Industry consortium
CANopen
A higher-layer protocol on CAN defining an object dictionary, network management (NMT) states and PDO/SDO messaging for machine devices.
N/ACANEncryption: No
How it works
An NMT master transitions nodes between states; PDOs carry cyclic process data and SDOs carry configuration.
Communication patternNMT master → nodes; cyclic PDO exchange.
Fact sheet
TransportCAN
PortsN/A
AuthenticationNone
PurdueLevel 1 – Level 0
EnvironmentsMachine control, Motion, Medical devices
DevicesDrive, I/O module, Motion controller
IndustriesManufacturing, Healthcare / Medical CPS
Why should I care?
Understanding CANopen is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- PDO process data
- SDO configuration
- NMT start/stop/reset
- Emergency messages
Security concerns
- NMT reset/stop commands affect machine state
- No sender authentication
What normal looks like
- Nodes in operational NMT state; steady PDO rates
What deserves attention
- Unexpected NMT state changes
- Emergency message bursts
Hunting ideas
- controller-mode-change
Defensive controls
- Physical bus protection
- Alarm on machine-level state changes from the controller side
Related ATT&CK for ICS techniques
T0858
Sources & further reading