Reproducing PROFINET in the Lab: Discovery, AR Establishment, and Cyclic RT Boundaries

By RUGERO Tesla ( @404Saint ). I approached this research with the same general workflow I have used for the other industrial protocols in my lab. Start with the architecture, identify a usable implementation, reproduce the visible protocol behavior, inspect the traffic, and then move toward security-relevant experiments. PROFINET made that process more complicated than I expected. The first challenge was getting the laboratory into a useful state. I spent a considerable amount of time working through Linux namespaces, virtual interfaces, routing, and the behavior of the available open-source implementation. Once the environment was working, the next challenge appeared: some parts of PROFINET were easy to observe, while other parts depended on controller/device behavior that the available stack did not fully expose. That changed the shape of the research. I could still examine discovery, application-relation traffic, cyclic Real-Time framing, and crafted Layer 2 inputs. I simply had to be more careful about what each experiment actually established. The goal of this project became straightforward: Build a reproducible PROFINET laboratory, examine its observable protocol surfaces, and document the point where packet construction, implementation output, and verified endpoint behavior stop answering the same question. Laboratory Scope The laboratory used Linux network namespaces to isolate the controller and device sides of the experiment. The main implementation was p-net , supported by custom Python and Scapy-based harnesses, packet captures, and Wireshark/TShark analysis. The work followed five phases: DCP and LLDP discovery DCE/RPC application-relation traffic Cyclic Real-Time frame analysis Layer 2 traffic generation, netload, and malformed inputs A specification-driven review of PROFINET security mechanisms The first four phases involved direct laboratory experimentation. The final phase connected those observations to PROFINET’s historical Security Class model a