Industry consortium
EtherNet/IP
CIP carried over standard Ethernet. Explicit messaging uses TCP 44818 for configuration and diagnostics; implicit (I/O) messaging uses UDP 2222 for cyclic real-time data.
44818/TCP (explicit), 2222/UDP (implicit I/O)TCP + UDPEncryption: Optional
How it works
Devices register a CIP session, then exchange explicit request/response messages or establish a cyclic implicit connection for deterministic I/O data.
Communication patternController ↔ adapter cyclic I/O; workstation → controller explicit messaging.
Fact sheet
TransportTCP + UDP
Ports44818/TCP (explicit), 2222/UDP (implicit I/O)
AuthenticationOptional
PurdueLevel 2 – Level 1
EnvironmentsDiscrete manufacturing, Packaging, Automotive
DevicesPLC, PAC, HMI, Drive, I/O adapter
IndustriesManufacturing, Food & Beverage, Pharmaceutical
Why should I care?
Understanding EtherNet/IP is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Identity object queries
- Read/write CIP attributes
- Connection establishment
- Program upload/download (via vendor tooling)
Security concerns
- Older device profiles ship without authentication on explicit messaging
- Controller mode and configuration changes may be reachable over the same path as I/O
- Broad multicast/implicit traffic makes flat networks noisy and hard to baseline
What normal looks like
- Fixed controller↔adapter connection pairs
- Cyclic I/O at a constant RPI
- Explicit messaging from a small set of workstations
What deserves attention
- Explicit messaging from an unknown host
- Identity object sweeps across a subnet
- Connection resets around unplanned times
Hunting ideas
- unauthorized-plc-programming
- ot-network-scanning
- controller-mode-change
Defensive controls
- Segment I/O traffic into its own cell zone
- Restrict explicit messaging to named engineering hosts
- Enable controller change detection features where supported
Related ATT&CK for ICS techniques
T0843T0858T0846
Sources & further reading