Industry consortium
HART-IP
Carries HART commands over IP, typically between WirelessHART gateways or multiplexers and plant asset management systems.
5094 (TCP/UDP)TCP / UDPEncryption: Optional
How it works
A HART-IP client session carries standard HART commands to devices behind a gateway.
Communication patternAsset management server → gateway → field devices.
Fact sheet
TransportTCP / UDP
Ports5094 (TCP/UDP)
AuthenticationOptional
PurdueLevel 2 – Level 1
EnvironmentsWirelessHART gateways, Plant asset management
DevicesWirelessHART gateway, Asset management server, Multiplexer
IndustriesOil & Gas, Chemical, Pharmaceutical
Why should I care?
Understanding HART-IP is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Device discovery
- Read variables
- Configuration commands
- Burst mode data
Security concerns
- Gateways bridge unprotected field networks to IP
- Configuration reach across hundreds of devices from one host
What normal looks like
- A single asset management client per gateway
What deserves attention
- New client to gateways
- Configuration commands outside maintenance
Hunting ideas
- protocol-write-activity
- new-device-control-zone
Defensive controls
- Place gateways in a controlled zone
- Restrict client hosts explicitly
Related ATT&CK for ICS techniques
T0857T0855
Sources & further reading