Hi,   Could anybody help me to setup explicit communication using the DATA_EXCH block without being a CIP expert? I read the docs here: https://www.se.com/ng/en/faqs/FA409179/ The example of the CIP request in the last page of the pdf is the following:     The meaning of the registers - as I figured out - are: 00: 0252 - I don't know what the 0x02 means, the 0x52 is the service code of the unconnected send request. 01: 0620 - 0x06 is the class ID of the connection manager, but what is the byte 0x20? 02: 0124 - I suppose 0x01 is the connection manager instance number, what is the instance segment 0x24? 03: 1007 - timeout ticks & priority/tick time, does it depend on the partner or this value will be ok? 04: 000C - number of bytes from the next register to the "Data: 0001" row. 05: 044C - 0x04 is the number of words from the next register to the end of the tag name, 0x4C is the Rockwell read tag service. 06: 0591 - 0x05 is the number of characters in the tag name, 0x91 is a constant to read a tag by name. 07: 6170 - from here comes the name of the tag. 08: 09: 10: 0001 - number of elements to read. 11: 0001 - 0x00 reserved, 0x01 route path size. Does it mean we use one word from the next register (EIPRequest[12]). 12: 0001 - 0x00 route path address, is this the slot number? 0x01 is the port. Why is this 0x01? Is it always 0x01?   If I try this example with a 1769 Rockwell PLC and created the "parts" variable. A Wonderware CIP DA server can read it, but the response in the M580 PLC is: 00D2 - ???? 0006 - by the docs this means "Only part of the expected data was transferred"   On the address pin of the DATA_EXCH block the value is: ADDMX('0.0.3{192.168.0.161}UNC.CIP').   I cannot guess the exact meaning of the following bytes: 00 MSB: 0x02 - request path size 01 LSB: 0x20 - segment, path segment 02 LSB: 0x24 - instance segment 03: 0x1007 - timeout ticks & priority/tick time 11: 0x0001 - route path size 12: 0x0001 - route path address, route path port   Any help would be appreciated ... View more