Can network monitoring see an S7 PLC being stopped?
Yes, when the stop command travels over the network in S7comm, the protocol Siemens S7 controllers use for programming and diagnostics. S7comm is not encrypted, so a passive sensor that receives a copy of the traffic can decode the request as a stop, together with the computer that sent it and the time. A stop made with the controller's own switch or front panel never crosses the network, so no sensor sees it. Newer controllers can use a protected successor protocol, S7comm-plus; ask us before relying on NetSenX for that traffic. From the Pro plan, NetSenX decodes S7comm requests into command names such as a PLC stop, a variable write or a program block download and raises an S7comm command alert, from a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port, without sending anything to the PLC. It informs your engineers; it does not block the command.
Read next
Related questions
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.