Hi, I’ve a request to write a script to monitor network traffic and detect the firmware version of the PLCNext. I read the advisories regarding the recent updates, which list a “2019.0 LTS” version. How is this represented in network traffic (i.e. ProfiNet, EthernetIP, LLDP) ? I don’t have a 2152 nearby unfortunately so can’t make PCAPs of my own. Rob
Hi Rob, Just so I’m clear on the requirement - you want to know the structure of every message on the network that could possibly contain the PLCnext Firmware version, from all possible protocols implemented by the PLC? If you just want to match a pattern from any message that might include the PLC firmware version, you could look for “2019.0”, or the ARP version “19.0.0.17548”. If you want to do an exact match on a complete string, then I will need to look into all possible protocols implemented on the PLC, whether they transmit the PLC FW version, and if so what exact string format each of them uses for the firmware version. Martin.