Network storm on LAN

Hi,

I have a network where several Siemens CPUs and switches are connected, and technically there is a loop in the network, meaning that I have a ring, without the ring being managed by any FRNT function activated (to manage the ring). However, I tried to put in a one-way Ethernet device, manufacture by Phoenix Contact. Schematics attached. This device should allow for my UDP data to flow in one direction only.

Shouldn't this physically avoid any network storm, if this is inserted in a part of the ring? If data can only go in one direction, a network storm will not occur, or am I wrong on this?

What in gods name is that ??
Newer heard about a one-way Ethernet device. Do you have a link to the Phoenix device ?

If there is a ring, you can still have packets travelling around even if it is only one way around.

And I am pretty certain that Profinet is exchanging data in both directions, even if functionally 'data is being sent one way only'.

What is the idea of all this ? Why create a ring with having devices that are setup to handle the ring ?

Is a device to manage the ring not a better solution?

Thanks for the reply,

The thought is to send UDP data broadcasted only in one direction. And it is on Industrial Ethernet, not Profinet.
This has been working fine, until we introduced another network of another system into the old network. When components in the new network got connected, there seem to be loops present. The only thing which would prevent the loops 100% closed, would be these adapters which has one installed in both parts of the loop, so the data should not be able to access the component which closes the loop. However it does not seem like it is working.

And I was wrong about Phoenix, it is actually an in-house product manufacture by one of our sister companies.

Attached is a schematic of the network. There is a switch in the LCC cabinet which connected those UDP connections. Also, the one-way adapters I mentioned are those that are inside the red rectangle

JesperMP said:

What in gods name is that ??
Newer heard about a one-way Ethernet device. Do you have a link to the Phoenix device ?

Click to expand...

I can't seem to find the specific device, but such things are called data diodes. usually used to support one-way data between separate networks, not on the same network.

JesperMP said:

And I am pretty certain that Profinet is exchanging data in both directions, even if functionally 'data is being sent one way only'.

Click to expand...

Agreed. This would break most protocols, not just Profinet.

Use of managed switches would seem to be in order here.

JesperMP said:

What in gods name is that ??
Newer heard about a one-way Ethernet device. Do you have a link to the Phoenix device ?

Click to expand...

I have heard about (but never used these) in the context of network security -- it allows (for example) data to be transmitted from a secure network to an insecure one without providing any possible access in the other direction.

As JordanCClark states, this is commonly known as a data diode, and OP's scenario is in no way its intended use.

orense said:

The thought is to send UDP data broadcasted only in one direction. And it is on Industrial Ethernet, not Profinet.

Click to expand...

I see that for UDP you dont actually need data going back to the sender.

orense said:

This has been working fine, until we introduced another network of another system into the old network. When components in the new network got connected, there seem to be loops present. The only thing which would prevent the loops 100% closed, would be these adapters which has one installed in both parts of the loop, so the data should not be able to access the component which closes the loop. However it does not seem like it is working.

Click to expand...

The diagram cannot be correct.
I would investigate and establish a 100% correct topology diagram.

Are you sure that the loop is not something else, like a duplicate IP ?

I know that my suggestion is not according to your strategy, but it could be simple solution. As you already have network, you can add Modbus TCP/IP functionality, and make use of same registers in PLCs. After that you need one Modbus Broadcast message to send data to all devices, by using address 0, and slaves will not respond.

For the record, a network ring is only a ring when it is managed; otherwise it's a loop.


From your diagram, is the "One Way Ethernet Device" effectively just a wierdly wired Ethernet cable? I'm pretty sure it doesn't work like that; if they devices are set to autonegotiate then they will figure out that they need to run at half duplex and they'll take turns sending data over the single pair and data will go both ways. If they are both configured for 100mb full duplex, then MAYBE the scheme would work?


Either way, if the above is true, it is totally abusing Ethernet, and you shouldn't be surprised if weird stuff results.

The majority or network switch made these days include spanning tree protocol, STP or RSTP (rapid), which prevent network broadcast storms, so you really should look at your switches specs to check that.

plvlce said:

I have heard about (but never used these) in the context of network security -- it allows (for example) data to be transmitted from a secure network to an insecure one without providing any possible access in the other direction.

As JordanCClark states, this is commonly known as a data diode, and OP's scenario is in no way its intended use.

Click to expand...

Yes. Firewall rules. in my home network i have a secure network, a home automation network, guest net. The secure network can reach into and communicate with things in the home automation network as long as secure devices start it. THe home automation network cannot talk to anything in the secure network first, only respond. Guest net can look into nothing.

As other said, do it right and get managed switch. Just about all managed switch have STP turn on by default and will prevent a loop.