PLC Messaging Itself?

[krakenfan69]

Hey guys. Got a strange one. Was sent to a site where the VNC access is very poor. The IT has assisted and a Wireshark report shows data requested from the MAC address of the L33ER being broadcast out to the switch asking "who has 192.168.1.1" (Not the actual IP address) The IP it is requesting data from is ITSELF! They eventually time out and let the VNC connection happen but it is still pretty poor. The Ethernet radios have a great signal strength. I can find no instance of a message instruction in the code. I don't see any Produce / Consume tags. Any hints as to how to try to find where this request is generated form inside the PLC?

 

[dmroeder]

I don't think a MSG would send out an ARP request, only things in the I/O tree would. And ARP requests by themselves wouldn't impact the performance, they're just too few and far between. Edit: in my case 44 bytes ever ~30 seconds

My guess, there is something in the tree that is configured to have the same IP address as the PLC. For fun, I added a generic module that has the same IP address as my controller (192.168.1.10). It will send an ARP request asking who has that address.

 

[idiotsecant]

So the VNC connection starts working when the self-ARP requests stop? Can you paste a screenshot of the hardware tree?

 

[krakenfan69]

Here you go. It appears the VNC just eventually can get through. Not specifically after the ARP stops.

 

[Ken Roach]

This isn't the controller "messaging itself". It's a "Gratuitous ARP" probe, being used by the controller to update the switches it's connected to and to detect duplicate IP addresses on the LAN.

>The Ethernet radios have a great signal strength.

If there's one statement I never trust, it's "there's nothing wrong with the radios".

There are lots of things that can cause poor remote access performance. Wireshark is a great tool, but don't get distracted by a handful of ARP packets.

 

[Contr_Conn]

This is also used to detect duplicate IP address. If Wireshark shows ARP “…Tell 0.0.0.0” then this is it.

 

[idiotsecant]

This is also used to detect duplicate IP address. If Wireshark shows ARP “…Tell 0.0.0.0” then this is it.

I haven't ever seen a node doing this in the wild. Is this common? If it was I imagine i'd see a lot of those sort of requests in regular ARP traffic but I don't think I have.

 

[Contr_Conn]

I haven't ever seen a node doing this in the wild. Is this common? If it was I imagine i'd see a lot of those sort of requests in regular ARP traffic but I don't think I have.

This is used for 20+ years in Logix and EtherNet/IP. Always been there, all RA modules do that.