How OTserver Discovers EtherNet/IP Devices
Overview
EtherNet/IP carries the Common Industrial Protocol (CIP) over standard Ethernet transports. OTserver queries the encapsulation identity service to enrich ARP-discovered assets with product and firmware evidence.
How OTserver discovers EtherNet/IP devices
For each discovered IPv4 target, OTserver sends the encapsulation List Identity command (0x0063) concurrently over TCP and UDP port 44818. It records each transport that returns a valid response and uses the first valid identity item as asset evidence.
The parser checks the encapsulation command, declared length, status, options, Common Packet Format item boundaries, and identity item type before accepting a response. It does not register a CIP session or establish connected I/O.
Evidence extracted
| OTserver evidence | List Identity attribute |
|---|---|
| Vendor | Vendor ID, when present in OTserver’s vendor mapping |
| Model and name | Product name |
| Firmware | Major and minor revision |
| Serial number | Device serial number |
| Network evidence | Reported device IP and responding TCP/UDP port |
| Raw evidence | Vendor ID, device type, product code, status, state, and complete response |
The current built-in vendor mapping names common Rockwell Automation/Allen-Bradley, Omron, Beckhoff, and Siemens IDs. Other vendor IDs remain preserved numerically in the raw observation.
Security and read-only safety
List Identity is an identification request. OTserver does not create a control connection, write CIP objects, download logic, or change device state. Devices still receive network traffic on both supported transports, so run scans only with authorization and disable EtherNet/IP probing where site policy requires it.
Frequently asked questions
Does OTserver broadcast EtherNet/IP discovery?
No. The current scanner sends List Identity directly to IPv4 targets already found by ARP. It tries both TCP and UDP 44818 rather than sending a subnet-wide EtherNet/IP broadcast.
Can OTserver discover a device that supports only one transport?
Yes. A valid response from either TCP or UDP is enough to create the EtherNet/IP observation.
Compare all supported discovery protocols or read about ARP and scanner setup.