Open / standardized
KNX
A building-control standard for lighting, blinds and HVAC. KNX Secure adds authentication and encryption but legacy installations commonly run without it.
3671/UDP (KNXnet/IP)Twisted pair, powerline, RF, IPEncryption: Optional
How it works
Devices exchange telegrams on group addresses; KNXnet/IP tunnels or routes those telegrams over IP.
Communication patternGroup address telegrams broadcast to subscribed devices.
Fact sheet
TransportTwisted pair, powerline, RF, IP
Ports3671/UDP (KNXnet/IP)
AuthenticationOptional
PurdueLevel 1 – Level 0
EnvironmentsBuilding control, mainly Europe
DevicesRoom controller, Actuator, Sensor, IP gateway
IndustriesBuilding Automation
Why should I care?
Understanding KNX is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Group write / read
- Device programming via ETS
- Tunnelling
Security concerns
- Unsecured KNXnet/IP gateways reachable from IP networks
- Programming mode accessible with physical access
- Group addressing has no per-device authorisation in classic mode
What normal looks like
- Telegrams from known gateways
- No programming traffic outside commissioning
What deserves attention
- Internet-reachable 3671/UDP
- Unexpected device programming
Hunting ideas
- unexpected-internet-connectivity
Defensive controls
- Deploy KNX Secure where available
- Keep KNXnet/IP gateways off routable/exposed networks
Related ATT&CK for ICS techniques
T0846
Sources & further reading