Why does ML1400 send a TCP [RST] ?

[gazroobari]

Hi all,

I have my own driver to communicate with a MicroLogix 1400.

Please refer to the attached screenshot from Wireshark. 10.10.21.10 is my driver's host, and 192.168.1.192 is the ML1400.

The startup sequence to establish a connection & session with the PLC is correct I believe:

- In the grey highlight, client requests a connection to .192 via SYN and this is ack'd
- A session is registered, and forward open is successful
- There's a lot of stuff in green simply because I've also got an HTTP browser session open to the PLC to monitor its session table
- In between, spaced 8 seconds apart, are my two attempts to keep the connection alive by sending a List Identity request (as a ping, if you like). These are highlighted in pale blue.
- However, 16.5 seconds from the start of the grey highlight, and 16.4 seconds after sequence=115 ack=99, the controller sends back a [RST, ACK] and a callback from my socket code tells me that the session has been dropped.

The connection timeout for the PLC is configured as either 30 or 60 seconds, so I don't see how that's relevant here when the reset is happening only 17 seconds after it was established ?

However, presumably the PLC doesn't see the application-level "List Identity" request as a valid means of keeping the connection alive.

What is the correct mechanism to use that the PLC will accept as a keep-alive ?

 

[Ken Roach]

I am most familiar with List Identity being used as a broadcast command, and I know that in that context it doesn't use a CIP connection. When I captured RSLinx Classic browsing the network with List Identity, it used a Session Handle of zero and never opened a CIP Connection.

I believe that's by design (at least on the part of RSLinx) because you don't want background Linx browsing sessions to chew up CIP connection resources.

How often does your driver send a command to the MicroLogix ? Is your goal to keep the CIP session going perpetually and send a read or write on demand ?

 

[Ken Roach]

How often does your client stack send ordinary TCP Keepalives ? A quick look at the OPC Test Client reading nothing but the keyswitch mode from a ControlLogix every 80 seconds shows a TCP Keepalive every 8 seconds or so.

It might just be that the MicroLogix is shutting down the TCP connection because it's idle, and it doesn't have to do with the CIP application-level timeouts at all.