Skip to main content
EtherNet/IP (Ethernet Industrial Protocol) carries CIP (Common Industrial Protocol) over standard Ethernet. It is the primary language of many Rockwell Automation / Allen-Bradley PLCs, drives, and I/O modules, common in North American manufacturing.

​
How EtherNet/IP works

CIP objects model device identity, assembly data, and motion/IO. EtherNet/IP uses TCP/UDP port 44818 (and related CIP ports). Explicit messaging reads/writes attributes; implicit messaging carries cyclic I/O. Authentication and encryption depend on product generation and configuration — many plants still run open CIP on plant VLANs.

​
How attackers abuse it

  • List Identity / List Services — fingerprint PLCs and firmware
  • Unconnected Send — probe and invoke services without a full session
  • Data table reads/writes — exfiltrate or alter process values (T0855)
  • Program download attempts — higher-impact engineering operations when credentials or CIP Security are absent

​
What Reyhford observes

EtherNet/IP appears alongside Modbus and S7 in multi-protocol scans, especially from infrastructure that fingerprints industrial estates at scale. Reyhford tags these events with protocol metadata so manufacturing SOCs can separate Rockwell-relevant IoCs from Modbus noise. Related: Modbus, Siemens S7.