EtherNet/IP
EtherNet/IP is an industrial Ethernet protocol that carries the Common Industrial Protocol (CIP) over standard TCP/IP and UDP. Managed by ODVA and widely used with Rockwell Automation controllers, it is one of the three protocols most often found on cement, mining, and aggregates plant floors.
Explicit messaging for configuration and diagnostics runs over TCP port 44818; implicit, real-time I/O traffic runs over UDP port 2222, often multicast. Because it is ordinary Ethernet, EtherNet/IP devices are reachable by anything on the same network, which is exactly why segmentation matters.
The protocol has no built-in authentication in its base form. CIP Security adds it for devices that support it, but most installed equipment does not.
Why it matters in cement, mining, and aggregates
Monitoring tuned to EtherNet/IP can tell a normal controller-to-HMI conversation from a new device issuing CIP commands. Generic IT monitoring sees both as TCP traffic. That is the difference between an OT monitoring baseline and a packet counter.
Source: ODVA, EtherNet/IP