Monitoring Isolated Enet/IP Networks

I was wondering how everyone monitors and troubleshoots their isolated control networks.We use mostly Rockwell components, and usually Control Logix. For example, we have many isolated Enet/IP networks consisting of Enet drives, Remote Enet I/O, and HMIs. These are behind 1756-ENBTs modules. Unfortunately we have NTRON 500 series switches which do not support SNMP, so we are limited to the N-view utility.

We are exploring options for troubleshooting these networks beyond the simple network tools, like ping. We've been considering IntraVUE, from Network Vision as an option to help us.

So, what do most of you use? is your network small enough to just use simple diagnostics? Or, do you use products like Wireshark and IP scanners, more standard IT tools.

Look@Lan is AWESOME

Anyone here use IntraVUE?

Haven't used any of your considerations, but SolarWInds will give you some nice trial software if you register.

We use Frontline. http://www.fte.com/products/NetDecoder-01.asp. A tad bit pricy but it does a lot more than just ethernet.

+1
I use Solar Winds and Whats Up Gold...

bulletin blues said:

Haven't used any of your considerations, but SolarWInds will give you some nice trial software if you register.

Click to expand...

Nagios, Solarwinds, and Wireshark here

Wireshark is an excellent, open (read free) software tool.

Wireshark is exceptional, but it's more of a "protocol/packet analyzer" than an overall network monitoring tool.

I use Wireshark and it is really good. However, my experience with Wrieshark is, that you really have to know where to look. As, Wireshark quickly captures alot of information. Unless I just haven't figured out the interface filtering as good as I should.

We have serval 90+ enet/IP networks with drives and Flex I/O, on several occasions we've had a few "ghost" problems that come and go. These are the type of problems we need a better way to monitor for these issues.

I agree that the amount of data that Wireshark captures can be confusing, and filtering is the key to getting through it all. I've been able to learn quite a bit about filtering from free online sources like LoveMyTool and Laura Chappell. The most important thing I've learned is that if I knew what to filter for up front, then I'd already have the answer to the problem, that's why having all the data too look at is so important, then run through a whole bunch of filters looking for possible problems, comparing captures of good behavior w/ captures of bad behavior.

Anyway, your "ghost" problems sounds like a tough one. I'm not sure I know what you mean, can you explain the symptoms your problem in a bit more detail?

Thanks for the reminder about LoveMyTool, Steve. It's a whole field that I'm sure I could get lost in if I wasn't doing automation systems.

Most of the users I've been involved with have very little going on in the way of monitoring or logging of their automation network.

Onboard the Logix controller, I like to poll the I/O connections with GSV instructions and log faults to an array. This is custom RSLogix 5000 code, though, and tedious.

Offboard from the controller, I rely on the embedded web pages in devices like the 1756-ENBT. I use WGET to download those on demand when I'm diagnosing a problem.

And if you're lucky, you have switches that have logs (oh, what I'd do for a Port State log with an accurate timestamp...) and SNMP features.

Alas, I get a lot of major customers insisting that I explain to them why they can't use use unmanaged office-grade switches. All I can do is tell them scary ghost stories about problems that arrived, shut down the plant, then disappeared without a trace.

There are amazing amounts of free software for network monitoring and diagnosis, but it could be a whole career for the average automation guy (Nathan/surferb is not average) just learning to build that onto a FreeBSD or Linux box.

When I go ghost hunting on a network, I bring a managed switch or an Ethernet tap, Wireshark and FTE NetDecoder, and a spare PC to leave perched inside the control cabinet.

What I would dearly love is if there was some connection between CIP object states and SNMP traps.

Wouldn't it be great if, when an I/O connection was created or broken, the 1756-ENBT sent an SNMP trap to a server ?

I don't think I can poll CIP statistics or connection data from the 1756-ENBT; the embedded web page or CIP objects seems to be the only way to get that information.

Thanks for all the good information. I'm in the process of recommending changes to our corporate specs for Ethernet control networks.

We have been using series 500 N-Trons on most of our networks. At a minimum, now I will recommend that we use the 700 series N-tron, they support SNMP. Stratix switches look nice with top features, however$$