Industry consortium
DeviceNet
CIP over CAN for device-level connectivity; common in older Rockwell-centric plants and gradually displaced by EtherNet/IP.
N/ACANEncryption: NoLegacy
How it works
A scanner polls device nodes; CIP objects define device behaviour.
Communication patternScanner ↔ device nodes.
Fact sheet
TransportCAN
PortsN/A
AuthenticationNone
PurdueLevel 1 – Level 0
EnvironmentsDevice-level networks in discrete plants
DevicesI/O block, Drive, Sensor
IndustriesManufacturing, Automotive
Why should I care?
Understanding DeviceNet is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- I/O polling
- Explicit CIP messaging
- Configuration
Security concerns
- Physical-access dependent, no security controls
- Little monitoring visibility
What normal looks like
- Stable node inventory
What deserves attention
- Node count changes
- Bus faults at unexplained times
Hunting ideas
- new-device-control-zone
Defensive controls
- Cabinet security
- Scanner diagnostics as telemetry
Related ATT&CK for ICS techniques
T0842
Sources & further reading