Beckhoff ADS Discovery With OTserver Otter
Overview
Otter uses Beckhoff ADS/AMS to collect runtime identity and state from eligible targets. A runtime name or version stays separate from the physical device’s model, serial number, and firmware.
How Otter discovers ADS runtimes
Otter sends one unicast ServerInfo request to UDP 48899. When a valid reply supplies an AMS NetID, Otter can send ReadDeviceInfo and ReadState requests over TCP 48898 to the selected logical AMS ports.
The scanner validates the discovery reply and correlates each ADS response with its NetIDs, ports, command, invocation ID, flags, and declared lengths. If UDP discovery fails and no target NetID was explicitly configured, it skips the TCP reads.
| Evidence | Treatment |
|---|---|
| ServerInfo identity and AMS NetID | Retained as discovery evidence for the responding target |
| Runtime name and version | Kept as runtime evidence, separate from hardware identity and firmware |
| ADS and device state | Retained as reported runtime state, not an inferred online/offline verdict |
| Per-port responses and failures | Kept with the selected logical endpoint |
Configure known NetIDs and logical ports
If UDP ServerInfo is unavailable, add the known target NetID to adsTargetNetIds in otter.json. adsSourceNetId optionally overrides the scanner’s NetID; adsPorts selects up to eight logical AMS endpoints. Without a port list, Otter queries the system service and the first TwinCAT 3 and TwinCAT 2 PLC runtimes.
The CLI equivalents are --ads-target-netid IP=NETID, --ads-source-net-id NETID, and repeated --ads-port PORT. Use values from the device’s approved configuration. AMS ports identify logical services and are not TCP port numbers.
ADS is enabled by default. Disable it with --no-ads, noAds: true in JSON, or its GUI toggle.
Read-only limits
The target may require a pre-existing authorized AMS route. Otter does not create routes or infer a target NetID from its IPv4 address. It does not write values, read symbols or the process image, subscribe to notifications, or invoke system-service operations.
Only ServerInfo, ReadDeviceInfo, and ReadState are used. Otter does not negotiate Secure ADS or try alternate secure ports. Discovery still generates traffic and requires explicit authorization.