Reproducing PROFINET in the Lab: Discovery, AR Establishment, and Cyclic RT Boundaries

说明与用途

使用 Linux 命名空间和 p-net 堆栈构建了可重复的 PROFINET 实验室，详细研究了发现、应用关系和循环 RT 流量，并揭示了开源实现的局限性。

问题

Reproducing PROFINET behavior in a controlled lab environment to understand observable protocol surfaces and identify limits of open‑source implementations.

结果

Established a repeatable PROFINET lab that captures discovery, application‑relation, and cyclic RT traffic. Identified limitations in the open‑source stack (e.g., station‑name write protection) and documented the boundary where packet construction no longer guarantees endpoint behavior.

工作流

• Set up Linux network namespaces for controller and device
• Deploy p-net stack in device namespace
• Capture DCP and LLDP discovery traffic
• Verify station name, vendor ID, IP config, and LLDP topology
• Attempt station‑name update to test write protection
• Capture DCE/RPC over UDP 34964 for AR/IOCR/AlarmCR blocks
• Analyze request/response UUIDs, opnums, and association
• Capture cyclic RT frames with EtherType 0x8892
• Document packet fields, timing, and endpoint behavior
• Review security implications of discovered surfaces

证据

The first phase established the identity and Layer 2 visibility of the device under test.

来源

The device continued reporting: rt-labs-dev. The update did not take effect.

来源

The packet capture showed a controller-to-device request followed by a device-to-controller response.

来源