Skip to Content

Register Login

Industry Online Support

Technical Forum

Navigation

Problems with port mirroring and fail-safe I/O

Created by: Lee T at: 8/29/2014 12:39 AM (4 Replies)

Rating (0)

Thanks 0

5 Entries

8/29/2014 12:39 AM	Rate (0)
Lee T Posts: 1 Rating: (0)	I am trying to monitor the ethernet traffic on an x-320 switch using port mirroring and Wireshark. As soon as I set up the mirrored port all of the ET200s nodes in the system went into an alarm state. The system uses an S7-300 FS, the X-320 switch, and seven ET200s I/O nodes. Six of the nodes are on umanaged switches in different pieces of equipment. The network also carries other ethernet traffic using, primarily EtherNet/IP. We are having mysterious network problems and I want to see how much load is being created by the EtherNet/IP devices. Using port mirroring for traffic analysis is well documented but nothing states situations where it would not work. Would port mirroring cause failures with fail-safe remote I/O? Perhaps a switch firmware bug? The firmware version on the switch is fairly old but I would like to avoid an upgrade if possible.
Lee T Posts: 1 Rating: (0)
Suggestion To thank Quote Answer

9/1/2014 8:57 AM	Rate (0)
Pittiplatsch Posts: 1368 Rating: (126)	Hello, the port mirroring is a function to analyze network traffic and should have no reaction to the normal Ethernet communication. The PC (with e.g.wireshark) is connected to the "mirror port". With FW <3.7.0, on "mirror port" only recording is possible, no communication to the devices. So...what is the error message of the faulty ET200 modules? Can you post this and a little draft of you network cabling? Thanks...
Pittiplatsch Posts: 1368 Rating: (126)
Suggestion To thank Quote Answer

9/1/2014 10:48 AM	Rate (0)
Marko Bursic Platinum Member Joined: 9/8/2009 Last visit: 7/17/2023 Posts: 1410 Rating: (153)	Why don't you isolate ethernet/ip <->profinet? It makes no sense to forward ethernet/IP traffic to ET200s, since they communicate with CPU via profinet RT/IRT protocol. IMO, this is kind of jamming, without any possible benefit (if there are any, please let me know).

Suggestion To thank Quote Answer

9/1/2014 1:18 PM	Rate (0)
fritz Diamond Expert Joined: 10/7/2005 Last visit: 11/1/2024 Posts: 3025 Rating: (1055)	Lee T Using port mirroring for traffic analysis is well documented but nothing states situations where it would not work. Hello Lee T port mirroring can unfortunately put quite a burden on your switch and lead to performance loss and drop of packets, which is something safety related messages don't take to lightly too (in other words, it can explain why your distributed safety network goes down once you enable port mirroring). Ethernet/IP (which some call a desease rather than a protocol) is traditionallyUDP and Multicast based and mirroring its traffic may very well be the straw that breaks theCamel's back in this case once you enable port mirroring. You unfortunetly are kind ofstuck in Heisenbergs uncertainty principle (i.e. your attempt to monitor things influences the realibility of your measurement). Apart from removing the Ethernet/IP traffic from the Network (I agree with Marko Bursicthat it has no business there), I'd also suggest you use a Network Tap (e.g. ProfiTap, located at your S7 PN port) instead of using port mirroring to analyse your Network, as a Tap does not suffer from the issues that affects port mirroring. I hope this helps and please let us know what you find.
	Cheers fritz The advice and opinion given in this thread is that of the author and does not necessarily reflect the views of I S Systems Pty Limited. To find out how I S Systems can help you with your automation needs please visit www.issystems.com.au.
Suggestion To thank Quote Answer

9/1/2014 10:46 PM	Rate (0)
Sprawl Posts: 58 Rating: (10)	Lee T We are having mysterious network problems and I want to see how much load is being created by the EtherNet/IP devices. I don't know a lot about EtherNet/IP, but if it is multicast only you don't need a mirror port at all. Plugging the PC into any switch port should be enough to trace that. The firmware version on the switch is fairly old but I would like to avoid an upgrade if possible. This is the very first thing i would change. Get 3.9.3, enable the "Monitor Barrier, see whether the same thing happens. Overall any mirror feature is forcing a switch to drop packages (assuming same link speed). You got two directions operating at 100Mbit (duplex, send/receive) tops. Thus for the send direction to the wireshark PC it would take a 200Mbit link. > If the total sum on the line is more than 100Mbit it will start dropping frames. The effect should be limited to the mirror port of course but that is one thing i wouldn't count on.
Sprawl Posts: 58 Rating: (10)	Last edited by: Sprawl at: 9/1/2014 10:47 PM
Suggestion To thank Quote Answer

|

Share this page:

Share this page on...

Follow us on