TwinCAT Test Connect probe dials the AmsNetId as an IP on the AMS port, so it always times out on real targets #863

Closed
opened 2026-11-11 12:06:04 -05:00 by dohertj2 · 1 comment
Owner

Found by the #755 read-only Test Connect gate against production press Z35474 on 2026-11-11 (AmsNetId 5.118.56.93.1.1, IP 10.201.23.227, TC3 port 851). The probe returns Ok=False, "Probe timed out after 10s", against a healthy, reachable press. Through the same in-process AMS router the probe's own ADS state read returns Run in 109–189 ms, and symbol upload and scalar reads work.

Cause: TwinCATDriverProbe.ExtractTarget runs a first-phase TCP reachability check before the ADS handshake, and it has two bugs:

  1. It dials the first four octets of the AmsNetId as an IP address. An AmsNetId is not an IP; here it dialled 5.118.56.93, an unrelated public internet host, so every Test Connect sends a connection attempt to a stranger.
  2. It dials the AMS port (801/851) as a TCP port. ADS over TCP is 48898.

As a result, Test Connect can't pass against any real TwinCAT runtime. TwinCATDriverProbeTests doesn't catch this, because it uses a local test listener on the "AMS port".

Fix: drop the first-phase TCP check, or point it at the local AMS router, and let the bounded ADS ReadState decide reachability. Correct the tests. Then rerun the Z35474 read-only probe gate (the harness and evidence are from #755).

ScadaBridge impact: none (AdminUI Test Connect only).

Found by the #755 read-only Test Connect gate against production press Z35474 on 2026-11-11 (AmsNetId `5.118.56.93.1.1`, IP 10.201.23.227, TC3 port 851). The probe returns `Ok=False`, "Probe timed out after 10s", against a healthy, reachable press. Through the same in-process AMS router the probe's own ADS state read returns Run in 109–189 ms, and symbol upload and scalar reads work. **Cause:** `TwinCATDriverProbe.ExtractTarget` runs a first-phase TCP reachability check before the ADS handshake, and it has two bugs: 1. It dials the first four octets of the **AmsNetId** as an IP address. An AmsNetId is not an IP; here it dialled `5.118.56.93`, an unrelated public internet host, so every Test Connect sends a connection attempt to a stranger. 2. It dials the **AMS port** (801/851) as a TCP port. ADS over TCP is 48898. As a result, Test Connect can't pass against any real TwinCAT runtime. `TwinCATDriverProbeTests` doesn't catch this, because it uses a local test listener on the "AMS port". **Fix:** drop the first-phase TCP check, or point it at the local AMS router, and let the bounded ADS ReadState decide reachability. Correct the tests. Then rerun the Z35474 read-only probe gate (the harness and evidence are from #755). ScadaBridge impact: none (AdminUI Test Connect only).
dohertj2 added the driver/twincatpriority:p2type:bug labels 2026-11-11 12:06:05 -05:00
Author
Owner

Done. The probe opens no socket of its own; it uses AdsClient.Connect + ReadStateAsync through the local AMS router, the same path as the driver. Live, read-only on production press Z35474: 'ADS state: Run' in 220 ms (it used to time out after 10 s). A regression test checks that the AmsNetId-derived address is never dialled. Pushed to master in e857135e..7a27ef1f; full suite green (20 projects, 0 failures, 0 warnings).

Done. The probe opens no socket of its own; it uses AdsClient.Connect + ReadStateAsync through the local AMS router, the same path as the driver. Live, read-only on production press Z35474: 'ADS state: Run' in 220 ms (it used to time out after 10 s). A regression test checks that the AmsNetId-derived address is never dialled. Pushed to master in `e857135e..7a27ef1f`; full suite green (20 projects, 0 failures, 0 warnings).
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#863