CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// IoT & industrial (ICS)

Port 44818: EtherNet/IP

Industrial Ethernet protocol (Rockwell / Allen-Bradley PLCs).

CIP
44818

How EtherNet/IP works

IoT & industrial (ICS)
controllerPLCCIP writeno authentication controllerPLCCIP writeno authentication

A controller sends commands to an industrial device on port 44818, which acts on the physical process. It travels in clear text: anyone on the path can read it.

Transport
TCP · UDP
Exposure risk
9/10 critical if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned2 registered services
Range
Registered (1024-49151)
Category
IoT & industrial (ICS)
01 Security

Is port 44818 dangerous?

Common attacks and weaknesses

  • Device enumeration and unauthenticated control.

How to secure it

  • Isolate OT networks and monitor with ICS-aware IDS.
02 Registry

IANA registry entries for port 44818

ServicePortTransportDescriptionReferenceUpdated
EtherNet-IP-2 44818 TCP, UDP EtherNet/IP messaging IANA assigned this well-formed service name as a replacement for "EtherNet/IP-2". - -
EtherNet/IP-2 44818 TCP, UDP EtherNet/IP messaging - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 44818, and is it reachable?

Linux

sudo ss -ltnup 'sport = :44818'      # process listening on 44818
sudo lsof -nP -i :44818

macOS

sudo lsof -nP -i :44818

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 44818 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 44818
netstat -ano | findstr :44818

From another machine

nmap -p 44818 -sV <host>
sudo nmap -sU -p 44818 <host>
nc -zv <host> 44818

Block it in the firewall

sudo ufw deny 44818/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 44818" -Direction Inbound -LocalPort 44818 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 44818 used for?

Industrial Ethernet protocol (Rockwell / Allen-Bradley PLCs).

Is port 44818 TCP or UDP?

Port 44818 is registered for TCP and UDP.

Is it safe to open port 44818?

It is rated 9/10 (critical) when exposed to the Internet. Device enumeration and unauthenticated control. Isolate OT networks and monitor with ICS-aware IDS.

How do I check if port 44818 is open?

On Linux run "ss -ltnup 'sport = :44818'", on macOS "lsof -nP -i :44818", and on Windows "netstat -ano | findstr :44818" to see the local process. From another machine, "nmap -p 44818 <host>" shows whether it is reachable.

05 Related
:1883 MQTT tcp · udp · high risk :8883 MQTT over TLS tcp · udp · moderate risk :502 Modbus TCP tcp · udp · critical risk :102 Siemens S7 (ISO-TSAP) tcp · udp · critical risk :47808 BACnet udp · tcp · critical risk :20000 DNP3 tcp · udp · sctp · critical risk :802 Modbus Application Protocol Secure tcp · udp :2221 EtherNet/IP over TLS tcp · udp

Latest vulnerability news

All news