Ethernet/IP

Protocol	Ethernet/IP
Name	Ethernet/IP
Aliases	Enip
Description	Ethernet-based industrial communication protocol for industrial automation systems
Keywords	CIP
Port(s)	44818/tcp, 2222/udp
Access to specs	Paid
Specifications	Ethernet/IP Specifications
Nmap script(s)	enip-info.nse, enip-enumerate.nse
Wireshark dissector	packet-enip.c
Scapy layer	enipTCP.py
Example Pcap(s)	ICS-pcap Ethernet/IP, ICS-pcap EIP
Related CVE	CVE-2012-6435, CVE-2012-6436, CVE-2012-6438, CVE-2012-6439, CVE-2012-6441, CVE-2012-6442, CVE-2018-14827, CVE-2019-6815, CVE-2020-13530, CVE-2020-13556, CVE-2020-13573, CVE-2020-25159, CVE-2020-6083, CVE-2020-6084, CVE-2020-6085, CVE-2020-6086, CVE-2020-6087, CVE-2020-6088, CVE-2021-20987, CVE-2021-21777, CVE-2021-27478, CVE-2021-27482, CVE-2021-27498, CVE-2021-27500, CVE-2021-34754, CVE-2021-36765, CVE-2022-1737, CVE-2022-3752, CVE-2022-43604, CVE-2022-43605, CVE-2022-43606, CVE-2023-2263, CVE-2023-3596, CVE-2023-38744, CVE-2020-5653
Discovery	List Identity: Request the device to describe itself
	Scapy: `ENIPTCP(commandId=0x0063)`
	Raw: `\x63\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc1\xde\xbe\xd1\x00\x00\x00\x00`

Documentations

Common Industrial Protocol (CIP) and the family of CIP networks - ODVA publication (2016)
Ethernet/IP - Overview on ODVA.org

Fuzzing and PR’ing: How We Found Bugs in a Popular Third-Party EtherNet/IP Protocol Stack - Sharon Brizinov, Tal Keren (Claroty, 2021)

Common Flaws in ICS Network Protocols - Mars Cheng & Selmon Yang @ Hack In The Box (2020)
Hunting EtherNet/IP Protocol Stacks - Sharon Brizinov @ SANS ICS Security Summit 2022

CIPster - Ethernet/IP (Common Industrial Protocol) stack in C++
cpppo - Communications Protocol Python Parser and Originator -- EtherNet/IP CIP
enip-stack-detector - EtherNet/IP & CIP Stack Detector
OpENer - EtherNet/IP stack for I/O adapter devices
pycomm3 - A Python Ethernet/IP library for communicating with Allen-Bradley PLCs
scapy-cip-enip - Ethernet/IP dissectors for Scapy