Industry consortium
POWERLINK
A deterministic industrial Ethernet using a managing node to schedule access on an isolated segment.
N/A — Layer 2Ethernet Layer 2Encryption: No
How it works
The managing node polls controlled nodes in a strict cycle; asynchronous phases carry non-real-time traffic.
Communication patternManaging node → controlled nodes each cycle.
Fact sheet
TransportEthernet Layer 2
PortsN/A — Layer 2
AuthenticationNone
PurdueLevel 1 – Level 0
EnvironmentsDeterministic machine control
DevicesManaging node, Controlled node, Drive
IndustriesManufacturing, Food & Beverage
Why should I care?
Understanding POWERLINK is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Cyclic exchange
- Asynchronous services
- SDO configuration
Security concerns
- No authentication; relies on physical isolation of the segment
What normal looks like
- Constant cycle, fixed node list
What deserves attention
- Node list changes
- Cycle jitter without a process cause
Hunting ideas
- new-device-control-zone
Defensive controls
- Keep segments physically isolated
- Alarm on node inventory change
Related ATT&CK for ICS techniques
T0842
Sources & further reading