04 — EtherNet/IP

Rockwell's industrial Ethernet, built on CIP.

Estimated 35 minutes.

What is EtherNet/IP?

EtherNet/IP is the dominant industrial Ethernet protocol in North America, championed by Rockwell Automation and the ODVA. It is what every Allen-Bradley ControlLogix PLC speaks natively — and what tens of thousands of drives, valves, scanners and remote I/O blocks are built to talk back.

The "IP" is not Internet Protocol.

Despite the name, the "IP" in EtherNet/IP stands for "Industrial Protocol" — meaning the Common Industrial Protocol (CIP). EtherNet/IP is "CIP carried over Ethernet." The same CIP also runs over DeviceNet (CAN), ControlNet, and CompoNet — that is the ODVA family.

Standard Ethernet, end to end.

EtherNet/IP runs on ordinary unmanaged switches, ordinary cables, ordinary TCP/IP. There is no special hardware requirement for typical I/O. That is its greatest strength — and one of its security weaknesses.

Everything in CIP is an Object.

CIP models a device as a collection of objects — Identity, Assembly, Connection Manager, TCP/IP, Ethernet Link, and dozens more. Each object has a Class code, one or more Instances, and a set of Attributes you can read or write.

Route the request to the right object.

Five real things you want to do — five CIP objects on the device. Each request fits exactly one object.

The Assembly Object is the workhorse.

For high-speed I/O, you do not want to ask for one attribute at a time. The Assembly Object bundles many attributes — say "16 input bits + 4 analog words" — into a single instance with a single block of bytes. That whole block is exchanged every cycle.

Where is the IP address stored?

You want to read or change a CIP device's IP address programmatically. Which object holds it?

• Identity Object (0x01)
• Assembly Object (0x04)
• TCP/IP Interface Object (0xF5)
• Ethernet Link Object (0xF6)

Two ways to talk CIP.

CIP messages come in two flavours: implicit (Class 1 I/O — fast, cyclic, UDP) and explicit (Class 3 or UCMM — flexible, request-response, TCP). Almost everything you do over EtherNet/IP is one of these two.

Pick implicit or explicit.

Five common tasks. Each has one right transport. Pick wrong and see the bandwidth or latency cost.

Two ports, two purposes.

EtherNet/IP uses two TCP/UDP ports. TCP 44818 — explicit messaging and connection setup. UDP 2222 — Class 1 implicit (I/O) data. If your firewall blocks UDP 2222, the device will appear "online" (TCP works) but no I/O will run.

Producer / Consumer, not Master / Slave.

Modbus is master/slave — the master polls, the slave answers. CIP is producer/consumer — a producer publishes its data, and any number of consumers subscribe to it. That is why one device can feed multiple PLCs simultaneously without being polled twice.

Producer feeds many — and the watchdog.

Add consumers, drop the network, recover. One UDP multicast feeds all of them.

RPI is not "polling rate".

RPI (Requested Packet Interval) is how often the producer pushes its data — not how often the scanner asks. Set it too low and you waste bandwidth; set it too high and your control loop lags. Typical: 10 ms for I/O, 2–5 ms for drives, 1 ms only when truly needed.

EDS: the device datasheet.

Every CIP device ships with an EDS file (Electronic Data Sheet) — a plain-text, INI-style file that describes the device's identity, supported connections, parameters and assembly instances. Studio 5000 reads the EDS to register the device.

Open a connection from the EDS.

Pick an Assembly Instance, RPI and Connection Type. Pick something the EDS does not declare and the device rejects with a real CIP status code.

Wrong EDS, wrong everything.

A common commissioning failure: the device firmware was upgraded but the old EDS is still registered in Studio 5000. The connection opens, the bytes flow — but the assembly layout has changed, and your input image is full of nonsense. Always match EDS revision to firmware revision.

How do you address an attribute?

To read "the ProductName of the Identity Object, Instance 1, Attribute 7", you build a CIP path — a short string of bytes called an EPATH that says "go to class X, instance Y, attribute Z". Every explicit message carries one.

EPATH segment bytes.

The four segments you will see most: 0x20 CC = 8-bit class code. 0x24 II = 8-bit instance. 0x30 AA = 8-bit attribute. 0x21 / 0x25 = 16-bit class / instance for codes above 0xFF. They chain together to form a path.

Decode a CIP path.

Type or paste an EPATH (hex bytes, space-separated). Try the samples to see real paths used by Studio 5000.

What does this path target?

You sniff this CIP path on the wire: 20 04 24 64. What is being addressed?

• Identity Object, Instance 100.
• Assembly Object, Instance 100.
• TCP/IP Object, Attribute 100.
• Connection Manager, Instance 4.

Gotcha #1: Multicast vs unicast.

Class 1 I/O is multicast by default. On an unmanaged switch, multicast floods every port — fine for small networks, a disaster on big ones. Use IGMP-snooping switches, or configure unicast connections (modern firmware supports it).

Gotcha #2: Connection budget.

Every CIP device has a maximum number of CIP connections it will accept (often 32, 64, or 128). It is easy to run out — every PanelView, every MSG instruction, every monitoring tool eats one. "Cannot open connection" almost always means the budget is full.

Gotcha #3: Plaintext, again.

EtherNet/IP has no native authentication or encryption. CIP Security exists (TLS-based) but adoption is still low. Treat the EtherNet/IP segment as a trusted OT network — firewall it from corporate IT.

You now know EtherNet/IP.

• EtherNet/IP = CIP over standard Ethernet (TCP 44818, UDP 2222).
• Devices are modelled as Objects — Identity, Assembly, Connection Manager, TCP/IP, Ethernet Link.
• Two messaging modes: Implicit (Class 1, UDP, cyclic I/O) and Explicit (TCP, request-response).
• Producer/consumer — one publisher, many subscribers, no polling.
• EDS files describe the device. CIP paths address objects via class / instance / attribute.

EtherNet/IP complete.

• You can read a CIP path on the wire.
• You know the difference between implicit and explicit messaging.
• You can pick the right RPI and explain the connection budget.
• You can debug "online but no I/O" — start with UDP 2222 and EDS revision.