Industry consortium
CIP (Common Industrial Protocol)
An object-oriented application layer shared by EtherNet/IP, DeviceNet and ControlNet. Behaviour is defined by objects, services and attributes rather than by the transport.
Depends on carrierApplication layer over EtherNet/IP, DeviceNet, ControlNetEncryption: Depends on profile
How it works
Clients address a device's object model (class / instance / attribute) and invoke services such as Get_Attribute_Single or Set_Attribute_Single.
Communication patternClient service request → object instance → response.
Fact sheet
TransportApplication layer over EtherNet/IP, DeviceNet, ControlNet
PortsDepends on carrier
AuthenticationOptional
PurdueLevel 2 – Level 0
EnvironmentsDiscrete and hybrid automation
DevicesPLC, Drive, I/O module, Robot controller
IndustriesManufacturing, Automotive
Why should I care?
Understanding CIP (Common Industrial Protocol) is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Get/Set attribute
- Reset
- Start / Stop services
- Connection management
Security concerns
- Service-level access control varies widely by device generation
- Attribute writes can alter device behaviour
- Legacy media (DeviceNet/ControlNet) is unmonitored in most sites
What normal looks like
- A stable set of services used by tooling
- Consistent object classes queried
What deserves attention
- Unusual service codes from non-engineering hosts
- Broad class/instance enumeration
Hunting ideas
- unauthorized-plc-programming
- ot-network-scanning
Defensive controls
- Use CIP Security-capable devices where the lifecycle allows
- Restrict configuration paths to engineering zones
Related ATT&CK for ICS techniques
T0843T0855
Sources & further reading