Free tool
OT / ICS Protocol Explorer
A reference for the protocols that actually run the physical world — fieldbuses, SCADA links and substation buses. For each one: default ports and transport, where it sits in the Purdue model, whether it authenticates or encrypts anything natively, its documented weaknesses, what an attacker who reaches it can do, and how to detect abuse. Search, filter, expand any protocol for detail, and export the filtered set to CSV. Everything runs in your browser — nothing is sent anywhere.
20
Protocols
17
No native auth
18
No native encryption
23
Unique IP ports
Purdue-level distribution (filtered)
20 shownBACnet Dominant building-automation protocol (HVAC, lighting, access); BACnet/IP is unauthenticated and broadcast-heavy. | 47808/udp, Serial | 0-1 | No authNo enc | |
CC-Link / CC-Link IE Mitsubishi-led open fieldbus (serial) and Gigabit industrial Ethernet (IE); dominant in Asian manufacturing. | Serial, Ethernet (L2) | 0-1 | No authNo enc | |
CIP Safety / FSoE (Safety fieldbus) Functional-safety "black channel" protocols (SIL-rated) layered on top of EtherNet/IP, EtherCAT or PROFINET. | 2222/udp, Ethernet (L2) | 0-1 | No authNo enc | |
CODESYS (Gateway / V3 protocol) The IEC 61131-3 runtime embedded in hundreds of OEM PLCs; its programming/gateway protocol has a long CVE history. | 1217/tcp, 11740/tcp, 1200/tcp | 1-2 | No authNo enc | |
DNP3 Electric/water SCADA protocol with event reporting and time-stamping; optional Secure Authentication rarely enabled. | 20000/tcp, 20000/udp, Serial | 1-2 | No authNo enc | |
EtherCAT High-speed "processing on the fly" industrial Ethernet; a single L2 segment with no node-level security. | Ethernet (L2), 34980/udp | 0-1 | No authNo enc | |
EtherNet/IP (CIP) ODVA protocol carrying CIP over Ethernet; dominant in Rockwell/Allen-Bradley plants, no native security. | 44818/tcp, 2222/udp, 44818/udp | 0-1 | No authNo enc | |
HART / WirelessHART Digital signalling layered over 4–20 mA field wiring; WirelessHART (IEC 62591) is the secured mesh variant. | 5094/tcp, 5094/udp, Serial, Radio | 0-1 | No authNo enc | |
IEC 60870-5-104 European electric-utility tele-control protocol; 104 is the TCP profile of the 101 serial standard, unauthenticated. | 2404/tcp, Serial | 1-2 | No authNo enc | |
IEC 61850 (MMS / GOOSE / SV) Substation automation suite: MMS client/server (TCP), plus layer-2 GOOSE and Sampled Values for protection. | 102/tcp, Ethernet (L2), Ethernet (L2) | 0-1 | No authNo enc | |
M-Bus / Wireless M-Bus European utility metering bus (heat/gas/water/electric); wired is unauthenticated, wireless M-Bus adds optional AES. | Serial, Radio | 0-1 | No authNo enc | |
MELSEC / SLMP (MC Protocol) Mitsubishi MELSEC PLC communication (MC Protocol / SLMP) for device read/write and remote control. | 5007/tcp, 5006/udp | 1-2 | No authNo enc | |
Modbus (RTU / ASCII / TCP) The oldest and most widespread fieldbus/SCADA protocol; register read/write with no security whatsoever. | 502/tcp, 502/udp, Serial | 0-1 | No authNo enc | |
Niagara Fox (Tridium) Proprietary protocol of the Tridium Niagara building-automation framework; widely internet-exposed historically. | 1911/tcp, 4911/tcp | 2-3 | AuthEnc | |
OMRON FINS OMRON PLC protocol for memory access and CPU control; unauthenticated over UDP/TCP. | 9600/udp, 9600/tcp | 1-2 | No authNo enc | |
OPC Classic (DA / HDA / A&E) Legacy Windows DCOM-based OPC; notorious for dynamic RPC ports and a huge attack surface. | 135/tcp, TCP | 2-3 | AuthNo enc | |
OPC UA Modern, platform-independent OPC with a real security model — but frequently deployed in insecure "None" mode. | 4840/tcp, 4843/tcp | 2-3 | AuthEnc | |
PROFIBUS (DP / PA) Classic RS-485/MBP serial fieldbus; physically isolated but completely unauthenticated on the wire. | Serial, Serial | 0-1 | No authNo enc | |
PROFINET Siemens-led real-time industrial Ethernet; layer-2 real-time channel is unauthenticated and spoofable. | 34962/udp, 34963/udp, 34964/udp, Ethernet (L2) | 0-1 | No authNo enc | |
S7comm / S7comm-Plus Siemens SIMATIC S7 PLC protocol over COTP/TPKT; S7comm is unauthenticated, S7comm-Plus adds (breakable) anti-replay. | 102/tcp | 1-2 | No authNo enc |
Reference material for defenders and architects. Security posture reflects base-protocol behaviour; secure variants (OPC UA security policies, DNP3 SAv5, CIP Security, IEC 62351, BACnet/SC) change the picture when actually deployed and configured. Always verify against your own equipment and the current vendor and CISA advisories.