1756-ENBT/A Ethernet Faults "Unknown Protocol"

[slick_2323]

I'm just starting trouble shooting a production Line that shuts down due to Ethernet faults. The line has been disconnected from the rest of the machine network, and this seemed to prolong the issue, but still occurred while the line was completely isolated from the rest of the network.

I checked the web interface of the 1756-ENBT/A and under Advanced Diagnostics --> IP Statistics I noticed "Unknown Protocol" count was at 152610. This seems unusually high.

I could not find much documentation on what "Unknown Protocol" would be a result of. Could someone direct me to more information on this subject?

 

[Contr_Conn]

You can ignore this counter. It means that ENBT is getting properly formatted data packet but just have no firmware support to understand it.

 

[Ken Roach]

All I've ever seen described for that counter was "inbound octets with an unknown protocol".

Does that value increment regularly ?

My guess is that you would see this if you regularly ran security scans, or had universal plug-and-play devices on the network, or some devices had been configured to try to read the -ENBT with Modbus, or some other protocol.

It's very unlikely to be causing a malfunction; the -ENBT will just ignore incoming packets it can't make sense of.

 

[Contr_Conn]

I would check the up time on the home page - this will tell you the frequency.
For ENBT this is not a counter to worry about in any case.

You did not specify what are actual issue you are trying to troubleshoot.

General recommendation to start with: make sure it has the latest firmware 6.006 and media counters are at zero.

 

[AlfredoQuintero]

The last resource would be to get a Wireshark trace of the traffic going into and coming out of this 1756-ENBT/A card, for which you would need a managed switch with port mirroring functionality or an Ethernet TAP.

 

[slick_2323]

The last resource would be to get a Wireshark trace of the traffic going into and coming out of this 1756-ENBT/A card, for which you would need a managed switch with port mirroring functionality or an Ethernet TAP.

I have this setup on a Stratix 6000 and capturing all network traffic on the Line. I'm splitting the pcap file every 4 hours hoping the logging will be done when the network fault happens again.

When using whireshark what do you look for to diagnose network faults on a machine network?

 

[alain64]

If the communication was good before and became bad (and if you can temporary fix it cycling the power), you may also consider an harware problem with the ENBT. This sometimes happened with old series of ENBT modules that have a deffective Ethernet communication chip.

 

[AlfredoQuintero]

I have this setup on a Stratix 6000 and capturing all network traffic on the Line. I'm splitting the pcap file every 4 hours hoping the logging will be done when the network fault happens again.

When using whireshark what do you look for to diagnose network faults on a machine network?

At this moment I do not know if the fault is a physical problem with the 1756-ENBT/A or with the devices communicating with it.


One way to know if there is something physical in nature is to check if there are ARP (address resolution protocol) requests from a device which may have a defective PHY. Every time an Ethernet device looses its link it must send an ARP. My rule of thumb is to start trying to rule out problems from the lower layers of OSI/OSI model, the physical layer, and going up from there.