OPC UA Asset Discovery for Industrial Inventory
Overview
OPC UA connects industrial controllers, supervisory systems, and other automation equipment over IP networks. OTserver opens an unsecured channel and reads standardized asset-identification variables without writing values or calling mutating methods.
How OTserver discovers OPC UA assets
For each ARP-discovered target, OTserver probes TCP ports 4840, 4841, and 48400 (configurable). It performs the OPC UA HEL/ACK handshake, calls GetEndpoints to learn the server’s endpoint and user-token policies, and opens a SecurityPolicy None session. Anonymous access is preferred; when the server requires username authentication, the scanner uses configured credentials and warns that they travel unencrypted. Certificate authentication is never attempted.
Asset identity is resolved through the standardized Objects/Aliases/Assets alias categories with the read-only FindAlias method. When no aliases exist, the scanner falls back to the OPC UA DI DeviceSet. It then reads identification, location, health, documentation, and counter variables in one bounded batch of at most 64 reads. Continuation points are not followed.
Evidence extracted
| OTserver evidence | OPC UA variable |
|---|---|
| Name | AssetId, or DeviceSet display name, or ProductInstanceUri |
| Vendor | Manufacturer |
| Model | Model |
| Serial number | SerialNumber |
| Firmware | SoftwareRevision |
| Description | DeviceClass |
| Location | HierarchicalLocation or OperationalLocation |
| Status | DeviceHealth (0 = online, 1 = offline, 4 = maintenance) |
| Raw evidence | applicationUri, productUri, applicationName, user token policies, endpoint URL, hardware revision, revision counter, patch identifiers, device health with source timestamp, documentation links, and operation counters |
Security and read-only safety
OTserver opens only unsecured (SecurityPolicy None) channels and never writes values or calls methods that modify server state. It does not follow continuation points, does not walk the full node tree, and limits reads to 64 variables per batch. When username authentication is required, credentials travel unencrypted; the scanner warns about this and requires explicit configuration.
Frequently asked questions
Does OTserver support encrypted OPC UA endpoints?
No. The scanner opens only SecurityPolicy None channels. When a server offers no unsecured endpoint, the scanner records the endpoint evidence it already collected and warns that asset details were not read.
What happens when the OPC UA server has no aliases?
OTserver falls back to the OPC UA DI DeviceSet and reads the same identification, location, health, and counter variables from each device object found there.
Compare all supported discovery protocols or configure the scanner.