Cheat Sheet

Communication
Protocols in
Industrial
Control
System (ICS)

Ver 2.0
Content
1. Common ICS Protocols 3-6
2. Wireless Protocols used in ICS 7
3. Vendor Specific Protocols 8
4. Data Historian Specific Protocols 9
5. IT Protocols used in ICS 10-12
6. Database Protocols used in ICS 13

Edited by Shiv Kataria 2

https://www.linkedin.com/in/shivkataria/
Common ICS Protocols
Protocol Description Serial/Ethernet Port Number Security Features

Used for communication between electrical power

NA (RS-232, RS- Limited security features,
IEC 60870-5-101 systems and devices for telecontrol and tele- Serial
485, RS-422) encryption not standard
protection.

Used for communication between electrical power

Supports encryption and
IEC 60870-5-104 systems and devices for telecontrol and tele- Ethernet (TCP) 2404
authentication
protection.

Used for communication between intelligent

Supports encryption and
IEC 61850 electronic devices (IEDs) in electrical power Ethernet (TCP) 102
authentication
systems.

Protocol used for communication between 135 (Uses

OPC (OLE for Supports DCOM and
industrial automation systems and enterprise Ethernet (TCP) DCP/RCE in
Process Control) encryption mechanisms
systems. Microsoft)

Protocol used for communication between Uses token-passing which

CC-Link IE industrial devices and enterprise networks, primarily Ethernet (UDP) Various can include security
used by Mitsubishi Electric. features

Protocol used for communication between Supports encryption and

ModbusTCP Ethernet (TCP) 502
Modbus devices over TCP/IP networks. authentication

Serial and
Used for communication between building 1628 (for Limited security features,
LonWorks Ethernet
automation systems and devices. TCP/UDP) encryption not standard
(TCP/UDP)

Edited by Shiv Kataria 3

https://www.linkedin.com/in/shivkataria/
 Used for communication between IoT devices and 1883 (non-
MQTT enterprise systems. Lightweight messaging protocol Ethernet (TCP) encrypted), 8883 Supports TLS encryption
for Internet of Things (IoT) devices. (TLS encrypted)

Used for communication between industrial control

Supports encryption and
ControlNet devices, including programmable logic controllers Ethernet 2222
authentication
(PLCs), primarily used by Rockwell Automation.

Used for communication between building Serial, Ethernet Supports encryption and
KNX 3671 (UDP)
automation systems and devices. (TCP/UDP) authentication

Real-time Industrial Ethernet protocol used for

communication between industrial automation Supports encryption and
EtherCAT Ethernet 34962
systems and devices, primarily used by Beckhoff authentication
Automation.

Application layer protocol for industrial automation

CIP (Common devices, used for communication between Ethernet 44818 (Various Supports encryption and
Industrial Protocol) industrial automation systems and devices, primarily (TCP/UDP) others as well) authentication
used by Rockwell Automation.

Protocol used for communication between

Ethernet 44818 (TCP), 2222 Supports encryption and
EIP (Ethernet/IP) industrial automation systems and devices, primarily
(TCP/UDP) (UDP) authentication
used by Rockwell Automation.

Protocol used for communication between building Supports encryption and

BACnet/IP Ethernet (UDP) 47808
automation systems and devices over IP networks. authentication

Communication protocol for TwinCAT automation

software used for communication between Ethernet Supports encryption and
ADS 48899 (TCP/UDP)
industrial automation systems and devices, primarily (TCP/UDP) authentication
used by Beckhoff Automation.

Digital communication protocol for process

Foundation Limited security features,
automation used for communication between Serialbus NA
Fieldbus encryption not standard
industrial automation systems and field devices.

Edited by Shiv Kataria 4

https://www.linkedin.com/in/shivkataria/
 Protocol used for communication between
Limited security features,
PROFIBUS industrial automation systems and field devices, Serial NA
encryption not standard
primarily used by Siemens.

Communication protocol for SCADA systems used

Serial and
for communication between various types of data Supports encryption and
DNP3 Ethernet 20000-20002
acquisition and control equipment in Electrical authentication
(TCP/UDP)
Systems.

Protocol used for communication between

Ethernet 2455, 2456 1217 Supports encryption and
CODESYS industrial automation systems and devices, primarily
(TCP/UDP) (TCP/UDP) authentication
used by 3S-Smart Software Solutions.

Protocol used for communication between

industrial automation systems and field devices,
34962 , 34963 Supports encryption and
Profinet primarily used by Siemens. Has 3 different modes: Ethernet
(UDP), 34964 (TCP) authentication
TCP/IP with latency >10ms, Realtime (RT) with
latency 1-10ms, and IRT with Latency <1ms.

Communication protocol for microcontroller-based Limited security features,

CAN bus Serial NA (non IP-based)
systems in automotive and industrial applications. encryption not standard

Protocol used for communication between smart Limited security features,

HART Serial NA (non IP-based)
instruments and control systems. encryption not standard

Protocol used in heavy-duty vehicles for N/A (non IP- Limited security features,
J1939 Serial
communication between microcontrollers. based) encryption not standard

Protocol used for communication between utility Serial and Limited security features,
Meter-Bus 10001 (TCP)
meters and data collection devices. Ethernet (TCP) encryption not standard

Communication protocol for marine electronics, N/A (non IP- Limited security features,
NMEA Serial
such as GPS devices. based) encryption not standard
Developed by Motorola, MDLC (Motorola Data Link
Serial and Supports encryption
MDLC Communication) is designed for use in industrial Various
Ethernet (AES256 and previously
automation and SCADA systems. Supports

Edited by Shiv Kataria 5

https://www.linkedin.com/in/shivkataria/
 communication between different devices and TEA), authentication, and
supports various transport layers and application secure communication.
profiles.
A protocol used for communication between
systems using the OSI model. ISO-TSAP provides a
ISO-TSAP layer of abstraction between the application layer
Supports encryption and
(Transport Service and the lower layers, allowing different application- Ethernet (TCP) TCP: 102, 104
authentication
Access Point) layer protocols to be used with different lower-layer
protocols. ISO-TSAP is used as the transport layer for
S7Comm and ICCP.

Communication protocol for Siemens S7 PLCs

102 (TCP), 161 Supports encryption and
S7Comm (Programmable Logic Controllers) based on ISO- Ethernet
(UDP) authentication
TSAP.

A protocol used for communication between

ICCP (Inter-
control centers in electrical power grids. ICCP is
Control Center Supports encryption and
based on the OSI model and includes multiple Ethernet 102, 410 (TCP)
Communications authentication
layers, including a transport layer based on TCP or
Protocol)
TP4.

A set of standards for communication between

devices in industrial automation systems, such as
OPC DA: 135, 137,
sensors, PLCs, and human-machine interfaces. OPC
138, 139, 445,
includes multiple protocols, including OPC DA
OPC (OLE for 4840-4843; OPC Supports encryption and
(Data Access), OPC AE (Alarms and Events), and Ethernet (TCP)
Process Control) AE: 135, 137, 138, authentication
OPC UA (Unified Architecture). OPC UA is the latest
139, 445; OPC UA:
and most secure version, supporting encryption
4840-4843 (TCP)
and authentication. OPC uses various transport
protocols, including ISO-TSAP, TCP, and HTTP.

Edited by Shiv Kataria 6

https://www.linkedin.com/in/shivkataria/
Wireless Protocols
Protocol Description Security Features Notes

Wireless protocol for low-power, low-data-rate AES-128 encryption, secure Commonly used in smart homes
Zigbee
communication used in industrial and home automation. key establishment and industrial sensor networks.

AES-128 encryption, Provides secure and reliable

Wireless protocol based on HART for communication
WirelessHART network security, device communication for industrial
between field devices and control systems.
authentication applications.

AES-128 encryption, Designed for industrial

Wireless protocol for industrial automation, designed for
ISA100.11a supports multiple security environments with high reliability
process automation applications.
levels and security.

WPA3, WPA2, WPA, WEP

Widely used in industrial and
Wireless networking protocol commonly used for general- (various encryption and
Wi-Fi commercial environments for
purpose wireless communication. authentication
wireless connectivity.
mechanisms)

Edited by Shiv Kataria 7

https://www.linkedin.com/in/shivkataria/
Vendor Specific Protocols
Protocol Vendor Description Serial/Ethernet Port Number/s

Protocol used for communication between Ethernet

ADS Beckhoff Automation 48899 (TCP/UDP)
industrial automation systems and devices. (TCP/UDP)

Protocol used for communication between

CC-Link IE Mitsubishi Electric Ethernet (UDP) 304
industrial devices and enterprise networks.

Protocol used for communication between Ethernet 44818 (Various others as

CIP Rockwell Automation
industrial automation systems and devices. (TCP/UDP) well)

3S-Smart Software Protocol used for communication between Ethernet 2455, 2456, 1217
CODESYS
Solutions industrial automation systems and devices. (TCP/UDP) (TCP/UDP)

Protocol used for communication between

ControlNet Rockwell Automation industrial control devices, including Ethernet 2222
programmable logic controllers (PLCs).

Protocol used for communication between

EtherCAT Beckhoff Automation Ethernet 34962
industrial automation systems and devices.

Protocol used for communication between Ethernet

EtherNet/IP Rockwell Automation 44818 (TCP), 2222 (UDP)
industrial devices and enterprise networks. (TCP/UDP)

Protocol used for communication between

PROFIBUS Siemens industrial automation systems and field Serial 102, 161
devices.

Protocol used for communication between

34962, 34963 (UDP), 34964
Profinet Siemens industrial automation systems and field Ethernet
(TCP)
devices.

Edited by Shiv Kataria 8

https://www.linkedin.com/in/shivkataria/
Data Historian Specific Protocols
Protocol Description Port Number Security Features

Supports various security features

Commonly used in industrial automation to allow devices and
TCP 135 and including encryption,
OPC systems to communicate with each other using a standard
dynamic ports authentication, and secure
interface.
communication

Standard language used to manage relational databases, TCP 1433 or other

Supports encryption (SSL/TLS),
SQL commonly used in data historians to query and store historical port configured
authentication, and access control
data. by the SQL server

N/A (uses TCP/IP Supports encryption and

Standard interface used to access various types of databases,
ODBC and dynamic authentication depending on the
including SQL-based databases.
ports) database and driver used

N/A (uses TCP/IP Supports encryption and

Java-based interface used to access various types of databases,
JDBC and dynamic authentication depending on the
including SQL-based databases.
ports) database and driver used

TCP 502 or other

Serial communications protocol commonly used in industrial Limited security features; Modbus
port configured
Modbus automation and data acquisition systems to transmit signals from Secure (with TLS) is available for
by the Modbus
instrumentation and control devices. enhanced security
server

TCP 20000 or
Protocol used in the utility industry to communicate between other port Supports encryption and
DNP3
different types of equipment, including data historians. configured by authentication
the DNP3 server

Edited by Shiv Kataria 9

https://www.linkedin.com/in/shivkataria/
IT Protocols used in ICS
Protocol Short Description Port Number Security Feature

Dynamic Host Configuration Protocol - Used to assign IP Limited security features; DHCP snooping
DHCP addresses and other network configuration information to UDP 67, 68 and IP source guard can be used for
devices on a network. additional security Reference

DNSSEC provides authentication and

DNS Translates domain names to IP addresses 53
integrity Reference

Limited security features; FTPS and SFTP

FTP File transfer protocol 21
provide secure alternatives Reference

Limited security features; HTTPS provides a

HTTP Web browsing protocol 80
secure alternative Reference

SSL/TLS encryption provides security

HTTPS Secure web browsing protocol 443
Reference

Limited security features; can be used for

ICMP Diagnostic protocol, also known as ping N/A
network diagnostics Reference

Precise time synchronization protocol used in industrial N/A (not IP-

IEEE 1588 Limited security features Reference
automation systems and process control based)

Supports encryption (SSL/TLS) and

IMAP Receives email over the network 143
authentication Reference

Protocol used for accessing databases, similar to ODBC but Depends on the database and driver
JDBC N/A
for Java-based applications used Reference

Provides strong authentication using

Kerberos Secure authentication protocol 88
secret-key cryptography Reference

Edited by Shiv Kataria 10

https://www.linkedin.com/in/shivkataria/
 Accesses and maintains distributed directory information Supports encryption (SSL/TLS) and
LDAP 389
services authentication Reference

Link Layer Discovery Protocol - Used to advertise and Limited security features; LLDP-MED
LLDP Ethernet
discover network devices and their capabilities. provides additional security Reference

Link-Local Multicast Name Resolution - Used for name Limited security features; can be used for
LLMNR UDP 5355
resolution on local networks when DNS is not available. local name resolution Reference

Limited security features; NTS provides

NTP Synchronizes clocks between devices 123
secure alternatives Reference

Depends on the database and driver

ODBC Protocol used for accessing databases N/A
used Reference

Protocol used for communication between industrial

Supports encryption and authentication
OPC UA automation systems and enterprise systems, including for 4840
Reference
data acquisition and database synchronization

Supports encryption (SSL/TLS) and

POP3 Receives email over the network 110
authentication Reference

Precise time synchronization protocol used in industrial N/A (not IP-

PTP Limited security features Reference
automation systems and process control based)

Supports encryption and authentication

RDP Remote desktop access protocol 3389
Reference

Supports encryption and authentication

SFTP Secure file transfer protocol 22
Reference

Supports encryption and authentication

SMB File and printer sharing protocol 139, 445
Reference

Supports encryption (SSL/TLS) and

SMTP Sends email over the network 25
authentication Reference

Edited by Shiv Kataria 11

https://www.linkedin.com/in/shivkataria/
 Simple Network Management Protocol - Used to manage
Supports authentication and limited
SNMP and monitor network devices, including routers, switches, UDP 161, 162
encryption Reference
and servers.

Protocol used for time synchronization in networked Limited security features; NTS provides
SNTP 123
environments secure alternatives Reference

Supports encryption and authentication

SSH Secure remote access protocol 22
Reference

Secure communication protocol used for encrypting data Provides encryption and authentication
SSL/TLS N/A
transmitted via HTTP, SMTP, FTP, and other protocols Reference

Depends on the specific application

TCP/IP Network communication protocol N/A
protocol used over TCP/IP Reference

Edited by Shiv Kataria 12

https://www.linkedin.com/in/shivkataria/
Database Protocols used in ICS
Database Protocol Description Default Port Security Features

A relational database management system Supports encryption (SSL/TLS), authentication,

Microsoft SQL Server 1433
developed by Microsoft. and access control Reference

A multi-model database management system Supports encryption (SSL/TLS), authentication,

Oracle Database 1521
produced and marketed by Oracle Corporation. and advanced security features Reference

An open-source relational database Supports encryption (SSL/TLS) and

MySQL 3306
management system. authentication Reference

An open-source relational database

Supports encryption (SSL/TLS), authentication,
PostgreSQL management system emphasizing extensibility 5432
and access control Reference
and SQL compliance.

An open-source, in-memory data structure store

Supports encryption (SSL/TLS) and
Redis used as a database, cache, and message 6379
authentication Reference
broker.

A free and open-source, distributed, wide column Supports encryption (SSL/TLS) and
Cassandra 9042
store, NoSQL database management system. authentication Reference

Edited by Shiv Kataria 13

https://www.linkedin.com/in/shivkataria/