IP

What is IP?

IP (Internet Protocol) is the network protocol at layer 3 of the OSI model that gives data packets an address and routes them via routers from source to destination, even when the two sit in different networks. Every device that communicates over IP needs an IP address to do so. In industrial environments, IP ties PLCs, SCADA servers, HMIs, drives, switches and IT systems together into a single Ethernet-based network. That makes IP the technical foundation of IT/OT convergence, but also of many attack paths into process control.

🧠 How does IP work?

IP is a connectionless, best-effort protocol. It sends each packet (a datagram) independently, with no guarantee that it arrives, arrives on time or arrives in the right order. IP leaves those tasks to the protocols above it:

• TCP - connection-oriented, with acknowledgements and retransmission; used by Modbus TCP, S7 Comm and OPC UA, among others
• UDP - lightweight and fast, without acknowledgements; used for cyclic I/O data in IP, for BACnet/IP and for time synchronisation
• ICMP - not a transport protocol but a helper protocol of IP itself, for error messages and diagnostics; familiar from ping and traceroute

An IP packet consists of a header and the payload. The header carries, among other things, the source and destination address, the protocol of the payload and a counter that stops packets from circulating forever: the Time To Live (TTL) in IPv4 and the Hop Limit in IPv6. Every router decrements that counter by one and discards the packet when it reaches zero.

Within a single network segment, a device looks up the destination’s MAC address via ARP (IPv4) or Neighbor Discovery (IPv6). If the destination lies in another subnet, the device sends the packet to its default gateway. The subnet mask determines which part of an address identifies the network; see Subnetting.

🕰️ Where does IP come from?

IPv4 was specified in September 1981 in RFC 791, written for the US agency DARPA with Jon Postel as editor. On 1 January 1983 the ARPANET switched in one go from the older NCP to TCP/IP, a date often regarded as the birth of the internet as we know it.

The IPv4 address space turned out to be too small. To stretch it, private address ranges (RFC 1918, February 1996) and NAT came first. In parallel IPv6 was developed; it has been an Internet Standard as RFC 8200 since July 2017, replacing the first specification, RFC 2460 from 1998. IANA handed out its last free IPv4 blocks on 3 February 2011. RIPE NCC in Amsterdam, which manages addresses for Europe, the Middle East and parts of Central Asia, made its last regular /22 allocation on 25 November 2019. Since then, recovered IPv4 space has been distributed through a waiting list.

🔍 What is the difference between IPv4 and IPv6?

Worldwide, roughly half of all traffic to Google now runs over IPv6. In OT networks IPv4 remains dominant, because many PLCs, O modules and engineering tools support IPv6 poorly or not at all. Be aware, though, that most modern operating systems on engineering stations and servers have IPv6 enabled by default. A segment that looks “IPv4 only” can therefore carry unnoticed IPv6 traffic that bypasses IPv4 firewall rules.

🏭 How is IP used in industrial networks?

In a typical plant, PLCs, IO modules, HMIs, engineering stations, historians and MES servers receive a fixed IP address. Industrial protocols run on top of IP and can be recognised by their well-known port numbers:

Not everything on an industrial Ethernet network uses IP. The cyclic real-time data of PROFINET RT and IRT, of EtherCAT and the GOOSE messages of IEC 61850 travel directly over layer 2, without an IP header. That saves processing time and reduces jitter. PROFINET uses IP only for configuration and diagnostics; the controller usually assigns the IP address itself through the layer-2 protocol DCP based on the device name, rather than through DHCP.

In OT, addresses are usually assigned manually or via BOOTP/DHCP with fixed reservations. A PLC that gets a different address after a restart becomes unreachable for the SCADA server. VLANs with their own subnets separate production, management and guest networks, and routers or firewalls connect those subnets in a controlled way. Sometimes NAT is needed, for example to connect identical OEM machines that ship with the same addresses to one plant network.

🔐 What are the security risks of IP?

IP was designed for reachability, not for security. The protocol does not check who sends a packet and encrypts nothing. That leads to well-known risks:

• Spoofing - an attacker can fill in a forged source address; on switches, IP Source Guard with DHCP Snooping helps, and Port Security covers the MAC side
• ARP Spoofing - forged ARP replies let an attacker divert traffic through their own system (man-in-the-middle)
• Scanning and reconnaissance - a flat IP network can be mapped in minutes; segmentation limits what an attacker can see
• Internet exposure - PLCs and HMIs with a public IP address are found daily by search engines such as Shodan; see Internet-Exposed OT
• Unencrypted protocols - in their classic form, Modbus TCP, S7comm and IEC 104 have no authentication or encryption; IPsec in a VPN or the built-in signing and encryption of OPC UA adds that layer

So rather than securing the protocol itself, secure the environment around it. The Purdue Model and the zones and conduits model of IEC 62443 divide the IP network into zones with controlled connections. ACLs and firewalls allow only the required ports between known addresses. Logging IP traffic to a SIEM and an IDS that flags new IP addresses make intruders visible in your OT network. Internet access for OT components goes through a proxy or jump server.

🧭 How do you set up an IP addressing plan for OT?

A well-thought-out addressing plan prevents outages and makes security simpler. A practical approach:

1. Inventory every device - record the IP address, MAC address, subnet and function of each device in an asset inventory.
2. Choose a fixed structure - for example 10.<site>.<zone>.<host>, so the address itself reveals which site and zone a device belongs to.
3. Use one subnet per zone - keep subnets small (a /24 with 254 hosts is often plenty) and map each subnet to one VLAN.
4. Reserve fixed ranges - for example .1 for the gateway, .10–.49 for PLCs, .50–.99 for HMIs and .100–.199 for I/O.
5. Avoid overlap with IT - pick private ranges that do not clash with the office network or with supplier networks.
6. Disable unused functions - switch off IPv6 on segments where you do not manage it, or include it deliberately in your firewall rules.
7. Document and monitor - use passive network monitoring to spot deviations from the plan.

For Dutch organisations covered by the Cybersecurity Act, which entered into force on 15 August 2026, such a plan directly supports the required measures for network security, asset management and detection.

❓ Frequently asked questions

What is the difference between IP and TCP?

IP handles addressing and routing of packets between networks at layer 3 of the OSI model. TCP works above it at layer 4 and provides a reliable connection with acknowledgements, ordering and retransmission. Together they form TCP/IP, the basis of protocols such as Modbus TCP and OPC UA.

Does every industrial Ethernet device use IP?

Not every industrial Ethernet device uses IP for its process data. PROFINET RT and IRT, EtherCAT and IEC 61850 GOOSE send real-time data directly over layer 2 to minimise delay. For configuration, diagnostics and connection to SCADA, PROFINET and IEC 61850 devices do use IP; with EtherCAT, usually only the master does.

Should an OT network migrate to IPv6?

Migrating to IPv6 is not necessary for most OT networks today, because private IPv4 addresses are more than sufficient and many PLCs do not support IPv6. It is wise, however, to manage IPv6 deliberately: disable it where it is not used, or include it in firewall rules and monitoring. IPv6 may play a role in new IIoT and cloud connections.

Which private IP addresses can you use in an OT network?

RFC 1918 reserves three IPv4 ranges for internal networks: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. These private IP addresses are not routed on the internet and are therefore suitable for OT networks. Choose ranges that do not overlap with the office network or with supplier networks.

Is IP traffic encrypted?

Standard IP traffic is neither encrypted nor authenticated. Encryption comes from additional protocols, such as IPsec in a VPN at network level, or TLS in HTTPS and the built-in security layer of OPC UA at application level. Classic OT protocols such as Modbus TCP therefore send their data in readable form across the IP network.

Why do PLCs usually get a fixed IP address?

PLCs usually get a fixed IP address because SCADA, HMIs and other PLCs address them at a known location. If that address changes after a restart, communication drops and the process can stop. That is why IP addresses in OT are assigned manually or via DHCP with fixed reservations.

📌 In summary

IP is the layer-3 protocol that addresses and routes data packets, making it the foundation of almost all modern IT and OT communication. In OT networks IPv4 is still the norm, protocols such as Modbus TCP, EtherNet/IP and OPC UA run on top of IP, and some real-time protocols deliberately bypass it. Because IP itself offers no security, a clear addressing plan, segmentation according to IEC 62443, strict firewall rules and monitoring are essential to keep your OT network stable and secure.