Managed Switch Ethernet Features For Industrial Automation

3rd September, 2026.

In this post, we will see the concept of the features generally used in a managed switch.

In numerous industrial automation applications, managed Ethernet switches are used to simply connect PLCs, HMIs, SCADA systems, drives and remote I/O devices. Once communication is established, many of their advanced capabilities go unused. However, a managed switch can do much more than connect devices to a network. Features such as VLANs, port mirroring, traffic prioritization, network redundancy, multicast control, diagnostics and security can be implemented to improve network reliability and troubleshooting. Unfortunately, many automation engineers are unaware of how and when to use such functions. This article provides an overview of the important features of a managed Ethernet switch, explaining what they do and where they can be practically used in industrial automation networks.

How Does a Managed Switch Work?

A managed switch takes incoming Ethernet data from connected devices and decides where that data must be sent out. To do this, the switch constantly builds a MAC address table to store which device is linked to which physical input. For instance, a Programmable Logic Controller (PLC) is connected to Port 1 and a Human Machine Interface (HMI) is connected to Port 2. The switch would discover these connections and forward data from PLC to the HMI by looking at the destination’s Media Access Control (MAC) address, and it will send the data to Port 2.

Most importantly, a managed switch offers the engineer to control and monitor this process and determine how the data flows. Based on the switch’s configuration, Virtual Local Area Networks (VLANs) can be set up to separate traffic, Quality of Service (QoS) can be applied to prioritize data, and multicast traffic can be shaped. Various security measures can also be deployed, such as blocking specific connections or providing alternate paths for failed connections or recording network events for analysis. The switch can constantly monitor the status of its ports and connections. An engineer can view if a port is connected or disconnected and the speed of each connection. It is possible to know how much data has been transferred and if any communication errors have occurred.

This data is crucial in troubleshooting issues such as intermittent communication problems on a PLC, faulty cable issues, network loops, or traffic congestion on the network. As a result, a managed switch is a controllable network device that can manage how Ethernet data is handled in the network. A switch offers configurations for engineers to monitor and troubleshoot network traffic.

Port Configuration And Management:

One of the first things an engineer should know is that any individual port on a managed switch can be configured and monitored individually. A port is more than just a place to plug in an Ethernet cable, because the switch itself provides information and control over what's connected to that individual port. For example, an engineer can identify which device is connected to each individual port and check whether the link is active, the speed of the connection and monitor errors or traffic on that port. Ports can also be enabled or disabled as required. Giving meaningful names or descriptions to each port (such as PLC, HMI, SCADA, VFD-01 or Remote I/O) can be of enormous value for troubleshooting, particularly if a panel has multiple network connections.

Port configuration can even be valuable in commissioning and maintenance work, because if there is an unexplained traffic issue in a network, the individual port can be monitored or temporarily disabled to isolate and identify the source of the problem. Meanwhile, unused ports can be disabled to prevent an unauthorized device being connected to the control network. Therefore, before using the advanced features of a managed-switch, engineers should have a good understanding of individual ports and be able to configure and monitor them properly. Good port management provides a useful overview of connected devices and can offer insight into how things are communicating and if there are any problems at any connection.

VLAN - Separating Network Traffic

VLAN stands for Virtual Local Area Network. It allows a managed switch to partition one physical Ethernet network into separate logical networks. This is useful when different groups of devices need to be kept logically separate, but connected via the same physical switch. For example, let's imagine a control panel that has PLCs, remote I/O, HMIs and an engineering PC. In this case, VLAN 10 could be used for the automation/control network and VLAN 20 could be used for engineering or IT devices. The switch will keep the traffic of these two VLANs logically separated. For example, broadcast traffic generated within VLAN 20 will not normally be forwarded to the devices belonging to VLAN 10.

The PLC may not be aware that VLANs are being used. In a simple case, the PLC, HMI and remote I/O could use their normal IP addresses and communicate via ports that are assigned to the same VLAN. The VLAN configuration is mostly up to the switch, which is configured accordingly. It is also important to note that a VLAN does not dictate a different IP address or subnet. A Layer 2 switch can have a management IP address, but VLANs are used to separate Ethernet traffic. If devices in different VLANs need to communicate, a router or Layer 3 device is required to route traffic between them. For example, a plant could use VLAN 10 for PLC/control devices and VLAN 20 for SCADA or engineering systems. If communication between these networks is required, routing can be configured with appropriate security rules.

Therefore, VLANs should not be created just because the switch exposes the feature. They are useful if there is a real requirement to separate network traffic, organise network zones, reduce unnecessary traffic or improve network security.

Port Mirroring - Capturing Network Traffic

Port mirroring is a troubleshooting capability that enables the switch to mirror the communication from one switch port to another switch port. The original communication continues on the original path, while a copy of the communication is sent to the destination port where it can be viewed with a diagnostic device such as a laptop running Wireshark.

For example, suppose the PLC connected to Port 1 is communicating with the SCADA computer, but the communication is intermittent. Rather than disconnecting the PLC or making any changes to the network communications, the engineer can mirror the traffic from the PLC to a diagnostic laptop. The engineer can configure the switch so that a copy of all PLC traffic is sent to Port 8 instead of the original destination port. The laptop on Port 8 can then view the Ethernet packets and troubleshoot problems such as intermittent PLC communication failures or excessive PLC traffic.

The port mirroring capability is particularly valuable because the engineer can observe the PLC communication without interrupting the PLC system under test. It is one of the most valuable features to know about if normal PLC diagnostics are not sufficient to understand what is happening on the Ethernet network.

QoS - Giving Priority To Important Traffic

QoS stands for Quality of Service. It is a way to define what traffic types will be prioritized on a network when there are mixed traffic types on the network. An industrial network may carry PLC communication, HMI data, SCADA traffic and engineering laptop traffic. The engineer can configure the switch to prioritize PLC control traffic over less-critical traffic types.

The switch classifies the traffic to determine which type matches the rules, and then gives higher precedence to prioritized traffic during bandwidth contention. In the case where an engineering laptop is transferring a large file while PLC communication is also occurring, the switch can prioritize PLC traffic.

QoS does not increase the available network bandwidth. It simply prioritizes available resources during contention. Therefore, the engineer first specifies the priority requirements, and the switch automatically enforces them during operation.

IGMP Snooping - Controlling Multicast Traffic

IGMP stands for Internet Group Management Protocol. Before you get to know what IGMP Snooping is, it is a good idea to get to know what multicast is. Typically, in communication, one device sends information to another specific device. When we are talking about multicast communication, one device sends the same information to a group of devices that are interested in receiving it. 

For example, imagine one device is sending multicast data to a particular group. There is more than one PLC or network device, which is interested in receiving this traffic, but others aren't. The issue is that your switch, if it doesn't know what devices are interested in what traffic, can send this traffic to many unnecessary ports, resulting in unnecessary traffic on your network.

IGMP Snooping allows the managed switch to listen to what IGMP messages are being passed between devices, so that it knows which ports have devices that want multicast traffic. In a scenario, the switch has learned that the PLC 1 and PLC 2 want the multicast traffic, while the PC doesn't want any. It subsequently forwards the multicast packets to the necessary ports rather than unnecessarily to the PC.

This is helpful in reducing unnecessary traffic on your network and not having multicasts unnecessarily sent to devices that don't want them. IGMP Snooping can be particularly useful in larger industrial Ethernet networks, where there is likely to be multicasts taking place. In short, while IGMP lets the network know what devices want what multicasts, IGMP Snooping lets the switch watch these messages and forward the multicasts where they need to go.

RSTP - Avoiding Network Loops

RSTP stands for Rapid Spanning Tree Protocol. It was designed to avoid network loops that can happen in case of having more than one physical path between two switches.

Imagine that we have two switches connected with two Ethernet cables instead of one. The extra cable can introduce a network loop that will make Ethernet frames circulate endlessly between the switches, creating large amounts of unnecessary traffic. RSTP helps to avoid such situations by detecting the redundant link and putting one of the connections into a blocking state. When the previously used link becomes unavailable, RSTP can react to the change and bring up the backup connection.

Thus, using RSTP introduces two major benefits. First of all, it helps to avoid network loops. Second, it allows an extra path that will be used automatically once the primary link breaks. For an automation engineer, such a protocol can be used in cases when switches are interconnected with multiple links. The choice of the specific technology to provide such redundancy should be driven by the requirements of the industrial network and available technologies on both sides of the connection.

Port Statistics And Diagnostics - Identifying Network Issue

A managed switch constantly collects data about the status of each Ethernet port. This information can be retrieved using the switch diagnostic interface and is particularly useful in the case of intermittent communication problems of a PLC, HMI or SCADA device.

For instance, an engineer may suspect that a PLC occasionally loses communication with an HMI. Rather than making changes to the PLC program immediately, the engineer should check the switch port connected to the HMI. By reviewing the statistics of this port, it may be possible to identify the source of the intermittent communication issues. Some of the parameters that can be found in the port statistics include: link status, connection speed, received packets, transmitted packets, packet errors and discarded packets. A steadily rising error counter on a specific port may be an indication of a faulty Ethernet cable, connector, network device or even a physical connection issue. This does not necessarily prove that the fault lies in the cable, however it provides the engineer with valuable insight that should be taken into account. 

Thus, the diagnostics of a switch port should be among the primary tools used for troubleshooting an industrial Ethernet network. It allows one to distinguish whether the issue is likely to be physical, communication-related or caused by excessive network traffic, rather than relying solely on PLC or HMI diagnostics.

SNMP - Monitoring The Switch Remotely

SNMP is the short form for Simple Network Management Protocol. In short, it allows the remote monitoring of a managed switch.

Think of a scenario, where a plant has 20 Ethernet switches in different control panels. For checking if everything is working properly, the engineer may have to go to each switch and do some checks. With SNMP, the monitoring can be done by a separate machine, collecting information from all switches. For example, it could detect that one switch lost the connection on one of its ports (a.k.a Ethernet cable unplugged). The switch provides information about its state (ports status, failures, traffic and other data) and can report (send SNMP messages) about the issues that occurred.

In other words, the SNMP technology helps the maintenance or network team to have a remote insight about the condition of their managed switches, thus eliminating a tiresome site visit to check each switch in a plant/control panel.

Configuration Backup and Restoration

A managed switch possesses a variety of configuration settings including the management IP address, VLAN settings, port configuration, as well as redundancy settings and other network parameters. The loss of these settings during a switch failure can significantly complicate the replacement process. In this regard, the switch configuration must be backed up after commissioning as well as whenever significant modifications take place. In case of a failure of the original switch, the configuration can be restored to a replacement device, drastically reducing the commissioning time.

For example, instead of manually configuring 20 ports, VLAN assignments and other settings on a replacement switch, an engineer would be able to restore the previously saved configuration where applicable.

As such, configuration backup must be considered as part of switch commissioning and maintenance, not as an option to be considered after a switch has failed. The backup should also be stored securely and properly identified with the corresponding switch and project.

I have covered the general theory on features used in managed switch. I have also not attempted to cover all the topics related to it, as it can vary from case to case. Once you are familiar with this type of technology, you can easily troubleshoot any issues related to it.

Thank you for reading the post. I hope you liked it and will find a new way in this type of technology.

Written by Viral Nagda, Industrial Automation Engineer with 12+ years of experience…