Wireshark trace interpretation

Hi all,

I've got an SEW device I'm trying to set up to talk to a ControlLogix. I've used this exact combination before and everything has worked swimmingly, but for some reason this time the thing just won't talk!

I've got a managed switch so I set up port mirroring on the PLC port and ran a wireshark trace, filtered to the IP of the offending device. I'm seeing some traffic, but it definitely looks like just a "are you there?" "no, go away" type exchange. I don't have a lot of experience with interpreting wireshark and wondered if a kind soul with more knowledge that I would be able to have a quick look and help me out? I've attached a screenshot and the wireshark file.

Key points:
- Device is set up as a generic ethernet module
- Checked (and double/triple checked) assembly instances/sizes, IP address, data type, etc. All copied and the same as a working example at another site
- I have two identical units both behaving the same way, which mostly rules out a dodgy device issue
- While online with the PLC I can ping the device (and use the SEW software to go online to it)
- I have tried linking everything together with an unmanaged switch to eliminate managed switch issues - same results
- 1756-L71 with v23 firmware, via 1756-EN2T (working example at other site is 1756-ENBT, but surely not a factor???)
- Error code for connection is (Code:16#0204) Connection Request Error: Connection request timed out
- Not using Unicast, RPI is 10ms (changing this has had no effect - and again, that's the same as the working setup elsewhere)

Thanks in advance to anyone who's able to shed light on this!

192.168.21.32 = 1756-EN2T
192.168.21.33 = SEW Eurodrive
192.168.21.34 = SEW Eurodrive

Your characterization is basically correct:

1756-ENBT: "Good morning, kind sir ! Lovely weather we're having. Could I interest you in a Port 44818 connection and a cup of hot tea ?"

SEW Eurodrive: "Port 44818 ? Never heard of her. [SLAM!]"

The SEW device just plain doesn't seem to be listening on Port 44818. It's as though you got one set up for Modbus/TCP (Port 502) or some other protocol.

There's a neat tool called TCPing (elifulkerson.com) that I use to prove that a device is at least listening on the ports I expect. Use that or something like NMAP to probe and see what ports might be open on that device.

Brilliant, thanks Ken.

I've got tcping, so I ran tcping 192.168.21.34 44818 and sure enough, no response. So I guess it's a matter of getting the SEW device to listen on that port then?

I'll keep looking, but if anyone has used MotionStudio and knows what to look for I'm all ears! (especially as they've just told me they're fumigating at 10pm and if I'm not out of here by then it's going to get very foggy all of a sudden!)

All EtherNet/IP devices listen on that port.

Could the EtherNet/IP protocol just not be enabled on that Eurodrive device ?

Well my SEW rep returned my call (got to hand it to him, it's a Saturday, and not only that, AFL grand final day which is basically the australian equivalent of the superbowl) and after a bit of back and forth wondering why he'd never ever come across having to open up ports before, we twigged that the bl**dy dip switches were set to Profinet. One tiny screwdriver later and all the problems are gone.

Thanks a heap Ken, you definitely got us looking in the right direction. If you ever find yourself down under I think I owe you several beers by now!