How does it work in practice? Is it using a protocol like LLDP?
Not sure about G.hn powerline devices, but the HomePlug AV powerline specification does have a "HomePlug Management Protocol" (see chapter 11) which is accessible through the Ethernet side of those devices. You can query their status, reboot them, change the network keys, etc.
HomePlug Management Protocol is not IP-based; it uses its own Ethertype 0x88e1. Most commands can be broadcast, or sent to a special "Nearest HomePlug device" MAC (it's pretty unlikely that the same ethernet would be directly attached to two powerline bridges at once), or sent to a specific device's MAC address. It's completely unauthenticated, so anyone on the same VLAN can reconfigure all of your HomePlug adapters.
Enumeration is done by asking the nearest device for a list of network members – not by querying them individually.
The protocol also has a facility for relaying commands over powerline to HomePlug devices which are not currently participating in the network. (This is where you need the "device access keys" printed on each adapter.)
Additionnaly, is there any way to get this mapping using free/open-source (and vendor-agnostic) softwares?
Most HomePlug AV software is vendor-agnostic to some extent. You can most likely use the same adapters with Netgear software, TP-Link software, and TrendNet software.
(Though, another thing about "vendor-agnostic" is that basically all vendors just use the same HomePlug AV chips made by Qualcomm. You're not actually talking to a Netgear device – you're talking to a QCA device in a Netgear-branded box. And I believe most of the HomePlug AV software actually do use QCA-specific commands, they just happen to be the same on all devices.)
Qualcomm actually publish an open-source set of command-line tools, open-plc-utils, which can give you most of the same features. You won't get a fancy map with that, but you don't really need one – an HPAV network is flat, with all devices directly talking to each other. (From what I know, HPAV does not have mesh/relay facilities like G.hn does.) Notice that the map in Genie is just a star with no complexity to it...
To ask the nearest HPAV adapter to give you a list of devices on the network (as well as their roles, speeds, and nearest Ethernet device), use
plcstat -m or
plcstat -t or
plctool -m, all doing mostly the same thing:
$ plcstat -i wlan0 -m local
NID 9A:09:7C:A3:D1:47:0E SNID 008
STA TEI 002 MAC 34:E8:94:6C:E2:xx BDA 48:5D:60:xx:xx:xx
CCO TEI 001 MAC 34:E8:94:6C:E6:xx BDA FF:FF:FF:FF:FF:FF TX 009 RX 009
To get the PHY error statistics, use
plcstat -s CSMA-ALL -d both. To reboot a bridge that tends to get stuck, use
To get the local device's Parameter Information Block, use
plctool -I – among other things, this will give you the PBKDF1 hash of the network's NMK, which can then be programmed into another device using
plctool -M or