IP Address

What is an IP address?

An IP address (Internet Protocol address) is a numeric address that identifies a network interface on an IP network, so that devices can send and receive data via protocols such as TCP, UDP and HTTP. The address consists of a network part and a host part: the network part determines which subnet a device belongs to, and the host part identifies the device within that subnet. In OT networks, the IP address enables communication between PLCs, HMIs, SCADA servers, Drives, Remote IO and other industrial components.

An IP address is unique within one routing domain, not necessarily worldwide. Thousands of plants use the same private address 192.168.1.10, and that works as long as those networks are not directly connected to each other.

🧠 How does an IP address work?

The IP address operates at Layer 3 of the OSI model, the network layer. A Router looks at the destination address of a packet and uses its routing table to decide which network the packet should go to. Within the same subnet, the packet goes straight to the destination device.

1. Address and subnet mask - a device knows its own address and its prefix, for example 192.168.10.25/24. The /24 (subnet mask 255.255.255.0) means that the first 24 bits identify the network.
2. Local or remote - if the destination address is in the same subnet, the device sends the packet directly. Otherwise it goes to the default gateway.
3. From IP to MAC - delivery on the local Ethernet segment requires the MAC address. IPv4 looks it up with ARP, IPv6 with Neighbor Discovery (NDP).
4. Assignment - an address is configured statically or handed out automatically via DHCP or the older BOOTP. With IPv6, a device can also derive an address itself (SLAAC).
5. Name resolution - people use names, the network uses addresses. DNS translates one into the other.

🔄 What is the difference between IPv4 and IPv6?

IPv4 is defined in RFC 791 from September 1981. IPv6 was designed because the IPv4 address space was running out; the current specification is RFC 8200 from July 2017, which replaced RFC 2460 from 1998.

On 3 February 2011 IANA handed the last free IPv4 blocks to the regional registries. The European registry RIPE NCC, based in Amsterdam, announced on 25 November 2019 that its IPv4 pool had run out. Since then, only LIRs that have never received IPv4 addresses can obtain at most a /24 of recovered addresses through a waiting list. For plant networks this matters little, because they almost always use private addresses.

🧱 What types of IP addresses exist?

Not every address is meant for the internet. A number of blocks have a fixed, reserved meaning:

Private addresses are not routed on the internet. For outbound traffic, a router or Firewall translates them into a public address using NAT. In OT, NAT is also used to connect identical machine networks from an OEM to a plant network without renumbering them.

🏭 How are IP addresses used in industrial networks?

In OT, IP addresses are usually static: a PLC or HMI must be reachable at the same address after a restart, and firewall rules and SCADA connections refer to fixed addresses. Each industrial protocol handles this differently:

• PROFINET - an IO device is recognised by its device name (NameOfStation). The IO controller looks the device up by that name and assigns its IP address via the DCP protocol. A new device ships without a name; if the topology is defined in the project, the controller automatically gives a replacement device the same name and address.
• IP - many devices ship set to BOOTP or DHCP and must be given a fixed address with a tool. If that step is forgotten, the device requests a new address after a power cycle.
• Modbus TCP - the device is addressed purely by IP address and port 502; there is no naming layer and no authentication.
• Management and monitoring - web servers and Embedded configuration tools on the device, polling via SNMP, Logging via Syslog and time synchronisation via NTP.

🔧 How do you build a good IP addressing plan for OT?

A documented addressing plan prevents duplicate addresses, makes firewall rules readable and speeds up troubleshooting. A practical approach:

1. Take inventory - map all existing addresses with asset inventory and passive asset discovery. Run active scans on a live process network only after agreement with the process owner.
2. Choose an address block per site - for example 10.<site>.0.0/16, so an address immediately shows where the device is located.
3. Map subnets to zones - one subnet and VLAN per zone or production line, in line with the Purdue Model and the zones and conduits model of IEC 62443.
4. Reserve fixed positions - for example .1 for the gateway, .10–.49 for PLCs, .50–.99 for HMIs and .100–.199 for IO and drives. A technician then recognises a device type from its address.
5. Record everything - address, host name, MAC address, firmware version and owner in an IPAM register or CMDB, updated with every change.
6. Leave room - a /24 gives 254 usable addresses; plan for growth rather than renumbering later.

🔐 What security risks come with IP addresses?

An IP address is not proof of identity. Many industrial protocols trust a request based on the source address alone, which makes them vulnerable. Good security therefore never relies on the address by itself:

• IP spoofing - an attacker forges the source address to pose as a trusted system. Combine address filters with IP Source Guard, DHCP Snooping and checks on the MAC address.
• Duplicate addresses - a misconfigured or rogue device can make a PLC unreachable. ARP probes (RFC 5227) and network monitoring help you find conflicts quickly.
• Overly broad rules - restrict traffic between zones with Firewalls and ACLs on source, destination and port, and avoid rules such as “entire /16 to anything”.
• Visibility - log connections to unknown addresses in a SIEM or IDS; a new IP address in a control network is always worth investigating.

Network segmentation based on IP subnets is a core measure of IEC 62443-3-3 (requirement SR 5.1). The NIS2 directive and the Dutch Cyberbeveiligingswet (Cybersecurity Act), in force since 15 August 2026, require asset management among other measures. An up-to-date IP addressing plan is a directly usable part of that.

❓ Frequently asked questions

What is the difference between an IP address and a MAC address?

An IP address is a logical Layer 3 address that determines which network a device is in and that you can change. A MAC address is a physical Layer 2 address that the manufacturer usually assigns to the network interface. Within a local network, ARP or NDP links the IP address to the MAC address.

Why do PLCs get a fixed IP address?

PLCs get a fixed IP address because HMIs, SCADA systems and firewall rules refer to that address. If a PLC received a different address via DHCP after a restart, communication would drop and the process could stop. With PROFINET, the IO controller assigns the address based on the device name, so it still stays predictable.

What does an IP address starting with 169.254 mean?

An IP address starting with 169.254 is a link-local address that a device gives itself when it gets no response from a DHCP server. In an OT network, such an address usually points to a missing DHCP server, a cabling problem or a misconfigured device. With this address the device is only reachable within its own segment.

Can IPv6 be used in OT networks?

IPv6 can technically be used in OT networks, but many PLCs, IO modules and older systems support only IPv4. Most plants therefore use IPv4 with private addresses and often disable IPv6 on OT segments, so that no unmonitored second address path exists. In new builds and IT-oriented systems in the OT DMZ, IPv6 is gradually gaining ground.

How many addresses does a /24 subnet have?

A /24 subnet has 256 IPv4 addresses, of which 254 are usable for devices. The first address is the network address and the last is the broadcast address. For a production line, a /24 is often a practical size because it leaves room for expansion.

Does a private IP address protect a device against attacks?

A private IP address does not protect a device against attacks, because it is only not directly routable from the internet. An attacker who gets in through a VPN, a remote access solution or an infected laptop can reach private addresses without difficulty. Real protection comes from segmentation, firewalls and monitoring.

📌 In summary

An IP address determines where a device sits in the network, and a well-designed IP addressing plan is the foundation for reliable communication, segmentation and asset management in OT.

IPv4 with private addresses is the norm in plants, while IPv6 is slowly gaining ground. Technically an IP address works the same in IT and OT, but in OT stability and predictability weigh heaviest: static addresses, a fixed scheme per zone and an up-to-date register keep networks manageable. Because an IP address does not prove identity, firewalls, segmentation and monitoring always belong with it.