Reproducing PROFINET in the Lab: Discovery, AR Establishment, and Cyclic RT Boundaries

Описание и применение

Создана воспроизводимая лаборатория PROFINET с использованием Linux‑namespaces и p‑net, позволяющая исследовать открытые протоколы обнаружения, связи приложений и циклические RT‑кадры, выявив ограничения открытого стека.

Задача

Reproducing PROFINET behavior in a controlled lab environment to understand observable protocol surfaces and identify limits of open‑source implementations.

Результат

Established a repeatable PROFINET lab that captures discovery, application‑relation, and cyclic RT traffic. Identified limitations in the open‑source stack (e.g., station‑name write protection) and documented the boundary where packet construction no longer guarantees endpoint behavior.

Рабочий процесс

• Set up Linux network namespaces for controller and device
• Deploy p-net stack in device namespace
• Capture DCP and LLDP discovery traffic
• Verify station name, vendor ID, IP config, and LLDP topology
• Attempt station‑name update to test write protection
• Capture DCE/RPC over UDP 34964 for AR/IOCR/AlarmCR blocks
• Analyze request/response UUIDs, opnums, and association
• Capture cyclic RT frames with EtherType 0x8892
• Document packet fields, timing, and endpoint behavior
• Review security implications of discovered surfaces

Доказательства

The first phase established the identity and Layer 2 visibility of the device under test.

Источник

The device continued reporting: rt-labs-dev. The update did not take effect.

Источник

The packet capture showed a controller-to-device request followed by a device-to-controller response.

Источник