> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# EtherNet/IP

> Rockwell/Allen-Bradley CIP over Ethernet — industrial protocol exposure and attack patterns.

EtherNet/IP (Ethernet Industrial Protocol) carries **CIP** (Common Industrial Protocol) over standard Ethernet. It is the primary language of many **Rockwell Automation / Allen-Bradley** PLCs, drives, and I/O modules, common in North American manufacturing.

## How EtherNet/IP works

CIP objects model device identity, assembly data, and motion/IO. EtherNet/IP uses TCP/UDP **port 44818** (and related CIP ports). Explicit messaging reads/writes attributes; implicit messaging carries cyclic I/O. Authentication and encryption depend on product generation and configuration — many plants still run open CIP on plant VLANs.

## How attackers abuse it

* **List Identity / List Services** — fingerprint PLCs and firmware
* **Unconnected Send** — probe and invoke services without a full session
* **Data table reads/writes** — exfiltrate or alter process values (**T0855**)
* **Program download attempts** — higher-impact engineering operations when credentials or CIP Security are absent

## What Reyhford observes

EtherNet/IP appears alongside Modbus and S7 in multi-protocol scans, especially from infrastructure that fingerprints industrial estates at scale. Reyhford tags these events with protocol metadata so manufacturing SOCs can separate Rockwell-relevant IoCs from Modbus noise.

Related: [Modbus](/protocols/modbus), [Siemens S7](/protocols/s7).