Wireshark + Rockwell

[kellian]

Sounds similar to an issue we just had on site with produced/Consumed tags. Our network team traced it to how some of the managed switches handled multicast traffic. in this case the switches were required to have an IP address in the Multicast vLan to ensure correct handling of Multicast traffic. So could be worth checking how your switches handle Multicast and check their config against that information. Or if possible replace with unmanaged switches and see if the error goes away.

 

[WillM]

Just wanted to respond with an update on this as the help was great.

I ended up looking into the web pages of the Cisco managed switches between the devices. What I found in the error logs was the Gigabit link between 2 of the switches was going down at the same time as the alarm and re establishing its self.

Annoyingly this was quick enough to disrupt the plc comms but not enough for the SCADAs that relied on that connection to alarm. I'd decided this must be ok for that reason early on.

I had the main link replaced and this has cleared the problem for a couple of weeks.

Whilst very frustrating, this has been a great learning exercise in the most complex area of our plant.


Thanks again for all the help