Skip to main content
IMMUNITYSEC

Port 2222: EtherNet/IP I/O

IANA registers port 2222 (TCP and UDP) for EtherNet/IP I/O and port 44818 for EtherNet/IP messaging. Both ports carry CIP traffic to industrial controllers. Port 2222 is also used outside industrial networks, for example as the default SSH port of the Cowrie honeypot.

2222
TCP / UDP

Port Details

Port
2222
Transport
TCP / UDP
Service
EtherNet/IP I/O
IANA service name
EtherNet-IP-1, EtherNet/IP-1
Range
User port (1024-49151)
Related ports
44818

Security Exposure

CISA advisory ICSA-13-011-03 describes Rockwell Automation controllers that could be reset, stopped into a fault state or reconfigured when they received valid CIP messages from unauthorized or unintended sources on TCP or UDP 2222 and 44818. In those products, network reachability decided who could influence the process. Industrial devices reachable from business networks or the internet extend that risk to a much larger population.

Hardening

  • +Block all traffic to EtherNet/IP and other CIP devices from outside the manufacturing zone, including TCP and UDP 2222 and 44818, as the CISA advisory recommends.
  • +Place controllers behind an industrial firewall or UTM appliance that supports CIP message filtering.
  • +Apply vendor firmware updates for affected controllers and communication modules.
  • +Segment control networks from enterprise IT networks and route remote access through a managed jump host.

Monitoring

Use OT network monitoring to baseline which hosts talk to controllers on 2222 and 44818, and alert on CIP commands that change controller mode or configuration from unexpected sources.

Tools for Auditing and Monitoring EtherNet/IP I/O

Conpot

Open Source
Honeypot & Deception Tools

Low-interaction ICS/SCADA honeypot simulating industrial controllers and protocols.

LicenseGPL-2.0-or-later
PlatformLinux

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Wireshark

Open Source
Network Monitoring Tools

Network packet analyzer and protocol inspection tool for capturing live traffic and debugging network communications in detail.

LicenseGPL-2.0-or-later
PlatformWindows, macOS, Linux, BSD

Related Tool Categories

Network Monitoring Tools→

Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.

OT/ICS Security Tools→

Industrial network monitoring, ICS protocol analysis, and OT asset inventory platforms.

Frequently Asked Questions

What is port 2222 used for?→

IANA assigns port 2222 to EtherNet/IP I/O for industrial automation. Some software, such as the Cowrie honeypot, also uses 2222 as its default SSH port.

What is the difference between EtherNet/IP ports 2222 and 44818?→

IANA registers 2222 for EtherNet/IP I/O and 44818 for EtherNet/IP messaging. CISA ICS advisories recommend restricting both ports to the manufacturing zone.

Is port 2222 TCP or UDP?→

IANA lists both TCP and UDP for EtherNet/IP I/O on 2222, and CISA advisory ICSA-13-011-03 references both transports.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 2222 is not guaranteed to be EtherNet/IP I/O. Exploited-in-the-wild data from the CISA KEV catalog (CC0).