What protocols can operate over Ethernet?

Ethernet is not an application protocol by itself. It provides the physical and data-link foundation that carries frames on a local network. Above that foundation you may run IP, TCP, UDP, HTTP, MQTT and SNMP; industrial protocols such as Modbus TCP, EtherNet/IP and PROFINET; or real-time technologies such as EtherCAT that can use Ethernet frames without placing cyclic process data inside a normal TCP/IP stack.^[1]

This is why two devices having Ethernet ports does not prove that they can exchange useful data. They share the lower network technology, but they still need compatible upper-layer protocols, roles and data models.

Start with the layers: Ethernet, IP, TCP/UDP and the application are different jobs

Think of a network message as nested envelopes. At the bottom is the Ethernet frame containing source and destination MAC addresses. That frame can carry IPv4 or IPv6. IP can carry TCP or UDP. The transport can then carry HTTP, MQTT, Modbus TCP or another application protocol. Other industrial technologies may use Ethernet at a lower layer and bypass the normal TCP/IP path for time-critical traffic.

IPv4 and IPv6 sit above Ethernet

IP is not Ethernet. IPv4 and IPv6 provide network-layer addressing and routing. Ethernet moves frames across the local link; routers use IP when traffic has to cross network boundaries.

This also explains why an Ethernet address and an IP address are different. A MAC address belongs to the data-link layer; an IP address belongs to the network layer. A PLC can have both at the same time because they solve different problems.

ARP, ICMP and IGMP support the IP side of an Ethernet network

ARP helps IPv4 systems discover the MAC address associated with an IP address on the local network. RARP is now a legacy mechanism and should not be presented as a normal modern address-assignment method; DHCP/BOOTP-style mechanisms replaced much of that role.

ICMP carries IP diagnostic and control messages and is used by familiar tools such as ping. IGMP manages IPv4 multicast group membership. In automation networks that use multicast, IGMP snooping on a managed Ethernet switch can become an important engineering detail.

TCP and UDP provide two different transport models

TCP provides a connection-oriented, ordered byte stream with retransmission and flow-control behavior. It is well suited to configuration, files, web services and reliable message exchange. UDP is lighter and connectionless; it does not provide TCP-style ordering, retransmission or reliable delivery. Describing UDP as having “no error checking” is too simplistic: UDP includes a checksum mechanism, but it does not turn that into TCP-like reliability.

Industrial protocols can use both models. EtherNet/IP, for example, uses TCP/IP for explicit messages and UDP/IP for cyclic real-time I/O.^[2]

HTTP and HTTPS are usually the device web-interface layer

When you open the web page of a PLC, switch or gateway, the typical stack is Ethernet → IP → TCP → HTTP/HTTPS. HTTPS adds TLS security to the transport.

A web interface is not the same thing as the machine's cyclic control protocol. One physical Ethernet interface can carry a web session while another protocol handles the actual I/O exchange.

DHCP, DNS and SNMP belong to network configuration and management

DHCP can distribute IP configuration automatically. DNS maps names to IP addresses. SNMP is widely used to monitor and manage network devices such as switches, routers and UPS systems. That is why SNMP appears separately in the page image: it is a network-management protocol rather than a process-control protocol.

A SCADA system may monitor the process while an SNMP-based system monitors switch port counters and network health in parallel.

MQTT is a publish/subscribe path toward IIoT and cloud systems

MQTT is a lightweight publish/subscribe messaging protocol. MQTT 5.0 requires an underlying transport that provides an ordered, lossless byte stream; TCP/IP is a common choice and TLS can be used for secure transport.^[3]

That makes MQTT useful for IIoT, cloud integration, energy monitoring and forwarding datalogger information upstream. It is not a substitute for a microsecond-level motion fieldbus such as EtherCAT.

OPC UA provides services and information models over several transports

OPC UA is broader than one Ethernet transport. It defines industrial services and information models and supports multiple mappings. The OPC Foundation currently documents UA TCP, HTTPS and WebSocket transports separately.^[4]

In many plants OPC UA sits between the PLC/IPC and SCADA, MES, edge computing or enterprise software while the hard real-time field cycle uses another network.

Modbus TCP carries Modbus over TCP/IP

Modbus TCP carries the Modbus application protocol over Ethernet using TCP/IP. The Modbus Organization describes Modbus as an OSI Layer-7 application protocol and explicitly lists TCP/IP over Ethernet as one deployment method. TCP port 502 is the well-known Modbus TCP service port.^[5]

So Modbus and Ethernet are not synonyms. The same Modbus register model can be transported over a serial link or over Ethernet/TCP, with different lower layers underneath.

EtherNet/IP uses standard IP networking plus CIP

EtherNet/IP combines standard Ethernet/IP networking with the Common Industrial Protocol (CIP). ODVA documents TCP/IP for explicit messaging and UDP/IP for time-critical implicit I/O. EtherNet/IP is therefore a specific industrial protocol—not a generic term for “Ethernet plus any IP traffic.”^[6]

An Ethernet-capable drive or PLC still needs actual EtherNet/IP support to participate in that network.

PROFINET can mix real-time Ethernet with normal TCP/IP services

PROFINET uses Ethernet for industrial communication but does not reduce every real-time exchange to a normal TCP socket. PI describes real-time I/O alongside parallel TCP/IP-based diagnostics and remote-maintenance traffic on the same infrastructure.^[7]

This is a useful reminder that “protocols over Ethernet” includes both IP-based application protocols and real-time industrial mechanisms operating closer to the data-link layer.

EtherCAT proves that Ethernet does not require TCP/IP

EtherCAT places its payload directly in a standard Ethernet frame and identifies the frame with EtherType 0x88A4. ETG explicitly notes that TCP/IP or UDP/IP can be omitted for short cyclic process data.^[8]

So an EtherCAT cable still carries Ethernet frames, but the cyclic field communication is not a normal TCP session. The separate EtherCAT vs traditional Ethernet guide explains that architecture in more detail.

POWERLINK separates the real-time cycle from asynchronous traffic

Ethernet POWERLINK is an IEEE 802.3-based real-time Ethernet system. openPOWERLINK documents Managing Node and Controlled Node roles, cyclic PDO exchange and an asynchronous path that can expose virtual Ethernet/IP communication.^[9]

This allows time-critical machine data and less critical Ethernet/IP services to coexist under a scheduled communication model.

BACnet/IP brings building automation onto IP/Ethernet networks

BACnet is widely used in building automation. BACnet/IP transports BACnet over IP networks and classic B/IP addressing combines the IP address with a UDP port. Current ASHRAE material describes that UDP-based B/IP model explicitly.^[10]

That is why HVAC controllers, room controllers and building-management systems can share ordinary Ethernet/IP infrastructure while still using BACnet as the application protocol.

CC-Link IE Field is a deterministic Gigabit-Ethernet field network

CC-Link IE Field is described by CLPA as a Gigabit Ethernet-based field network with deterministic cyclic communication and separate transient information communication. The family also covers motion and safety use cases.^[11]

CC-Link IE Field Network Basic is a different profile designed for standard Ethernet-stack implementation and coexistence with TCP/IP. Even inside one technology family, the exact profile matters.

VLAN, LLDP, STP and LACP are network-control mechanisms rather than application protocols

802.1Q VLAN segments a bridged Ethernet network logically. LLDP advertises device identity and capabilities to neighbors. STP/RSTP/MSTP prevent unwanted Layer-2 loops. LACP groups multiple physical links into one logical link.

Legacy material often labels LACP as “802.3ad.” That history is understandable, but the current Link Aggregation standard is IEEE 802.1AX.^[12]

A single machine can use several protocols at the same time

A real machine may run fast I/O and servo axes on EtherCAT, exchange controller data over EtherNet/IP or Modbus TCP, expose plant data to SCADA through OPC UA, publish selected values to an MQTT broker, monitor switches with SNMP and still provide HTTPS web interfaces for maintenance.

That does not mean every traffic type should share one uncontrolled switch. Real-time control, bandwidth and cybersecurity requirements may justify VLANs, managed switches, separate segments or a completely separate field network. The Ethernet security and industrial cybersecurity guides address that part of the design.

Quick comparison

Why can the link be up while communication still fails?

A lit Ethernet link LED proves only that the physical link is established. Useful data exchange also requires compatible upper layers. A PLC configured only as a Modbus TCP server will not exchange process data with a device expecting an EtherNet/IP scanner/originator relationship, even when the cable and IP configuration are correct.

A practical diagnostic path is link → MAC/VLAN → IP/subnet → TCP/UDP service → application protocol → device data model. The Ethernet data-transmission and how Ethernet works guides help separate those layers.

Related OtomasyonAVM guides

• What is Ethernet?
• How does Ethernet work?
• Ethernet frame structure
• MAC address
• Data transmission in Ethernet
• Ethernet network security
• What is EtherCAT?
• What is EtherNet/IP?
• What is PROFINET?
• What is POWERLINK?
• Modbus guide
• What is BACnet?
• Industrial communication

Technical references

[1] IEEE — IEEE 802.3, Ethernet physical and MAC framework. IEEE 802.3

[2] ODVA — EtherNet/IP uses TCP/IP for explicit messaging and UDP/IP for real-time I/O. EtherNet/IP

[3] OASIS — MQTT 5.0 transport requirements; TCP/IP/TLS are common transports. MQTT 5.0

[4] OPC Foundation — OPC UA transport mappings for UA TCP, HTTPS and WebSockets. OPC UA Mappings

[5] Modbus Organization — Modbus TCP/IP specifications and Modbus application-layer model. Modbus Specifications

[6] ODVA — EtherNet/IP, CIP, TCP/IP and UDP/IP. ODVA EtherNet/IP

[7] PROFIBUS & PROFINET International — PROFINET real-time communication and parallel TCP/IP services. PROFINET System Description

[8] EtherCAT Technology Group — EtherCAT payload in Ethernet frame, EtherType 0x88A4, cyclic data without TCP/IP. EtherCAT Technology

[9] openPOWERLINK — IEEE 802.3-based real-time Ethernet with Managing/Controlled Node roles and asynchronous IP channel. openPOWERLINK

[10] ASHRAE — BACnet/IP address model uses IP address plus UDP port. BACnet/IP

[11] CC-Link Partner Association — CC-Link IE Field deterministic cyclic and transient communication on Gigabit Ethernet. CC-Link IE Field

[12] IEEE — Link Aggregation is standardized under IEEE 802.1AX. IEEE 802.1AX