UDP 2222
Synopsis
- UDP port 2222 is officially assigned to EtherNet/IP (CIP) for implicit (I/O) messaging.
- Industrial devices use it for cyclic I/O data, including Rockwell Automation/Allen‑Bradley ControlLogix and CompactLogix PLCs, Kinetix drives, and POINT I/O adapters (e.g., 1734‑AENTR).
- Other EtherNet/IP products using UDP/2222 include Omron NJ/NX PLCs, Schneider Electric Modicon controllers/adapters, and Beckhoff TwinCAT when configured as an EtherNet/IP scanner/adapter.
- Software such as Rockwell RSLinx/FactoryTalk Linx acts as an EtherNet/IP scanner and uses UDP/2222 to maintain real‑time I/O connections.
- Security note: UDP/2222 is a common target for ICS reconnaissance; exposed EtherNet/IP services have been used to enumerate device info and, in weakly secured deployments, to impact PLC state, as noted in multiple ICS‑CERT advisories.
Observed activity
Last 30 days
Detailed chart