can cause strange things on the data string as well.

(3)
Avatar
Scott Bradford
Feb 26, 2018
IPVMU Certified

New info!  The reader on the other side of this wall where the red star is.  Also, the reader is a fairly new HID multiclass reader.

 

So, my current theory is that it's electrical noise causes by these huge breaker panels that are surrounding the reader. 

 

reader

U
Undisclosed #2
Feb 26, 2018
IPVMU Certified

Also, the reader is a fairly new HID multiclass reader.

Btw, is weigand still the protocol in use with those?

Avatar
Brian Rhodes
Feb 26, 2018
IPVMU Certified

Yes. OSDP is an option, but typically requires additional configuration to implement.

Avatar
Jeff Kaproth
Feb 27, 2018

My goodness.  The Simplex panel nearby was scary enough!

 

My suggestion is making sure you have shielded wire, and only ground 1 side!  (panel side generally the easiest).

(1)
TM
Tom McVey
Feb 26, 2018
IPVMU Certified

I would like to know what you find out and what you do to prevent this.  Please update when you find the solution. I've found threads before that describe a problem I have only to reach the end and they say fixed it without a description.

Avatar
Scott Bradford
Feb 26, 2018
IPVMU Certified

We are about to do some work in that area, so I'll have the integrator check and make sure the cables are shielded and in good shape. If I find anything I'll report back.

 

 

U
Undisclosed
Feb 26, 2018

The technical term from the data communications world is "DATA F*RT".  Something (those panels maybe) made the thing emit a burst of noise and the panel managed to interpret it as a read.  Virtually all of this stuff is wiegand. In other words, uncontrolled unsupervised ttl wiring going through your walls past all your high voltage gear, relays, electric motors, etc.  Check the "cardholder number" the system claimed it saw.  Is it all 0's or all 1's or some crazy value nowhere near the expected range of values?  Let me guess, if the front and rear parity bits on the wiegand message were bad there's no way for the system to report that, is there?

Avatar
Mark Jones
Feb 27, 2018

We too have seen this on very rare occasions.  Without fail, it was always wire.  Replace it with spec. 

Avatar
Tony Darland
Feb 27, 2018
IPVMU Certified

I'd call Ghostbusters.

U
Undisclosed
Feb 27, 2018

Undisclosed Ghostbuster No. 4?

OK so all you wizards had answers.  Is there a voltmeter or something you would have used to check this questionable wire?

Avatar
Jeff Kaproth
Feb 27, 2018

In my experience, there is no tool better than a solid install from day 1.  No, a voltmeter will not find the inherent induced voltages with any accuracy.  Shield your data line, and ground at one end, will give it a drain to eliminate the induction.  Ground at both ends, you create an antenna, and issues will not only continue, but multiply.

 

(2)
Avatar
John Doherty
Feb 27, 2018
IPVMU Certified

Make sure card reader shield is not grounded on both sides. If only grounded in panel make sure its a good ground. We recently had a bad ground on a shield in the card reader panel for an HID 6005 reader that cause phantom reader errors coming in as invalid reader when no one was presenting a card to the actual reader.  We removed the shield from ground in panel and it fixed the issue. 

(2)
Avatar
Scott Bradford
Feb 27, 2018
IPVMU Certified

this is the card string that S2 captured

(1)
Avatar
Jonathan Lawry
Feb 28, 2018
Trecerdo, LLC

Was this S2 Netbox talking to an S2 node, or a Mercury panel?

Is there a reason why facility codes seem not to be being checked?  Granted, it's not going to help the ghost reads in the first place, but it might make them easier to filter.

Avatar
Scott Bradford
Feb 28, 2018
IPVMU Certified

S2 node.  An older node if it makes any difference. 

 

Also, in our system we have approx 15 different card types with a variety of FC and brands.  (working to clean that up)

Avatar
Jonathan Lawry
Feb 28, 2018
Trecerdo, LLC

While ghost reads, in my experience, always turn out to be reader and/or wiring issues, I ask because S2 nodes and Mercury panels treat facility codes a little differently:  On S2 nodes, the facility code and the card number together form the unique credential identifier, while on Mercury the facility code is a property of the card, but not technically part of the identifier.

All that means is that this bad read of yours, which per the screen capture would have had Facility Code 0, would be easier to report as a "BIT MISMATCH" event in  S2 rather than an "UNKNOWN" card event, if it the board were Mercury.  This wouldn't have fixed the issue in any case, but it would identify the ghost reads easier.

U
Undisclosed
Feb 27, 2018

front parity even, first 12 bits, second 12 bits, rear parity odd - right?

so the front parity is wrong? (1 followed by 12 zero's?)

Jp
Jeffrey pope
Feb 27, 2018
IPVMU Certified

Myself, I'd go for the "ghost theory"------makes for better reading......lol.

UI
Undisclosed Integrator #3
Mar 01, 2018

I've had this happen on older systems.  In most cases, i've found that the reader port on the panel was bad.  If possible, try another port ( i know you many need to massage the access levels, but that might not be too bad)

TM
Tom McVey
Mar 09, 2018
IPVMU Certified

Was this ever fixed? What was the outcome.

Avatar
Scott Bradford
Mar 09, 2018
IPVMU Certified

I have not gotten any ghost reads in a while, but I've pretty much decided that it's electrical noise from the sub panels surrounding the reader and wiring

New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions