Werkspilot
    ← Insights

    EtherNet/IP SBOM: how one ListIdentity broadcast identifies every device in the subnet

    In brief · As of October 2026

    Every EtherNet/IP device carries the CIP Identity Object (class 0x01) with Vendor ID, Device Type, Product Code, Revision (Major.Minor), Status, serial number and product name. A ListIdentity broadcast (UDP 44818) in the subnet returns all eight attributes of every device in one pass – no session, no controller; this is exactly what RSLinx does on "Browse". For the plant SBOM, it is the fastest collection there is. Two gaps: the Product Code is a manufacturer-internal number, the catalogue number is usually found only in the product name – and modules in a ControlLogix chassis do not answer individually.

    The Identity Object is present in every CIP device

    The Identity Object (class 0x01, instance 1) is part of the mandatory scope of every device that passes the ODVA conformance test. Attributes 1 to 7 are standard:

    AttributeContentMeaning for the device list
    1 Vendor IDUINTManufacturer as ODVA number (1 = Rockwell Automation); resolved through vendor lists
    2 Device TypeUINTDevice profile (0x0E controller, 0x0C communications adapter)
    3 Product CodeUINTManufacturer-internal product number – not the catalogue number
    4 RevisionMajor.MinorFirmware revision, the comparison value for "prior to 36.013" in Rockwell advisories
    6 Serial NumberUDINTSerial number, unique only together with the Vendor ID
    7 Product Nameup to 32 charactersProduct name – at Rockwell usually contains the catalogue number ("1756-L83E/B")

    There is no attribute for the hardware revision and no dedicated field for the order number. The catalogue number has to be read from the product name, whose format the manufacturer defines.

    ListIdentity captures the subnet in one pass

    The encapsulation command ListIdentity (0x63) needs no registered session. Sent as a UDP broadcast to port 44818, every EtherNet/IP device in the local subnet answers with its IP address and the identity attributes. Across routers, the same works as unicast per host. The method is layer 3, read-only and so widespread that every device has to handle it – it is the mechanism behind the RSWho window. Tools such as nmap --script enip-info or the libraries pycomm3 and EIPScanner speak it directly.

    For the complete attributes (such as attribute 8 State or manufacturer-specific extensions), explicit messaging with Get_Attributes_All over TCP 44818 is required; for the device list, ListIdentity is enough.

    What EtherNet/IP does not provide

    • Modules in the chassis: a ControlLogix rack or a POINT I/O station shows one identity per IP address; the modules behind it are reachable only via CIP routing through port and slot. They come from the Studio 5000 project or a targeted routing scan.
    • The catalogue number as a field: Product Code is manufacturer-internal; the product name is free text of 32 characters. Rockwell writes the catalogue number into it, other manufacturers not always.
    • The firmware notation: Revision 36.13 in the Identity Object corresponds to "36.013" in the advisory – the leading zero has to be added, otherwise the comparison fails.
    • A public vendor list: the ODVA assigns Vendor IDs but publishes no simple table; tools such as nmap and Wireshark maintain their own lists with around 1,500 entries.
    • Suppressed answers: some controllers can be configured not to answer ListIdentity. Then the only path is through the project.

    What this means for the plant SBOM

    • At acceptance (FAT), run a ListIdentity broadcast per subnet and take product name, revision and serial number per device; derive the catalogue number from the product name.
    • Add chassis modules from the engineering project and list them as items under the adapter IP.
    • Store the firmware as Major.Minor with a three-digit minor so that Rockwell advisories can be compared without rework – details in the article on Rockwell and the plant SBOM.
    • Capture Stratix switches additionally via SNMP; there the serial number and firmware are in the ENTITY-MIB.

    All 13 manufacturers compared: SBOM by manufacturer →

    Trial Werkspilot Scan on your own plant.

    We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.

    Ask about the development partnership →

    Werkspilot Scan reads these fields from the maintenance PC, read-only and with a fixed request list, and keeps them per plant. This article describes the state of the specifications at the time of publication.

    Frequently asked questions

    Vendor ID (ODVA number, 1 = Rockwell), Device Type, Product Code (manufacturer-internal), Revision as Major.Minor, Status, serial number and product name with up to 32 characters; optionally the state. Attributes 1 to 7 are present in every conformant CIP device. There is no hardware revision and no dedicated catalogue number field; at Rockwell the catalogue number is in the product name.

    With a ListIdentity broadcast (encapsulation command 0x63) as a UDP packet to port 44818. Every device in the subnet answers without a session with its IP address and identity attributes – the same mechanism RSLinx uses on Browse. Across routers it needs unicast per host. Modules in a chassis do not answer individually and have to be added via CIP routing or from the project.

    No, it is a read-only standard service that engineering tools send all the time. What is risky are port scans and malformed packets on old stacks; an inventory tool should use only ListIdentity and read-only Get-Attribute services, with a fixed port list and without write access.