EtherNet/IP

What you can build

• Watch a drive fault before the line stops

  The client consumes the drive's input assembly. When the fault bits change, the operator names the drive from its Identity object and EDS and posts the notice with the fault word.

  With Predictive Maintenance, Line Downtime

• Find every device after a network change

  A ListIdentity broadcast returns each device's identity. The operator compares the list with yesterday's, flags devices that vanished or changed revision, and lists the ones whose EDS no longer matches.

  With Integration Health, Data Freshness

• Fix a duplicate address

  Devices with Address Conflict Detection (RFC 5227) report a conflict. The operator proposes a new IP through the TCP/IP Interface object for the device you pick, sent once after approval.

  With Alarm Triage

• Read the counters that predict a cable failure

  The Ethernet Link object keeps error counters per port. The operator trends them and proposes an inspection for the port whose errors climb.

  With Predictive Maintenance, Sensor Health

Requirements

• IP reach to each device on TCP port 44818 (0xAF12); every EtherNet/IP device accepts at least two TCP connections there
• UDP reach on port 2222 (0x08AE), and switches with IGMP Snooping if devices produce multicast I/O
• The EDS file for each device, matched by vendor ID, product code, and major revision, to know its connections and parameters
• For CIP Security devices, a certificate or pre-shared key enrolled for this client and, where used, credentials under the CIP User Authentication Profile

Authentication

CIP Security (Volume 8) authenticates devices with X.509 certificates or pre-shared keys, using TLS (RFC 5246) for the TCP encapsulation, UCMM, and transport class 3 traffic and DTLS (RFC 6347) for transport class 0/1 I/O over UDP, with a CIP User Authentication Profile for users; devices without CIP Security accept any client that reaches the port.

Limits

• The CIP Networks Library (Volume 1 CIP, Volume 2 EtherNet/IP, Volume 8 CIP Security) is sold by annual subscription, not public download
• Devices without CIP Security accept unauthenticated explicit messages from any host that reaches port 44818
• Target-to-originator I/O may be multicast, which spreads across the subnet unless switches support IGMP Snooping
• Unconnected explicit messaging draws on limited node resources and suits only irregular, infrequent requests

Questions and answers

What is the difference between explicit and implicit messaging?

Explicit messages carry addressing and service information that tells the receiver what to do; they use TCP port 0xAF12 with the SendRRData (unconnected) or SendUnitData (connected) encapsulation commands. Implicit, or I/O, messages carry only data on a connection whose meaning both ends already know, over UDP port 0x08AE.

Do I need the ODVA specification to talk to a device?

Volume 1 and Volume 2 are sold by ODVA on an annual subscription. The public PUB00123 book describes the object model, encapsulation, and EDS structure. A device's EDS file, an ASCII text file with a [Device] section, identifies it and lists its connections.

Is EtherNet/IP traffic authenticated?

Only with CIP Security. It uses TLS for TCP-based traffic and DTLS for UDP-based I/O, authenticates devices with X.509 certificates or pre-shared keys, and offers a CIP User Authentication Profile and an EtherNet/IP Confidentiality Profile. Devices without it accept any reachable client.