Supported Protocols and Queries

This page lists the currently supported OT, IT, IoT and IoMT protocols for passive detection and active querying within Forescout Platform for OT. Our engineering team updates this page regularly to extend the asset discovery and threat detection capabilities for additional assets and vendors as we come across more systems and improve and expand the platform.

Protocols:

1. Standard OT/IoT Protocols

Art-Net IEC 60870-5-101 OPC_UA
BACnet IEC 60870-5-104 PMCN
CC-Link (Field, FieldBasic, Control) KNX/IP PROFINET (RPC, RTC, RTA, DCP and PTCP)
DLMS/COSEM MMS - ICCP TASE.2 RTPS
DNP3 MMS - IEC61850 SES_92
EtherCAT / EtherCAT Routable Modbus ASCII SLMP
EtherNet/IP - CIP - PCCC Modbus RTU SYNCHROPHASOR (IEEE C37.118)
Foundation Fieldbus HSE Modbus TCP Sox
GOOSE MQTT UTMC (based on SNMP)
HART OPC_CLASSIC (DCOM)  

2. Proprietary OT/IoT Systems/Protocols

ABB_CNCP (ABB 800xA DCS) DELTAV_IO (Emerson DeltaV DCS) Keyence devices SADP (Hikvision)
ABB_IAC_MMS (ABB 800xA DCS) DELTAV_MGMT (Emerson DeltaV DCS) Kingfisher devices SAPLING_DISCOVERY (Sapling)
ABB_NIS (ABB 800xA DCS) DELTAV_UPGD (Emerson DeltaV DCS) Kongsberg NET_IO (Kongsberg K-Pos, K-Bridge DCS) SCHNEIDER_SYSAP (Schneider)
ABB_RNRP (ABB 800xA DCS) DELTAV_WGP (Emerson DeltaV DCS) KMC Controls BAS devices SAIA_SBUS (Saia Burgess)
ABBDMS (ABB 800F / Freelance DCS) DEMATIC Lantronix gateways ScanSnap Discovery Protocol
ABB Melody (ABB AC870P DCS) Desigo (Siemens) LonTalk (LonWorks) SEL_FM (SEL)
ABB_NETCONFIG (ABB AC500 PLCs) DIGI_REALPORT (Digi) MACHINE_EXPERT_DISCOVERY (Schneider Electric) SEL_RTAC_ONLINE (SEL)
ABB Totalflow DIGSI4 (Siemens) MELSOFT (Mitsubishi Electric) SICK_DISCOVERY (Sick)
ADE (Phoenix Contact) EATON_IPP (Eaton UPSes) Meggitt Vibrometers Siemens Apogee P2
Advantech ASCII Command ECOM (Host Engineering) MMS (ABB 800xA) S7COMM+/OMSPlus (Siemens)
AMAG_SYMMETRY (Amag) Eurotherm PRP Modbus/TCP Unity (Schneider Electric) SPlus, SPlusPortMap (ABB SymphonyPlus)
AMS (Beckhoff) Experion CDA, CDAPortMap, DSA, HMI, PointBuilder, SafetyManager, SRP, SrvDiscovery, SrvHeartbeat, SrvRDT (Honeywell Experion DCS) Modbus/TCP Concept (Schneider Electric) STARDOM Resconf (Yokogawa)
APC PowerChute (Schneider Electric) Experion PHD (Honeywell Experion Historian) Modbus/TCP Modicon (Schneider Electric) Step7 (Siemens)
Atop Technologies gateways FANUC C4 (Fanuc Robotics America) Modbus/TCP SoMachine Basic (Schneider Electric) SUPREMA_BIOSTAR (Suprema)
AUTOMATIONDIRECT_SYSTEM (AutomationDirect) Festo protocols (FESTO_FGMC, FESTO_WAY, FESTO_FCL, FESTO_KMC, FESTO_CI) Monarch (OSI) TCF (Target Communication Framework protocol)
AUTROCOM (Autronica) Fox (Niagara / Tridium) Motorola IPGW (Motorola) Trend Controls IQ/IC
BN_TDI_CMD (Bently Nevada System-1) GE_ADL (GE MarkVI and MarkVIe) MSP (Mercury Security) Triconex Protocol Suite: TSAA, TRICONEX_TMI, TRICONEX_DNLD, TRICONEX_NET_CTRL Tristation, TRICONEX_P2P (Schneider Electric / Invensys / Triconex)
BN_TDI_HOST (Bently Nevada 3500) GE_EGD / GE_CMP (GE) MTL8000_MATRIX (MTL Instruments) UBIQUITI_DISCOVERY (Ubiquiti)
BSAP / BSAP_IP (Bristol Babcock) GE_GSM (GE MarkVI and MarkVIe) Nexthink (Nexthink Analytics) UCA2_GOOSE
BSAP_IP_TIMESYNC (Bristol Babcock) GE_SDB (GE Mark VI and MarkVIe) NMKD-3085 UNI_TE (Schneider Uni-TE)
Centum ODEQ (Yokogawa Centum / ProSafe DCS) GE_SDI (GE MarkVI and MarkVIe) NovaTech Orion Unitronics PCOM
Centum CAMS (Yokogawa Centum / ProSafe DCS) GE_WorkstationST_IntercomPeer (GE MarkVIe) OASyS, OASyS PubSub (Schneider Electric) URMS 2070
Centum TREND (Yokogawa Centum / ProSafe DCS) GE_iFIX_N2N (GE iFix) Omniflex CONET/E VESTAS_FIRECREST, VESTAS_ROADRUNNER (Vestas Wind Turbines)
C-NET (Mitsubishi Wind Turbines) GE_iFIX_PDB_SYNC (GE iFix) OMRON_FINS Vnet/IP (Yokogawa)
Citect (Schneider Electric) GE_SRTP (GE PACSystem / Fanuc) OSISOFT_PI (OsisoftPI) VNET_IP_WAN / VNET_IP_WAN_HEARTBEAT (Yokogawa)
CMP-Link (Toyoda / Toyopuc / Jtekt) GE_HISTORIAN_API (GE Proficy Historian) Ovation IO, LOG, REM_IO, RT, ALARM_IO, CD, DB_XMIT, PE, PQ, PR, REDUND, SL, SOE, SYS_REG (Emerson Ovation DCS) Wartsila NACOS Platinum
CodeSys V2 (used by Wago, ABB, and other PLC vendors) H1 / S5 (Siemens / Sinec) PAKBUS (Campbell Scientific) Wavetronix Z1
CodeSys V3 (used by Schneider and other PLC vendors) HONEYWELL_ICW (Honewyell InControlWare WCS) PANASONIC_BOOTP (Panasonic) Wonderware Historian (HCAL)
COGNEX_DISCOVERY (Cognex) HONEYWELL_MERCURY PN800 (ABB Harmony) Wonderware SuiteLink (WWIOTALK)
COGNEX_MASTERSLAVE (Cognex) HONEYWELL_VOCOLLECT PROCONOS_SOCOMM (multiple vendors) Wonderware System Platform (ARCHESTRA_NMXSVC)
COMEX (Schneder Electric Foxboro) IbaPDA S7 PROSOFT_DISCOVERY (Prosoft Technology) Zebra Technologies devices over HTTP or TCP/4200
CP2179 (Cooper / PG&E) ICONICS_GENBROKER PVSS (Siemens) ZENON_NETSRV (COPA-DATA)
CRESTRON_IP (Crestron) IoIP (Intercom Over IP, Commend) QNAP_DISCOVERY (QNAP)  
CSLib (ABB 800xA DCS) ION (Schneider Electric, Siemens) QDP (Q-Sys discovery protocol)  
CSP - PCCC (Rockwell) ISaGRAF IXL (Yokogawa ProSafe & others) Raymond iWarehouse  
CygNet SCADA (CygNet) Kaba Benzing access control devices ROC / ROC Plus (Emerson)  

3. IT Protocols

AFP LDAP RIP
BGP LDP RTCP
BitTorrent LLDP RTP
BJNP LSD RTSP
CAPWAP_CONTROL MCAFEE_RELAY_SRV_DISCOVERY SDDP
CAPWAP_DATA MNDP Sentinel_LDK
CCP (CheckPoint cluster protocol) MSMQ SIP
CDP MSSQL SLP/SRVLOC
Cisco_Auto_RP MySQL SMB
Cisco_HSRP NetSupport SMTP
Cisco_SCCP (also known as SKINNY) NFS SNMP
Cisco_SMI NTP SSDP/UPNP
DCOM NMF (.NET Messaging Framework) SSH
DHCP NRTP SSL
DHCPv6 NetBIOS SSRP
DNS OpenRDA STP
DTLS OpenVPN SunRPC
DTP Oracle TNS TACACS_PLUS
FTP OSPF TeamViewer
FTPDATA POP3 Telnet
GLBP PostgreSQL TFTP
HSR_PRP_SUPERVISION PTP VXLAN
HTTP Radius Windows IOT protocols (Sirep_Broadcast, Sirep_WPCon, WIOT_DISCOVERY)
IMAP RADMIN WireGuard
IPMI RDP WUDO (Windows Update Delivery Optimization)
ISAKMP RESP  
Kerberos RFB/VNC  

4. IoMT Protocols

Abbott I-Stat GE RWHAT (GE Healthcare) Philips Respironics
Abbott Xceed GE Unity (GE Healthcare) POCT1-A (covers Nova Biomedical, Roche, Siemens, Abbott)
Aeroscout (Stanley) GEMNet (Instrumentation Laboratory) PTS Translogic (Swisslog)
Alaris DCMP (BD) Getinge Rauland Responder
Alaris Gateway (BD) Hamilton Siemens SDXI
Baxter Sigma HillRom Servo (Maquet)
BBraun (over HTTP) HL7 Smiths Medical
Cadi Scientific Hospira (proprietary and over HTTP) Vitek (BioMerieux)
Centrak Star Iris IQ200 (Beckman Coulter) Vocera Badge Signaling
Corometrics (GE Healthcare) iSirona XML (Masimo) VOXP (Viasys)
Datex-Ohmeda COM (GE Healthcare) LIS2 (covers also ASTM, E1394-37) WACP (Welch Allyn)
Datex-Ohmeda ARS5 (GE Healthcare) Masimo Patient Monitors 0PAD (BD Pyxis)
DICOM Mindray MD2  
Draeger Infinity Omnicell (via MSMQ)  
ELI Link (Welch-Allyn) Philips Avalon  
GE MAC (GE Healthcare) Philips Data Export  

Queries:

1. Generic Queries

  • Active IPS
  • OS Fingerprinting
  • Selected OT Ports
  • Windows WMI/WINRM

2. OT/BAS Protocol Fingerprinting

  • BACnet
  • Beckhoff ADS
  • DNP3
  • EtherNet/IP
  • Fox
  • KNX
  • Melsec R
  • Modbus
  • Omron Fins
  • PCWorx
  • ProConOS
  • Profinet RPC
  • SEL/IED Ethernet
  • SEL/RTAC
  • Siemens S7
  • Toyopuc
  • Unitronics PCOM

3. IT/IoT Protocol Fingerprinting

  • Cognex
  • Crestron/IP
  • Custom Queries
  • Dahua DHIP
  • FTP
  • HTML Title
  • HTTP Favicon
  • HTTP NTLM
  • HTTP Server
  • Lantronix Discovery
  • mDNS
  • ONVIF Device Service
  • RDP NTLM
  • RTSP server
  • SIP client
  • SIP server
  • SMB
  • SNMP Printers Info
  • SNMP SysDesc
  • SNMP SysObjectID
  • SSH
  • SSL
  • Telnet
  • UPnP
  • WS-Discovery ONVIF

4. IoMT Protocol Fingerprinting

  • DICOM

5. Integration

  • MS SCCM
  • Switches (SNMP)
  • Cisco WLC
  • Active Directory

Don't see a protocol here?

Contact us and we will assist with adding official support in a future release or guidance on how to build it yourself.