IGMP Snooping

whumphrey

Lifetime Supporting Member
Join Date
Aug 2011
Location
Lincoln, NE
Posts
35
Hello,
Could someone offer a simple explanation of IGMP snooping and how it relates to AB Ethernet IP devices on a network?

My specific issue is a Panelview on a network of other SLC 5/05 PLCs, HMIs, etc. Part of the newtwork including some Micrologix 1100s is on the other side of a MDS iNET 900 Ethernet radio link.

The wirless bandwidth on the iNETs is getting hammered. The IT folks think they have narrowed it down to ARP requests coming from the PanelView.

Everything is on the same class C subnet. Will a managed switch with IGMP snooping enabled help solve this problem and keep this traffic off the wireless section of the network?

Thanks,
Warren
 
This sounds like a system that IGMP Snooping and filtering will not help.

That technology only applies to Multicast traffic, and the only A-B automation devices that generate that kind of Ethernet traffic are ControlLogix I/O and Produced/Consumed Tags. If you only have SLC and MicroLogix and PanelView, there should be no A-B related Multicast traffic.

Address Resolution Protocol (ARP) is a very normal part of IP networking that allows a device to determine the relationship between MAC ID and IP Address. ARP packets should be very infrequent.

But there might be something the MDS radios are doing that messes with ARP and requires constant refreshing of the ARP table on the PanelView.

Has the IT department provided you with any TCPDUMP or Wireshark traces, or told you how many ARP packets per minute are going over this link ?
 
Does the PV need to talk to anything that isn't on its side of the radio link?
Could you post the subnet mask of the pv as its configured right now?
 
Thanks all. It may take some time to get the info requested but I'll try. The system is somewhere else and my remote access cannot get me everything.

I do have some older wireshark traces they sent me; I'll see if I can filter these to shed more light on the situation.

Thanks,
Warren
 
What I was thinking and what Dravik may have in mind also is segregating the traffic a little bit by maybe putting thr radio in a seperate subnet and using a mask to give the radio the abilty to send traffic to only the devices it needs such as the plc.

You could do this with a smart / managed switch or a router also. Doing it with masks is a cheap but effective solution.
 
Great minds, etc Plc Kid, that's where I was going with it.
I've noticed that even operating normally the PVs tend to be rather 'chatty'.
 
I've asked for a recent wire shark trace. Hopefully this will come soon. I did look at an older trace that shows a fair amount of SSDP messages being generated by the PV....but it doesn't look to me like enough to cause the problems being reported. Is this the *chatty* behavior Dravik is referring to?
Thanks,
Warren
 
A PanelView terminal is only going to be as "chatty" as you configure it to be ! It's easy to configure a terminal for 100 millisecond updates but forget that this puts a load on the controller and the network.

I'm curious to see what sort of traffic has been seen on this network. To my knowledge neither the PanelView Standard nor the PanelView Plus (which one are you using?) uses the Simple Service Discovery Protocol (SSDP) at all, though it wouldn't surprise me to see ordinary traffic inadvertently mis-labeled by Wireshark.

With regard to ARP; I have seen some devices "flood" a network with gratuitous ARP packets for the purpose of duplicate IP address detection. PanelView wasn't part of my testing for that, and it was a while ago. The effect only lasted until the device saw some sort of other traffic than its own gratuitous ARP packets.
 
The source IP of the SSDP was definately the panelview...unless it is a duplicate IP. I did see a number of gratuitious ARP "broadcasts" coming from several devices whos source shows up as "RsAutoma_<last three words of mac address>". I think these are the SLC 5/05 PLCs but I cannot be sure without more investigation.
 
Yes, the PV and its associated Micrologix 1400 PLC are plugged into the same switch which is part of a local fiber network (made up of Moxa unmanaged switches). Also on this fiber/copper section of the local subnet are three SLC 5/05 PLCs, a Wonderware InTouch HMI, and one iNET.

The iNET branches out to several other iNETs which attache to other Wonderware InTouch PCs and AB PLCs (SLC and Micrologix).

Unfortunately most of this network, including the iNETs, were designed and installed by others. I do agree with the replies suggesting the network be carved up in to multiple subnets.

Thanks.
 
I wonder what's on this network !

"RsAutoma" is the prefix that Wireshark puts on MAC IDs from a company called RS Automation Co. Ltd in Korea. They happen to also be Rockwell Automation's partner in Korea, which might have something to do with the name, but they have a product line that's different from RA. Their servo controllers look a lot like the Kinetix 350 to me: do you have any of those on the network ?

Most Rockwell Automation Ethernet devices, including PanelViews, SLC-500 and MicroLogix controllers, and ControlLogix, will have a "Rockwell_" prefix taking the place of 00:00:BC in the MAC ID field.

I can't explain the apparent SSDP traffic.

Any Wireshark traces you can ZIP and post here (or put in another dropbox style location) would make for interesting reading.
 

Similar Topics

Hi, Can anyone tell me if the IGMP snooping is enabled if the Stratix 8000 is used in a way straight out of the box using the factory defaults. I...
Replies
2
Views
1,556
Hello All, Please our powerflex 755 20G1AJD545AN0NNNNN runs for about 2 weeks then trips on F5037. I have checked the CAT6 cable that its not...
Replies
4
Views
3,082
I am trying to get a better understanding of some of our ethernet ip systems and i know that you must use managed switches with IGMP turned on to...
Replies
14
Views
9,356
Hello. I have a question about multicast packets over produced tags. I've got a home lab setup, and I'm trying to get a better understanding of...
Replies
7
Views
1,836
I am designing a network with a contrologix PLC. We are proposing to connect the drives and remote I/O using ethernet. The controllogix rack will...
Replies
7
Views
6,518
Back
Top Bottom