Encyclopedia
Industrial protocols
How each protocol works, what normal traffic looks like, which behaviours deserve attention, and which controls actually help.
Most industrial protocols were designed for deterministic control on trusted networks, not for hostile ones. Assume no authentication and no encryption unless the protocol page says otherwise, and defend the conduit rather than the packet.
N/A — serial
Modbus RTU
A serial master/slave protocol published in 1979 and still extremely common in field wiring. It carries register and coil reads/writes with no authentication, no integrity protection and no encryption.
502/TCP
Modbus TCP
Modbus RTU's application layer carried over TCP/IP, normally on port 502. It is trivially readable, unauthenticated by default and one of the most widely deployed industrial protocols.
44818/TCP (explicit), 2222/UDP (implicit I/O)
EtherNet/IP
CIP carried over standard Ethernet. Explicit messaging uses TCP 44818 for configuration and diagnostics; implicit (I/O) messaging uses UDP 2222 for cyclic real-time data.
Depends on carrier
CIP (Common Industrial Protocol)
An object-oriented application layer shared by EtherNet/IP, DeviceNet and ControlNet. Behaviour is defined by objects, services and attributes rather than by the transport.
Carrier dependent
CIP Safety
A functional-safety profile layered on CIP using a black-channel approach: safety integrity is protected end-to-end with sequence numbers, timeouts and CRCs independent of the underlying network.
20000/TCP (commonly)
DNP3
A telemetry protocol widely used between control centres and remote substations or pump stations. It supports unsolicited reporting, time-stamped events and, optionally, Secure Authentication (DNP3-SA).
2404/TCP
IEC 60870-5-104
Telecontrol protocol used between control centres and substations, mainly outside North America. Base standard has no authentication or encryption; IEC 62351 defines security extensions.
102/TCP for MMS; GOOSE and SV are Layer 2
IEC 61850
A substation automation standard defining a data model plus several communication profiles: MMS for client/server, GOOSE for fast peer-to-peer status, and Sampled Values for measurements.
102/TCP
MMS (Manufacturing Message Specification)
A client/server messaging standard used as the IEC 61850 station-bus profile and by several automation platforms over TCP port 102.
N/A — EtherType 0x88B8
GOOSE
Generic Object Oriented Substation Event messages carry time-critical protection status peer-to-peer on the station/process bus, republished rapidly on state change.
135/TCP plus dynamic high ports
OPC Classic (DA/HDA/AE)
The original Windows COM/DCOM-based OPC family. Functional but firewall-hostile because of dynamic port allocation, and dependent on legacy Windows authentication settings.
4840/TCP (default)
OPC UA
The platform-independent successor to OPC Classic with an information model, single well-known port and built-in security modes supporting signing, encryption and certificate-based authentication.
34962–34964/UDP; 102/TCP for related engineering
PROFINET
Industrial Ethernet for cyclic real-time I/O with acyclic services for parameterisation and diagnostics. Discovery (DCP) operates at Layer 2 and can identify or rename devices.
N/A — fieldbus
PROFIBUS
A widely installed fieldbus predating industrial Ethernet, still carrying a large share of process I/O in older plants.
102/TCP
S7 Communication (S7comm / S7comm-plus)
The communication used between Siemens SIMATIC controllers, HMIs and engineering software over ISO-on-TCP port 102. Newer S7comm-plus generations add integrity and anti-replay protections that older S7-300/400 traffic lacks.
47808/UDP (BACnet/IP)
BACnet
The dominant building automation protocol. BACnet/IP on UDP 47808 is broadly deployed, frequently on shared corporate networks, and often internet-exposed by accident.
47808/UDP (0xBAC0)
BACnet/IP
The IP profile of BACnet, using BBMDs and foreign device registration to carry broadcasts across routed networks — which also extends discovery reach.
3671/UDP (KNXnet/IP)
KNX
A building-control standard for lighting, blinds and HVAC. KNX Secure adds authentication and encryption but legacy installations commonly run without it.
N/A — field wiring
HART
Digital communication superimposed on the classic 4–20 mA analog loop, used for device configuration, diagnostics and calibration data.
5094 (TCP/UDP)
HART-IP
Carries HART commands over IP, typically between WirelessHART gateways or multiplexers and plant asset management systems.
N/A / Ethernet for HSE
FOUNDATION Fieldbus
An all-digital fieldbus that can execute control function blocks in field devices themselves, common in large continuous process installations.
N/A
CAN bus
A broadcast, priority-arbitrated serial bus originally designed for vehicles and widely reused in mobile and machine automation.
N/A
CANopen
A higher-layer protocol on CAN defining an object dictionary, network management (NMT) states and PDO/SDO messaging for machine devices.
N/A
DeviceNet
CIP over CAN for device-level connectivity; common in older Rockwell-centric plants and gradually displaced by EtherNet/IP.
N/A — Layer 2
EtherCAT
A processing-on-the-fly industrial Ethernet fieldbus achieving very low cycle times, normally on a dedicated physical segment.
N/A — Layer 2
POWERLINK
A deterministic industrial Ethernet using a managing node to schedule access on an isolated segment.
1883/TCP (plain), 8883/TCP (TLS)
MQTT
A lightweight publish/subscribe protocol used heavily for industrial telemetry, often with the Sparkplug B specification to add a standard topic namespace and state management.
5672/TCP (plain), 5671/TCP (TLS)
AMQP
A general-purpose messaging protocol used industrially where richer routing, transactions and durability are needed than MQTT provides.
9600 (UDP/TCP)
Omron FINS
Omron's factory interface network service used for memory access, program operations and controller status across its controller families.
Configurable (commonly 5007 / 5562 depending on configuration)
Mitsubishi MC Protocol
MELSEC Communication protocol for device memory access between MELSEC controllers and host systems; port assignment is configuration dependent rather than fixed.
48898/TCP
Beckhoff ADS/AMS
Automation Device Specification messaging used by TwinCAT systems for variable access, state control and engineering operations between AMS network IDs.
N/A — serial
IEC 60870-5-101
The serial predecessor to IEC 104, still used for remote telecontrol links where bandwidth is limited.
2222/TCP (CSP), 44818/TCP when tunnelled in CIP
PCCC / CSP
Rockwell Automation's legacy command set for SLC 500, PLC-5 and MicroLogix controllers. It predates EtherNet/IP and is still reachable on many brownfield sites, either natively over CSP on 2222/TCP or tunnelled inside CIP messages on 44818/TCP.
20256/TCP (PCOM), 20257/TCP (secondary), 5900/TCP for embedded VNC
PCOM
The proprietary protocol used by Unitronics all-in-one PLC+HMI controllers (Vision, Samba and UniStream families). It exposes operand and data-table access, and on many deployments sits directly on the internet on 20256/TCP — the condition behind the 2023 targeting of US water utilities.
N/A — layer 2, broadcast within the subnet
PROFINET DCP
The discovery and commissioning layer of PROFINET. DCP is how an engineering tool finds every PROFINET device on a cell, reads its identity, and assigns its station name and IP address. It carries no authentication and runs below IP, so it is invisible to any control that only inspects TCP ports.
502/TCP (Modbus function code 90 / 0x5A)
UMAS
Schneider Electric's proprietary engineering protocol for Modicon controllers — the M580, M340, Quantum and Premium families. It is how EcoStruxure Control Expert reads and writes controller programs, and it travels inside ordinary Modbus/TCP on 502 as function code 90, which means an environment that allows 'Modbus' also allows programming unless the function code is inspected.