System for analyzing an industrial control network
A system may be provided in which an industrial control network may be discovered and characterized such that useful networking data may be presented to a user and/or monitored for events. By configuring an interrogator device to send a “generic” message to ranges of network locations, presences of devices at particular locations may be determined. The generic message may direct any of numerous devices types to provide a response including multiple parameters. The interrogator may store such parameters in “data records,” and may advantageously send periodic collections of data records, or “data sets,” to a processing manager. The processing manager, in turn, may communicate with one or more data structures to format, enrich and/or monitor the networking data to more conveniently and reliably capture and maintain networks and connected devices.
1. A system for analyzing an industrial control network, comprising:
an interrogator having a network interface configured to communicate with a plurality of device types, the interrogator executing a program stored in a non-transient medium to discover a first-level device on a first-level network by sending a generic message readable by each of the plurality of device types, the generic message being configured to direct a device to identify its device type, then send a specific message to the first-level device based on the device type to discover a second-level network connected to the first-level device, then discover a second-level device on the second-level network by sending a generic message readable by each of the plurality of device types via the first-level device, wherein each message is configured to direct a device to provide a response including a plurality of parameters, and wherein each generic message is sent to a plurality of network locations to determine presence of a device at each network location; and
a processing manager in communication with the interrogator, the processing manager executing a program stored in a non-transient medium operable to:
receive a plurality of data records from the interrogator, each data record including a plurality of parameters for each device providing a response, the plurality of data records forming a data set;
format the data set by populating a plurality of predetermined fields for each data record, the plurality of predetermined fields including a first field indicating a parameter for a device of a data record and a second field indicating a network location for the device of the data record; and
graphically display the predetermined fields.
2. The system of claim 1 , wherein the parameter indicated by the first field is a serial number for the device, and the network location indicated by the second field is an Internet Protocol (IP) address for the device.
3. The system of claim 1 , further comprising a data structure relating a plurality of predetermined values to the plurality of device types, wherein the processing manager is further operable to communicate with the data structure to identify a device type and a related predetermined value according to a parameter for a device of a data record.
4. The system of claim 3 , wherein the plurality of predetermined fields include a third field, and further comprising the processing manager being operable to format the data set by populating the third field indicating the related predetermined value for each device.
5. The system of claim 1 , further comprising the processing manager being operable to monitor the data set for a predetermined condition.
6. The system of claim 1 , wherein the generic message is a Common Industrial Protocol (CIP) explicit message containing addressing and service information directing a receiving device to provide information for identifying a device type, and wherein the response provides a CIP identity object, and the plurality of parameters are attributes of the CIP identity object.
7. The system of claim 1 , wherein the processing manager communicates with the interrogator through a defined port in a firewall.
8. The system of claim 7 , wherein the processing manager communicates with the interrogator at a higher level of communication than the interrogator communicates with a device.
9. The system of claim 1 , wherein the interrogator includes a transaction manager operable to send the data set to the processing manager, and wherein the transaction manager assigns a unique identifier to the data set.
10. The system of claim 9 , wherein the interrogator periodically generates new data sets, and wherein the transaction manager sends new data sets to the processing manager with unique identifiers.
11. The system of claim 1 , wherein the first-level device is a gateway or a router, and the second-level device is at least one of: a processor, a drive, a network card, and an I/O module.
12. The system of claim 1 , wherein the interrogator is an automation controller.
13. The system of claim 1 , further comprising a library data structure relating messages to a plurality of device types, wherein the specific message is determined from the library data structure for a device type determined from the generic message.
14. A method for analyzing an industrial control network including an interrogator having a network interface configured to communicate with a plurality of device types, the interrogator executing a program stored in a non-transient medium to discover a first-level device by sending a generic message readable by each of the plurality of device types, the generic message being configured to direct a device to identify its device type, then sending a specific message to the first-level device based on the device type to discover a second-level network connected to the first-level device, then discover a second-level device on the second-level network by sending a generic message readable by each of the plurality of device types via the first-level device, wherein each message is configured to direct a device to provide a response including a plurality of parameters, and wherein each generic message is sent to a plurality of network locations to determine presence of a device at each network location, and a processing manager in communication with the interrogator, the method comprising:
receiving a plurality of data records from the interrogator, each data record including a plurality of parameters for each device providing a response, the plurality of data records forming a data set;
formatting the data set by populating a plurality of predetermined fields for each data record, the plurality of predetermined fields including a first field indicating a parameter for a device of a data record and a second field indicating a network location for the device of the data record; and
graphically displaying the predetermined fields.
15. The method of claim 14 , further comprising communicating with a data structure relating a plurality of predetermined values to the plurality of device types to identify a device type and a related predetermined value according to a parameter for a device of a data record.
16. The method of claim 15 , wherein the plurality of predetermined fields include a third field, and further comprising formatting the data set by populating a third field indicating the related predetermined value for each device.
17. The method of claim 14 , further comprising monitoring the data set for a predetermined condition.
18. The method of claim 14 , wherein the interrogator includes a transaction manager operable to send the data set to the processing manager, and further comprising the interrogator periodically generating a new data set, and the transaction manager sending each new data set to the processing manager with a unique identifier.