Two LEDs can narrow an EtherNet/IP outage faster than a laptop—provided their pattern is recorded before anyone cycles power. On the CompactLogix 1769-L35E, Module Status and Network Status describe different layers and should be read together.

MS and NS indicators describe different layers of an EtherNet/IP fault and should be recorded before power is cycled.

The 1769 CompactLogix controller manual is the authoritative decoding reference. Generic EtherNet/IP charts are useful, but product-specific meanings and actions take priority.

MS answers whether the port is healthy

An unlit MS points first to loss of controller power. Flashing green indicates standby with no IP address while operating in BOOTP mode. Steady green is normal port operation.

Red patterns shift the investigation toward the controller or port. The manual associates steady red with reset, controller fault, power-up self-test or an unrecoverable condition, depending on timing. Flashing red can indicate a firmware update; do not interrupt a legitimate update.

NS describes the network relationship

An unlit NS means the port is not initialized or has no IP address. Flashing green means an IP address exists but no CIP connections are established. That can be normal or evidence that expected originators are absent.

Steady green means at least one CIP connection is established without timeout. Flashing red indicates one or more timed-out connections. Steady red points to duplicate IP. These states tell engineers where to look; connection error codes and switch evidence still determine the root cause.

Preserve evidence before changing anything

Photograph MS, NS, controller status and switch-port LEDs with a timestamp. Record whether the fault followed a download, switch change, shutdown or IP assignment. Check address ownership and the controller path without writing changes.

If NS is steady red, remove the duplicate or correct the plan. If NS flashes red, identify which I/O, HMI or produced/consumed connection timed out. Replacing a switch at random can erase counters while leaving the conflict intact.

Build first-fault capture outside the cabinet

Mirror connection faults into a first-out alarm and retain managed-switch events where possible. For older L35E systems, connection capacity and obsolescence belong in the lifecycle review. The Rockwell OT cybersecurity assessment report also shows why network evidence and asset context should be managed together.

Our view: the useful life of an LED pattern is often less than a minute because responders reset the system. A photograph and timestamp should be the first action.

Questions engineers ask before making the change

What does flashing green NS mean?

The port has an IP address but no CIP connections are established. That may be normal or evidence an expected connection is missing.

What does steady red NS indicate?

The controller manual identifies steady red NS as a duplicate IP condition. Correct the conflict before replacing hardware.

Should the controller be power-cycled first?

Usually no. Record the pattern and related evidence first; a power cycle can erase the best clue.