Intercepting PLC Traffic

J

Thread Starter

jarbar

We would like to be able, outside Rockwell's RSView32 software, to monitor and intercept network traffic to and from our PLC controllers. When certain signals come from certain controllers, we would like to take specific action.

I have a small "packet sniffer" application which is allowing us to view the contents of the TCP packets coming to and from Rockwell's RSView32.

Problem is, the contents of these packets isn't exactly clear-text instructions that are easily decipherable to the untrained eye.

Call me naive, but I'd just hoped against hope that maybe these TCP packets would make sense on their own (much the way HTTP and other traffic does). I figured that a given controller telling RSView "I'm on" or "I'm off" might not be a very verbose message, and might just be human-readable. Who knows for sure until you've gotten in and tried?

Well, now I've tried, and the packet data is sure enough pretty cryptic.

Could anyone give me some pointers on how I might figure out the protocol or formatting involved, and begin picking my way down the path toward converting these TCP conversations into something meaningful? I have lots of URLs and protocol information, but nothing that's actionable so far.

By the way, we're fully licensed and legit Rockwell users. This isn't some ploy to avoid purchasing some legit software. We'd just like to passively listen to what our controllers are telling RSView.

The idea of writing new code in-process in VBA to do this, with the risk of possibly bringing down one of our production programs, well, that just doesn't appeal to us. Not like the idea of just passively listening to the controllers talk and occasionally updating a database does.

Can anyone give us a push toward making sense of these TCP packets? Toward taking the streams of bytes that I'm "sniffing" to/from RSView, and making heads or tails of them?

Thanks very, very much.
 
Well the whole purpose of MMI is to display what your controllers are doing. Seems redundant to go to the trouble of seeing what is going on under the sheets.
 
If you are using RSView you are probably also using RSLinx Pro or Gateway for communications. If this is the case, you could set up an Excel spreadsheet to read specific PLC address information via NetDDE pointed at RSLinx. This would not eliminate the use of the I/O server but would be a way to observe the raw data.
 
Top