From transmitting bits to interpreting CIP data

Hello everyone. EtherNet/IP cannot be assigned to a single layer of the Open Systems Interconnection (OSI) model. It uses Ethernet, IP and TCP/UDP at the lower layers, while CIP provides upper-layer industrial meaning and services. Examining how communication works through these distinctions helps with both network design and troubleshooting.

A practical mapping of the seven layers

The following mapping relates OSI's functional layers to the EtherNet/IP stack. In particular, do not interpret the upper three layers as three completely independent protocols.

Layers 1 and 2: signals, links and MAC addresses

The physical layer carries bits through media such as copper cable or fiber. The data link layer uses Ethernet frames and MAC addressing. In a network using standard Ethernet infrastructure, a typical Layer 2 switch forwards frames according to its MAC table. A routing-capable Layer 3 switch has additional responsibilities.

An illuminated link indicator may show that a physical link exists; it does not establish that IP settings or CIP data exchange are correct. Likewise, a correct IP address cannot repair a faulty cable or a lost physical connection.

Layer 3: IP addressing and routing

The IP address, subnet mask and, where needed, default gateway are fundamental settings at this level. This is where the network path to the destination device is considered. During configuration, distinguish communication within one subnet from communication across different subnets. Different subnets require suitable routing; multicast I/O also requires evaluation of the relevant network support and settings.

Using IP does not require internet connectivity. A machine network completely isolated from the internet can still operate with IP addresses.

Layer 4: TCP and UDP

Explicit messaging generally uses TCP for request/reply transactions such as parameter reads and writes. Implicit I/O messaging carries time-critical process data over UDP. In standard, unencrypted communication, TCP 44818 and UDP 2222 are common destination ports. Services such as discovery mean it would be incorrect to state that TCP only uses 44818 and UDP only uses 2222. Examine ports and message types together for the details.

TCP's reliable, ordered delivery differs from UDP's behavior, affecting latency and update performance. Using UDP does not automatically guarantee a particular application response time.

Layers 5–7: CIP objects and industrial meaning

The Common Industrial Protocol, or CIP, defines upper-layer functions such as device identity, objects, services, connection management and device profiles. This is where the meaning of a drive's speed reference or an I/O module's input status is defined. For application development, knowing an IP address is insufficient; the relevant CIP service and data structure must also be understood.

The OSI and TCP/IP models do not map one-to-one. TCP/IP descriptions commonly group upper-layer functions under the application layer. Consequently, describing CIP as an application-layer protocol and showing CIP across the upper three layers in an ODVA diagram are compatible when the abstraction level is explained.

Are a TCP connection, session and CIP connection the same?

A TCP connection belongs to the transport layer. An EtherNet/IP encapsulation session and a CIP connection are different concepts within the stack. For example, establishing an I/O connection through Forward Open is not the same operation as opening a TCP connection. In an automation application, TCP access may succeed while I/O exchange fails because of connection parameters, Assembly configuration or the UDP path.

How do the layers appear inside a message?

Simplified explicit-message example: An Ethernet frame carries an IP packet, which carries a TCP segment; EtherNet/IP encapsulation information and the CIP request sit above these. Analysis tools such as Wireshark can decode these fields under separate headings. This describes logical encapsulation; an application message does not necessarily fit into a single Ethernet frame. Implicit I/O also has a different format from an explicit request.

With CIP Security, additional protection mechanisms such as TLS/DTLS are used. Security policies and encryption affect which contents are visible during analysis; understanding the OSI layers does not make encrypted content readable.

Troubleshooting by layer

During diagnostics and fault finding, begin with physical connections, port status and frame error counters. Then check IP addressing, subnet masks, routing and access rules. If that infrastructure works, assess TCP/UDP access followed by CIP connection status, data lengths and device responses.

A ping response does not prove that CIP communication works. Ping checks IP reachability through ICMP; it does not verify a valid I/O connection or the correct speed reference. Similarly, establishing a TCP connection does not establish that application data is scaled correctly.

EtherNet/IP and Modbus TCP can use the same underlying network infrastructure while implementing different application services and data models. When assessing standards and conformance, verify support for the required industrial protocol and device functions rather than relying solely on the presence of an Ethernet port.