Industry consortium
EtherCAT
A processing-on-the-fly industrial Ethernet fieldbus achieving very low cycle times, normally on a dedicated physical segment.
N/A — Layer 2Ethernet Layer 2 (EtherType 0x88A4)Encryption: No
How it works
A master sends a frame that each slave modifies in transit; the frame returns to the master within a cycle.
Communication patternMaster frame traverses the slave chain and returns.
Fact sheet
TransportEthernet Layer 2 (EtherType 0x88A4)
PortsN/A — Layer 2
AuthenticationNone
PurdueLevel 1 – Level 0
EnvironmentsHigh-speed motion control
DevicesMotion controller, Servo drive, I/O terminal
IndustriesManufacturing, Pharmaceutical
Why should I care?
Understanding EtherCAT is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Cyclic process data
- Mailbox services (CoE, FoE)
- Distributed clocks
Security concerns
- FoE file access can update device firmware
- Segment assumes a trusted physical chain
- Not routable — physical tampering is the main risk
What normal looks like
- Fixed slave count and topology
- Constant cycle timing
What deserves attention
- Slave count change
- FoE transfers outside maintenance
Hunting ideas
- unauthorized-firmware-change
Defensive controls
- Physical segment protection
- Master-side topology change alerting
Related ATT&CK for ICS techniques
T0857T0842
Sources & further reading