Industry consortium
PROFINET
Industrial Ethernet for cyclic real-time I/O with acyclic services for parameterisation and diagnostics. Discovery (DCP) operates at Layer 2 and can identify or rename devices.
34962–34964/UDP; 102/TCP for related engineeringEthernet (RT Layer 2, TCP/UDP for acyclic)Encryption: No
How it works
A controller establishes application relations with devices and exchanges cyclic RT frames; acyclic record read/write handles configuration.
Communication patternController ↔ device cyclic frames + acyclic parameter services.
Fact sheet
TransportEthernet (RT Layer 2, TCP/UDP for acyclic)
Ports34962–34964/UDP; 102/TCP for related engineering
AuthenticationOptional
PurdueLevel 2 – Level 0
EnvironmentsEuropean-style discrete and process automation
DevicesPLC, I/O device, Drive, HMI
IndustriesManufacturing, Automotive, Food & Beverage
Why should I care?
Understanding PROFINET is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Cyclic I/O
- Record read/write
- DCP identify / set name & IP
- Alarms & diagnostics
Security concerns
- DCP set operations can alter device identity on a flat Layer 2 network
- Real-time frames are unauthenticated
- Broad Layer 2 domains increase blast radius
What normal looks like
- Fixed controller/device relations
- No DCP set operations outside commissioning
What deserves attention
- DCP identify sweeps
- Device name or IP changes
- New MAC in the I/O VLAN
Hunting ideas
- ot-network-scanning
- new-device-control-zone
Defensive controls
- Per-cell VLANs and port security
- Disable unused switch ports
- Baseline the device MAC inventory
Related ATT&CK for ICS techniques
T0842T0846
Sources & further reading