To gain an understanding of the way in which
PROFINET devices communicate with one
another over Ethernet.
• To learn how to capture the PROFINET
Frames using Wireshark®.
• To see how Wireshark® can be used to analyse
the captured frames to gain an understanding
of the various protocols.
• This is a topic covered in more detail in the
Certified PROFINET Engineers Course
IAC 2024 - IA Fast Track to Search Focused AI Solutions
PROFIBUS frame analysis - Peter Thomas of Control Specialists
1. A Demonstration
of PROFINET
Frame Analysis
using
Peter Thomas
Control Specialists Ltd
www.controlspecialists.co.
uk
An Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
2. 2
Objectives
• To gain an understanding of the way in which
PROFINET devices communicate with one
another over Ethernet.
• To learn how to capture the PROFINET
Frames using Wireshark®.
• To see how Wireshark® can be used to analyse
the captured frames to gain an understanding
of the various protocols.
• This is a topic covered in more detail in the
Certified PROFINET Engineers Course
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
3. 3
What is Wireshark?
• Wireshark® is a network protocol analyser.
It lets you capture and interactively browse
the traffic running on a computer network.
• It is not dedicated to PROFINET and as
such cannot be compared to ProfiTrace.
• It is free to download and available from
www.wireshark.org
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
4. 4
The need for Real Time
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
• Normal, office-like, Ethernet communication, as defined in
IEEE 802.3, is non-deterministic, i.e. the time to transmit a
message from one device to another, and then receive a
response, is undefined and cannot be guaranteed.
• Industrial Automation Control Systems require
Deterministic or “Real Time” Communications.
• Software and/or hardware solutions allow IEEE 802.3 to be
deterministic and operate in Real Time.
• Remote I/O (typical PLC) applications generally require
guaranteed responses in the order of 5-10mS.
• Motion Control applications are even more demanding
requiring cycle times of <1mS.
5. 5
What is PROFINET
• It is an Industrial Ethernet Protocol.
• Unlike conventional, office-like, Ethernet,
PROFINET is deterministic meaning that it
is capable of supporting guaranteed cycle
times.
• There are two “real time” variants of
PROFINET, RT for conventional PLC
applications (Typ 10mS) and IRT for High
Speed applications (Typ 250µS but 31.25µS
ASICS have been developed).
• Although considered to be the modern-day
alternative to PROFIBUS DP, PROFINET is
NOT PROFIBUS over ETHERNET.
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
9. 9
Frame Capturing – Mirrored Ports
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
10. 10
Frame Capturing – Mirrored Ports
Switch A – Port 2
(IM153-3 & WAGO)
Switch B – Port 2
(IM153-3 ONLY)
LAN LAN
TO/FROM CPU
TO/FROM IM153-3
TO/FROM WAGO
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
11. 11
Frame Capturing – ProfiTap
USBX
TO/FROM IM153-3
TO/FROM CPU
TO/FROM WAGO
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
12. 12
Scope of this workshop
• Wireshark® can be used to capture and
analyse PROFINET traffic during the
following events:-
– Start-Up
– Data Exchange
– Loss of Module
– Loss of Communications
– Duplicate Device Name
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
13. 13
Equipment used in this workshop
• Siemens S7 PLC Hardware & Switches.
• Wago IO
• ProfiTap from Procentec
• Wireshark® Network Protocol Analyser.
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
14. 14
Siemens – Hardware Configuration
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
15. 15
IEEE 802.3 EtherNet Frame
40 – 1500 BYTES
DATA
SOURCE
MAC
6 BYTES
DEST
MAC
ETHER
TYPE
FRAME
CHECK
SEQ
ETHER TYPE EXAMPLES
0800: Internet Protocol (IPV4)
0806: ARP
8892: PROFINET
88CC: LLDP
Format / Contents dependent
upon the value of the
ETHER TYPE
ETHERNET HEADER ETHERNET TRAILER
Note – VLAN Tags (Bandwidth Control / Prioritisation),
IFG (Inter Frame Gap), Preamble and
SFD (Start Frame Delimiter) bytes not shown.
ETHERNET FRAME
6 BYTES 2 BYTES 4 BYTES
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
16. 16
PROFINET Frame
SOURCE ADDRESS DESTINATION ADDRESS ETHERTYPE
PROFINET IO DATA CYCLE COUNTER DATA STATUS
FRAME ID
TXFR STATUS
ETHERTYPE 8892 = PROFINET, FRAME ID 8000 = REAL TIME CLASS 2
-- APPLICATION PROTOCOL DATA UNIT STATUS --
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
17. 17
PROFINET Frame (CPU to OUTPUTS)
SLOT 1
SLOT 2
SLOT 3
SLOT 4
IOPS SLOT 3/4
DIG OUT DATA
DAP
DAP = DEVICE ACCESS POINT (IO DEVICE STATUS) 00 = BAD, 80 = GOOD
IOPS = IO PROVIDER STATUS (DATA STATUS @ CPU) 00 = BAD, 80 = GOOD
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
18. 18
Common Protocols seen on PROFINET
• PNIO-DCP – Device Name / IP Address Assignment
• PNIO-CM – Start-up Services between an IO
Controller and each IO Device.
• PNIO – Cyclic IO Data Exchange
• PN-PTCP – Time Syncronisation
• PNIO-AL – Acyclic Alarms / Events
• ARP – IP Address – MAC Address Lookup
• LLDP – Device Identity & Properties.
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
21. 21
Protocol Usage: Start-up to Data Exchange
Assign Device Name *
PNIO-DCP
/ ARP Assign IP Address
Establish Connection
PNIO-DCP
or LLDP
PNIO-CM
PNIO Cyclic Data Exchange
IO Device confirms Name SET
IO Device confirms IP Address SET
Connection Established
* DEVICE NAME ASSIGNMENT
Device Names can be set up Manually,
prior to connecting to the network, or
Automatically on power-up.
Manual name assignment uses PNIO-DCP
and tools such as the Primary Set-Up Tool
from Siemens or Netilities from Procentec.
Automatic name assignment uses the
LLDP protocol and requires the use of a
PROFINET Topology Configuration Tool.
Primary Setup Tool
www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)
Determine MAC Address