Port reference
Port 44818 (TCP/UDP) – EtherNet/IP (CIP)
EtherNet/IP encapsulating the Common Industrial Protocol — controls Allen-Bradley and other CIP PLCs and devices.
Quick facts
- Transport
- tcp, udp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on EtherNet/IP PLCs and devices (e.g. Allen-Bradley/Rockwell) with no authentication on the explicit-messaging interface.
What is port 44818 used for?
Port 44818 carries EtherNet/IP, an industrial protocol that runs the Common Industrial Protocol (CIP) for factory automation. It is the main protocol for Allen-Bradley / Rockwell programmable logic controllers (PLCs) and many other vendors' devices. Engineering software and HMI/SCADA systems use it to read a controller's identity, read and write data tags, and send commands; real-time I/O uses a companion port (UDP 2222).
When would you open it?
This port belongs on a segmented factory or plant control (OT) network, allowed only between the PLCs and the specific engineering workstations, HMIs, or SCADA servers that control them. Open it just for those device-to-device paths, behind a firewall. It should never face the internet or the office network.
Is it safe to open?
The CIP interface usually has no authentication, so anyone who reaches it could read or change controller data; keep it isolated on a dedicated OT network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :44818
nmap -p 44818 <target>netstat -ano | findstr :44818
Test-NetConnection <host> -Port 44818lsof -i :44818
nmap -p 44818 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 44818 to your device's local IP, internal port 44818, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 44818/tcpsudo firewall-cmd --permanent --add-port=44818/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 44818 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 44818" -Direction Inbound -Protocol TCP -LocalPort 44818 -Action AllowSecurity & risks
Common attacks
- Identity enumeration of vendor, product, firmware via enip-info
- Unauthenticated read/write of tags and CIP objects
- PLC stop/reset and configuration changes over CIP services
- Denial of service against controllers and adapters
Hardening
- Never expose port 44818 to the internet — isolate EtherNet/IP on an OT cell
- Segment with firewalls/DMZ and allowlist authorized controllers/HMIs
- Enable controller-side protection (trusted slots, key switch RUN mode)
- Monitor with an ICS IDS for unexpected CIP write/admin services
How to block this port
sudo ufw deny 44818/tcpsudo firewall-cmd --permanent --remove-port=44818/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 44818 -j DROPNew-NetFirewallRule -DisplayName "Block 44818" -Direction Inbound -Protocol TCP -LocalPort 44818 -Action Blocknmap snippet
nmap -p44818 --script enip-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does EtherNet/IP have authentication?
- The CIP explicit-messaging interface on port 44818 generally has no authentication, so a reachable device will return its identity and accept tag and object operations. Newer Rockwell controllers add CIP Security, but it is not widely deployed.
- What is CIP on EtherNet/IP?
- CIP (Common Industrial Protocol) is the application layer; EtherNet/IP is its encapsulation over TCP/UDP. Together they let masters read and write tags and call services on PLCs and field devices in factory automation.