arp -a not showing PLCs + other network puzzles

[LifeGoals]

Hey everyone,

Recently landed a job in an environment where I have pretty good access to both the hardware and software surrounding all of the tech in the building. I'm using it as a playground to grow my knowledge and skillset, and in the spirit of doing so I wanted to rebuild the PLC network map that RSLinx uses for coms from scratch instead of flashing the backup we have on the network with all the settings already configured (there are 3 main panels, each with a single PLC, so I figured it shouldn't be too hard.)

My first step was to go to each panel and just read the IP Address spit out by the network card. There were 7 cards (and unique IPs) between the 3 PLCs, so that threw me off. Also, I was unable to ping them from command prompt. As I've dug into it, I'm viewing these addresses as a private IP host address within the PLC's individual network and it exists because many of our sensors and such are run off of I/O Link hardware (is the I/O block with all the M12 ports called a hub?). The idea is, the 11.100.100.10 address shown on the PLC network card is the address that the I/O Links modules send data to. Is that correct? Assuming it is, why would any PLC need more than one card? Couldn't you just subnet it to the needed number of host devices and then let one network card do the work?

Flashing the backup for RSLinx and then trying to work backwards, I have found the PLCs' public IP addresses (continuing with reasoning mentioned earlier), and for these there seems to just be one per unit which makes sense. Further, if I ping one of these public addresses from command prompt all four packets come and go with no issues whatsoever. The next part of the situation that I've not been able to come up with any good explanation for is that the address doesn't show up when I type arp -an into cmd prmt. A list of stuff does show up, some of it I don't even know what device it is, but not the PLCs. My thought was maybe the switch/router that the organization set up to handle the network traffic in the building just has two networks set up, but if that is the case, the ping command should've returned a no response timeout (I would think). So, how can ping find the PLC but arp -a cannot? The reason for using arp -a is I have engineering aspirations and I figure that if I need to be spoon fed IP addresses of the object I want to be the resident SME of down the road, I'd be a worthless SME, so I'm trying to gain an understanding of why I'm hitting these roadblocks and a knowledge toolset that I can use when the time comes to go to a new site that is having issues and be able to preform, assuming worst case situation such as lost backups and techs that are weak on their networking.

I hope that makes sense, and if something about the story is off, I can try to clarify/ add more details. Thanks in advance for any wisdom!

 

[lunenburger]

Can you post a screenshot of what you are looking at in RSLinx

You can't really remap RSLinx, it is just showing you what is configured in the field

 

[joseph_e2]

I'll leave most of your questions for others, but multiple cards allow you to physically isolate multiple networks. Also, each card will support a limited number of devices at a time.
This will get useful when you have, for example, the machine's IO and such on one network card while the other card handles the plant network, PCs, SCADA, other PLCs, etc. We have a system with 12 PLCs. The smallest has 3 nodes while the largest has 21. The PLCs talk amongst themselves and to a SCADA system. The network is overloaded and we sometimes get "impossible" situations arising where handshaking between the machines didn't work correctly, causing collisions, jams, and "hang-ups". It really needs a do-over, but the PLCs are all CompactLogix that only support a single network connection each so segregation will be tough without a managed switch, which our IT department won't allow unless they control it.
So....network segregation is definitely valuable and is a quite valid use for multiple network cards in a single chassis.

 

[arpus4KM]

Hey everyone,

Recently landed a job in an environment where I have pretty good access to both the hardware and software surrounding all of the tech in the building. I'm using it as a playground to grow my knowledge and skillset, and in the spirit of doing so I wanted to rebuild the PLC network map that RSLinx uses for coms from scratch instead of flashing the backup we have on the network with all the settings already configured (there are 3 main panels, each with a single PLC, so I figured it shouldn't be too hard.)

My first step was to go to each panel and just read the IP Address spit out by the network card. There were 7 cards (and unique IPs) between the 3 PLCs, so that threw me off. Also, I was unable to ping them from command prompt. As I've dug into it, I'm viewing these addresses as a private IP host address within the PLC's individual network and it exists because many of our sensors and such are run off of I/O Link hardware (is the I/O block with all the M12 ports called a hub?). The idea is, the 11.100.100.10 address shown on the PLC network card is the address that the I/O Links modules send data to. Is that correct? Assuming it is, why would any PLC need more than one card? Couldn't you just subnet it to the needed number of host devices and then let one network card do the work?

Flashing the backup for RSLinx and then trying to work backwards, I have found the PLCs' public IP addresses (continuing with reasoning mentioned earlier), and for these there seems to just be one per unit which makes sense. Further, if I ping one of these public addresses from command prompt all four packets come and go with no issues whatsoever. The next part of the situation that I've not been able to come up with any good explanation for is that the address doesn't show up when I type arp -an into cmd prmt. A list of stuff does show up, some of it I don't even know what device it is, but not the PLCs. My thought was maybe the switch/router that the organization set up to handle the network traffic in the building just has two networks set up, but if that is the case, the ping command should've returned a no response timeout (I would think). So, how can ping find the PLC but arp -a cannot? The reason for using arp -a is I have engineering aspirations and I figure that if I need to be spoon fed IP addresses of the object I want to be the resident SME of down the road, I'd be a worthless SME, so I'm trying to gain an understanding of why I'm hitting these roadblocks and a knowledge toolset that I can use when the time comes to go to a new site that is having issues and be able to preform, assuming worst case situation such as lost backups and techs that are weak on their networking.

I hope that makes sense, and if something about the story is off, I can try to clarify/ add more details. Thanks in advance for any wisdom!

If you want to find something using arp -a, you may have to scan for it after shutting it down and allowing it to boot up again if you haven't already been pinging it or have had any prior comms with it.



I think a list of what you have would be helpful..

PLC IP you're trying to see
your IP
what your arp -a looks like along with a valid ping result.

what PLC is this? what "network card" is it? what IO link block are you referring to.

 

[jschulze]

The ARP command in Windows' command prompt performs no action on the network (i.e. it doesn't cause any ARP packets to be sent). It simply lists the entries that are already in your computer's ARP cache, showing a list of IP addresses that your computer has previously resolved to physical addresses (MAC address) for a specific network interface. Therefore, if you've never communicated to a device on the network from that computer, it will not be in the computer's ARP cache.


Now that being said, you are correct that a successful PING command should result in an entry in the ARP cache for that IP address (since an ARP packet will be sent by your computer for that IP address if it wasn't already in the ARP cache). This is, of course, assuming that you are looking at the correct interface's ARP table. However, the "ARP /a" command should show all interfaces, though, so it should be shown under one of the interfaces.

 

[JeremyM]

arp is as reliable as:
a) the driver/stack implementing the service, and
b) how long it's been on the network communicating with stuff, and
c) how recently it communicated with the IP/MAC combination of interest.

TLDR: it's not the actual best tool for discovery.

 

[JTCat]

If you want to find all this information, why not use FTLinx instead? You can enter in your IP Range (example: 192.168.0.1-255) and it will populate the entire range and include all network cards in this range with their subnets. It will browse those too and list everything on those networks along with the IP they use.

Or you can also use SystemFerret, if someone wants to provide a link.

 

[chelton]

If you want to search for all devices with specific protocols ie find all Ethernet/ip devices on a network NMAP is great tool to have. NMAP is very flexible, being able to search and find if specific ports are open.

 

[DaimondKing]

In case you want to check and search for individual fixtures with individual protocols. NMAP, seems to be the best solution. It provides information about open ports on the network, while also allowing you to check them.