I recently experimented with monitoring communication between a PLC and an HMI using port mirroring.
I had heard that a managed switch such as the NETGEAR GS308Ev4 can mirror Ethernet packets, allowing them to be captured and analyzed on a PC. I decided to try this out.
The motivation came from a past experience where I connected around 15 PLCs using EtherNet/IP. At that time, some PLCs occasionally disappeared from the network. Unfortunately, I had no effective tools to understand what was actually happening on the network.
This experiment was partly to learn how to properly analyze network traffic and at least be able to observe what is happening when similar problems occur.
PLC and GOT Connection
A PLC and a GOT (HMI) communicate via Ethernet.
To monitor their communication, a managed switch can be inserted between them.
In this setup:
- Port 1 → PLC
- Port 2 → GOT
- Port 8 → PC for packet capture
The switch is configured so that the packets from ports 1 and 2 are mirrored to port 8, where a PC can capture and analyze the traffic.
Hub (Switch) Setting
The switch comes with a configuration tool.
As shown in the screenshot, the configuration simply mirrors the packets from ports 1 and 2 to port 8.
One thing to note:
The NETGEAR website sometimes redirects to a Japanese support page where the download does not work properly. In my case, I asked ChatGPT to provide a direct download link to the tool. Without that workaround, downloading the utility might be a bit difficult.
Packet Capture
The network traffic can be captured using an application called Wireshark.
With Wireshark, you can capture packets on the mirrored port and inspect the communication between the PLC and the HMI. By analyzing the captured packets, it becomes possible to understand what is happening on the network.
It can also be helpful to feed screenshots of Wireshark into tools like ChatGPT to help interpret the packet data.
Thoughts on a Past Network Issue
In the earlier situation where multiple PLCs were connected, my guess is that the packet size or traffic volume became too large, causing the communication cycle to slow down.
At that time I did not fully understand what was happening, but I suspect the EtherNet/IP communication was using multicast, and the issue may have been mitigated by switching to unicast communication.
Conclusion
Today, many industrial devices communicate using Ethernet-based protocols such as EtherNet/IP and EtherCAT.
When troubleshooting network-related issues during commissioning, having a small managed switch that supports port mirroring can be very helpful.
Keeping such a switch available for diagnostics is probably not a bad idea.