Open / standardized
PROFINET DCP
The discovery and commissioning layer of PROFINET. DCP is how an engineering tool finds every PROFINET device on a cell, reads its identity, and assigns its station name and IP address. It carries no authentication and runs below IP, so it is invisible to any control that only inspects TCP ports.
How it works
A client broadcasts a DCP Identify request; every PROFINET device on the layer-2 segment answers with its station name, IP, MAC, vendor and device ID. Set requests then write the station name, IP configuration or a factory reset, and a Signal request flashes the device LED for physical identification.
Communication patternEngineering tool or IO controller → layer-2 broadcast across the cell → all PROFINET devices respond.
Fact sheet
Why should I care?
Understanding PROFINET DCP is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Identify (broadcast discovery)
- Get device parameters
- Set station name
- Set IP configuration
- Signal / flash LED
- Factory reset
Security concerns
- Anyone with layer-2 access to the cell can enumerate every device with a single broadcast — a complete asset inventory handed to an attacker in one frame
- Set requests are unauthenticated: renaming a station or reassigning its IP breaks the IO controller's device relationship and drops the process
- A DCP factory reset clears device configuration without touching the controller program
- Layer-3 firewalls and port-based conduit rules never see it, so it is commonly unmonitored
What normal looks like
- DCP Identify bursts during commissioning and device replacement
- The IO controller resolving station names after a power cycle
- Steady-state cells that are almost silent on DCP
What deserves attention
- DCP Identify-All broadcasts from a host that is not the IO controller or a known engineering laptop
- Any Set Name / Set IP outside a change window
- DCP traffic sourced from a new MAC address on the cell
- Factory reset or repeated Signal requests with no maintenance activity
Hunting ideas
- ot-network-scanning
- new-device-control-zone
- unauthorized-plc-programming
Defensive controls
- Terminate every cell in its own VLAN and keep DCP inside it — DCP does not route, so segmentation is genuinely effective here
- Monitor with a layer-2 capable sensor on a SPAN of the cell; EtherType 0x8892 is trivially filterable
- Enable port security / sticky MAC on SCALANCE and equivalent cell switches and disable unused ports
- Alarm on any DCP Set operation, and record the expected station-name inventory as a baseline to diff against