Lots of ARP traffic from a PanelView

[Stonent]

We have one PanelView that is generating about 67% of all packets on it's subnet. Approximately 49 ARP requests per second. I believe it may be a PanelView Plus 1000 (I was told it runs Windows CD).

We have a second PanelView which I have not seen personally (So I don't have the model) that's also scanning constantly but at a much much lower rate. I suspect they are very close as they both have a FactoryTalk Viewpoint screen that shows when you try to access them over the network from a web browser (followed by a message that FTV ME is not running)

I was also told that they can manage PLCs from it as well, so it sounds like it can run RSLINX.

I suspect it's constantly scanning over and over again for what it can see. The device is in an area where they would be unlikely to suddenly have a need to manage some PLCs from it.

Wireshark captures show it looks like it's just going through all the IP addresses in the scope (255.255.254.0) which is a little over 500; over and over again.

Can that constant ARPing be disabled or dialed down?

 

[Stonent]

FYI we did figure this out this afternoon. It was Universal Plug and Play was enabled on the PV. We went into the windows control panel and then services and de-selected it and rebooted the PV and it went away. We located another PVP1000 that was doing the same thing and cleared it as well.

If you're interested in seeing what that traffic looks like, here's a wireshark filter that will show it

UDP && HTTP

Anything showing as Rockwell Automation would be something that could be being very chatty. The constant ARPing went away as well with this.

 

[Ken Roach]

Great find, and thanks for posting !

I've never seen that enabled by default on a PV+, but I haven't been looking for it specifically either. I do a lot of Wireshark analysis on RA-based automation networks but that's a new one to me.

Thanks again for posting the resolution of the issue.

 

[James Mcquade]

Stonent,

I spoke with the other programmer about these units and we have several of them. He said he didn't know how to get there.

Please detail how you got to the windows screen so we can turn this setting off.

thanks,
james

 

[bernie_carlton]

Search the screen manual for "UPnP"

In one (Panelview Plus 6) it was accessed from the Windows Desktop (if you can get to it, there were also directions about that) - 'Control Panel' - 'Services'

 

[The Plc Kid]

Just to add.

Unless you need UPnP disable it on PC's and routers /firewalls as it can be a huge security risk. Even when UPnP is needed port forwarding is still a better alternative.

Yes it's also very chatty.Around 2% of the worlds home routers are vulnerable to attach becuase of poor UPnp implementations. If you use it make sure your router firmware is patched to correct it and your OS is patched to correct it.

In most cases at home you are best served by disabling it.

 

[arlenjacobs]

Starting with PanelView Plus 6, the UPnP server is enabled. That lets you plug your PVP into your computer with a USB cable for easy programming.... but you already found what happens on wireshark.


page 87 UPnP is enabled by default
page 103 is the easy way to enable/disable that
http://literature.rockwellautomation.com/idc/groups/literature/documents/um/2711p-um006_-en-p.pdf


If you have tech connect access, Rockwell has that issue listed in their knowledgebase
"505268 - PanelView Plus 6 & PanelView Plus 7 terminals broadcast SSDP packets on Ethernet network"