Ethernet IP

What is EtherNet/IP?

EtherNet/IP is an open industrial communication protocol that carries the Common Industrial Protocol (CIP) over standard Ethernet and TCP/IP, allowing PLCs, sensors, actuators, HMIs, drives and robots to exchange data in real time. The “IP” in the name stands for Industrial Protocol, not Internet Protocol, although EtherNet/IP does run entirely on IP. The protocol was introduced in 2001 and is managed by ODVA, the organisation that also maintains DeviceNet and CIP Safety. Accounting for an estimated 23% of all newly installed industrial network nodes (HMS Networks, 2025), EtherNet/IP is the most widely used Industrial Ethernet protocol in the world after PROFINET, particularly in plants built around Rockwell Automation controllers.

🕰️ How did EtherNet/IP come about?

Development started in the late 1990s in a technical working group of ControlNet International. In 2000 ODVA (originally the Open DeviceNet Vendors Association, founded in 1995) and ControlNet International signed a joint technology agreement, and in 2001 EtherNet/IP was officially published. Since 2009 the technology has been fully under ODVA, which now has more than 300 member companies.

The idea was simple: reuse the object model that already ran on DeviceNet (based on CAN) and ControlNet on unmodified Ethernet. An engineer who knows CIP can therefore configure devices on all three networks in the same way, and messages can even be routed between those networks through gateways.

Internationally, EtherNet/IP is standardised as Type 2 in IEC 61158 and as communication profile CP 2/2 within Communication Profile Family 2 (CPF 2) of IEC 61784. ControlNet (CP 2/1) and DeviceNet (CP 2/3) belong to the same family.

🧠 How does EtherNet/IP work?

EtherNet/IP uses the ordinary Ethernet and TCP/IP layers and puts CIP on top as the application layer. There are two kinds of messages:

• Explicit messaging - request/response traffic over TCP port 44818, for example to read diagnostics, change parameters or query a device’s identity. Reliable, but not time-critical.
• Implicit messaging - cyclic I/O data over UDP port 2222. Once a connection has been set up (the CIP Forward_Open service), the device sends its data at a fixed interval, the Requested Packet Interval (RPI), without each message having to be requested again.

Implicit messaging follows the producer/consumer model: one device produces data and one or more consumers receive it simultaneously, via unicast or multicast. This is more efficient than classic master/slave polling as used by Modbus. Because multicast floods the whole network unless it is contained, larger installations use managed switches with IGMP snooping or opt for unicast connections.

Every device is described in an EDS file (Electronic Data Sheet): a text file listing its parameters, I/O assemblies and connection options. Engineering software such as Studio 5000 imports this file to configure the device. ODVA conformance testing is meant to ensure that devices from different vendors work together.

🔧 What are the key features and typical values?

For motion applications, CIP Motion combines cyclic I/O with CIP Sync so that servo axes can be synchronised without a separate motion network. This makes EtherNet/IP suitable for motion control, although EtherCAT and PROFINET IRT generally achieve shorter and tighter cycle times.

🔁 How does ring redundancy with DLR work?

Device Level Ring (DLR) is the ODVA standard for ring redundancy at device level. Devices with two Ethernet ports and an embedded switch are daisy-chained into a ring, so each device does not need its own switch port.

• Ring supervisor - one supervisor sends beacon frames in both directions every 400 µs (default) and blocks one port to prevent a loop.
• Fault detection - if a cable or device fails, the beacons stop arriving and the supervisor unblocks its port.
• Recovery time - about 3 ms for a 50-node ring, fast enough that I/O connections with a normal RPI do not time out.

DLR heals a ring much faster than RSTP, which typically needs tens to hundreds of milliseconds after a topology change, but it only works within a single ring. For redundancy between switches and cells, RSTP or PRP is used alongside it, as described in the Converged Plantwide Ethernet architecture from Rockwell and Cisco.

🦺 What are CIP Safety and CIP Security?

CIP Safety adds functional safety using the black channel principle: safety data travels over the ordinary network but is protected by extra checks (CRCs, time stamps, unique connection identifiers) so that errors such as message loss, delay, corruption or misrouting are detected. CIP Safety is certified by TÜV Rheinland to IEC 61508 up to SIL 3 and is specified in IEC 61784-3-2. As a result, a safety PLC, emergency stops and light curtains can communicate over the same EtherNet/IP network as standard I/O.

CIP Security was published by ODVA at the end of 2015 as Volume 8 of the CIP specifications and protects the traffic itself:

• TLS for TCP traffic (explicit messaging) and DTLS for UDP I/O
• Device authentication using certificates or pre-shared keys
• Integrity profile (messages cannot be altered unnoticed) and confidentiality profile (encryption)

Support for CIP Security is growing, but many installed devices do not support it yet. Network-level measures therefore remain essential.

🔄 What is the difference between EtherNet/IP, PROFINET and Modbus TCP?

Because EtherNet/IP runs on standard TCP/UDP/IP, it can be routed (using unicast I/O) and to combine with IT traffic. PROFINET achieves better determinism by bypassing the IP stack, whereas Modbus TCP is above all simple and offers few management functions.

🏭 Where is EtherNet/IP used?

The ecosystem is centred on Allen-Bradley: ControlLogix and CompactLogix controllers from Rockwell Automation use EtherNet/IP as their standard network, configured with Studio 5000. Hundreds of other vendors also support the protocol, from Omron and Schneider Electric to ifm, Bosch Rexroth, ABB and Fanuc.

Typical applications:

• PLC communication with Remote IO, HMIs and other controllers
• Controlling variable frequency drives and servo drives in conveying and packaging lines
• Robot cells in automotive and assembly
• Data exchange with SCADA and MES, often via a gateway or OPC UA server
• Process industry - since November 2021 the specification supports Ethernet-APL, offering 10 Mbit/s over two wires, cable lengths up to 1,000 metres and intrinsically safe field devices in hazardous areas

🔐 How do you secure an EtherNet/IP network?

Standard EtherNet/IP has no authentication: anyone who can reach port 44818 can often query device information, change parameters or put a controller into program mode. Vulnerabilities such as CVE-2021-22681 (CVSS 10), in which an insufficiently protected key in Logix controllers could be abused, are now on the CISA list of known exploited vulnerabilities. A practical step-by-step approach:

1. Inventory all EtherNet/IP devices, firmware versions and connections, for example with passive monitoring.
2. Segment the network according to the Purdue Model and the zones and conduits model from IEC 62443; never expose ports 44818, 2222 and 2221 outside the OT zone.
3. Filter at protocol level with an industrial firewall with DPI that can block CIP services such as writes, firmware updates or mode changes.
4. Contain multicast with VLANs and IGMP snooping so that I/O traffic stays within the cell.
5. Protect the controller with the physical key switch in RUN, Trusted Slot features and up-to-date firmware.
6. Deploy CIP Security where devices support it, starting with connections between cells and to engineering workstations.
7. Monitor continuously for unusual CIP commands, such as unexpected program downloads.

For organisations in the EU that fall under NIS2, these measures form part of the duty of care. Manufacturers of EtherNet/IP devices also have to deal with the Cyber Resilience Act.

❓ Frequently asked questions

What does IP stand for in EtherNet/IP?

In EtherNet/IP, IP stands for Industrial Protocol, not Internet Protocol. EtherNet/IP does use the standard TCP/IP protocol stack, but the name refers to the industrial CIP protocol that runs on top of it.

Which ports does EtherNet/IP use?

EtherNet/IP uses TCP port 44818 for explicit messaging and UDP port 2222 for cyclic I/O data (implicit messaging). Traffic secured with CIP Security uses TCP and UDP port 2221. These ports should only be reachable inside the OT zone.

Is EtherNet/IP the same as CIP?

EtherNet/IP is not the same as CIP but is the implementation of CIP on Ethernet. CIP is the application protocol with the object model, and the same CIP layer also runs on DeviceNet and ControlNet. This means you configure devices on these networks in the same way.

Is EtherNet/IP real-time?

EtherNet/IP is suitable for soft real-time applications: I/O data is sent cyclically at a configurable RPI, usually in the range of a few to a hundred milliseconds. For synchronised motion, EtherNet/IP uses CIP Sync and CIP Motion, but for sub-millisecond applications EtherCAT or PROFINET IRT are often faster.

Can EtherNet/IP and PROFINET run on the same network?

EtherNet/IP and PROFINET can physically share the same Ethernet infrastructure, because both use standard Ethernet. In practice you separate them with VLANs and QoS to avoid interference, and a gateway handles data exchange between the two.

Is EtherNet/IP secure?

Standard EtherNet/IP has no built-in authentication or encryption, which makes it vulnerable to unauthorised commands. With CIP Security (TLS and DTLS), network segmentation and an industrial firewall with deep packet inspection, you can secure EtherNet/IP effectively.

📌 In summary

EtherNet/IP brings the Common Industrial Protocol to standard Ethernet, making it one of the most widely used industrial networks, especially in the world of Rockwell Automation and Allen-Bradley. With implicit and explicit messaging, DLR ring redundancy, CIP Safety and CIP Security it offers a complete package for I/O, safety and security, provided you segment and monitor the network properly.