Some proprietary softwares (like router softwares, or proprietary desktop applications to manage powerline devices) offer a way to enumerate powerline adapters.

For example, on Netgear Genie, we have a nice map of powerline adapters: enter image description here

How does it work in practice? Is it using a protocol like LLDP?
More precisely, considering the fact that this map is 100% generated from a desktop connected to the network (with no a-priori knowledge of the powerline devices), how does it enumerate these powerline devices?

Additionnaly, is there any way to get this mapping using free/open-source (and vendor-agnostic) softwares?


How does it work in practice? Is it using a protocol like LLDP?

Not sure about G.hn powerline devices, but the HomePlug AV powerline specification does have a "HomePlug Management Protocol" (see chapter 11) which is accessible through the Ethernet side of those devices. You can query their status, reboot them, change the network keys, etc.

HomePlug Management Protocol is not IP-based; it uses its own Ethertype 0x88e1. Most commands can be broadcast, or sent to a special "Nearest HomePlug device" MAC (it's pretty unlikely that the same ethernet would be directly attached to two powerline bridges at once), or sent to a specific device's MAC address. It's completely unauthenticated, so anyone on the same VLAN can reconfigure all of your HomePlug adapters.

Enumeration is done by asking the nearest device for a list of network members – not by querying them individually.

The protocol also has a facility for relaying commands over powerline to HomePlug devices which are not currently participating in the network. (This is where you need the "device access keys" printed on each adapter.)

Additionnaly, is there any way to get this mapping using free/open-source (and vendor-agnostic) softwares?

Most HomePlug AV software is vendor-agnostic to some extent. You can most likely use the same adapters with Netgear software, TP-Link software, and TrendNet software.

(Though, another thing about "vendor-agnostic" is that basically all vendors just use the same HomePlug AV chips made by Qualcomm. You're not actually talking to a Netgear device – you're talking to a QCA device in a Netgear-branded box. And I believe most of the HomePlug AV software actually do use QCA-specific commands, they just happen to be the same on all devices.)

Qualcomm actually publish an open-source set of command-line tools, open-plc-utils, which can give you most of the same features. You won't get a fancy map with that, but you don't really need one – an HPAV network is flat, with all devices directly talking to each other. (From what I know, HPAV does not have mesh/relay facilities like G.hn does.) Notice that the map in Genie is just a star with no complexity to it...

To ask the nearest HPAV adapter to give you a list of devices on the network (as well as their roles, speeds, and nearest Ethernet device), use plcstat -m or plcstat -t or plctool -m, all doing mostly the same thing:

$ plcstat -i wlan0 -m local
 NID 9A:09:7C:A3:D1:47:0E SNID 008
 STA TEI 002 MAC 34:E8:94:6C:E2:xx BDA 48:5D:60:xx:xx:xx
 CCO TEI 001 MAC 34:E8:94:6C:E6:xx BDA FF:FF:FF:FF:FF:FF TX 009 RX 009

To get the PHY error statistics, use plcstat -s CSMA-ALL -d both. To reboot a bridge that tends to get stuck, use plctool -R.

To get the local device's Parameter Information Block, use plctool -I – among other things, this will give you the PBKDF1 hash of the network's NMK, which can then be programmed into another device using plctool -M or -J.

  • 1
    Looks like my powerline adapter (PLP1000) is using a broadcom chip and open-plc-utils is only supporting QCA chips, this would explain why plcstat doesn't return anything. (BTW cannot restrain myself to thank you for this super clear answer!)
    – Phylliade
    Feb 28 at 9:31
  • 1
    I see -- in that case, try all of the plcstat or plctool options; I think some of them actually issue generic management commands, while others use QCA-specific ones. (For example, I think this was the difference between -m vs -t.) You might also want to try the older int6kstat tool which is part of the same package (though that too is aimed at the Qualcomm-absorbed Atheros/Intellon INT6xxx, not Broadcom).
    – user1686
    Feb 28 at 9:41
  • 1
    No luck to get an answer from the adapter using any combination of open-plc-utils commands. However, this third-party implementation, pla-util, worked to communicate with my PLP1000!
    – Phylliade
    Feb 28 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.