August 11, 2026 · Reference

EtherNet/IP Port 44818 Explained: TCP, UDP 2222, and Firewall Rules

Every EtherNet/IP device listens on the same registered port: 44818. But ask "is 44818 TCP or UDP?" and the honest answer is "both, plus a second port." EtherNet/IP actually uses two ports for three jobs, and getting them wrong on a firewall is one of the most common reasons an Allen-Bradley system works on the bench but fails when the IT department gets involved.

This is a compact reference to which port does what, and how to configure firewalls without breaking the protocol. For the protocol layers underneath, see the CIP protocol guide; for the messaging types these ports carry, see explicit vs implicit messaging.

The Three Port/Protocol Combinations

TCP 44818 — explicit messaging. Session registration, tag browse, tag read, tag write, configuration. This is what SCADA and monitoring tools use. See reading tags.
UDP 2222 — implicit (cyclic I/O) messaging. The real-time connection between a Logix controller and its remote I/O and drives, exchanging data at the configured RPI.
UDP 44818 — the ListIdentity discovery broadcast. One packet out, many identity replies back. See ListIdentity discovery.

The split: TCP 44818 for reliable request-response. UDP 2222 for deterministic cyclic I/O (TCP's flow control would wreck the timing). UDP 44818 only for discovery broadcasts.

Firewall Rules

For a controller and its clients to reach EtherNet/IP devices, the firewall between them must permit:

TCP 44818 — both directions for the session (client-initiated).
UDP 2222 — for any cyclic I/O connection to function.
UDP 44818 — only if you rely on broadcast ListIdentity discovery; otherwise omit it and configure device IPs explicitly.

Restrict these rules to the specific OT subnet and hosts that need them. A blanket "allow 44818 from anywhere" is a serious exposure — see the security note below.

Common Failure Modes

Tag reads work, I/O does not. TCP 44818 is open but UDP 2222 is blocked. The controller cannot establish the cyclic connection to remote I/O.
Discovery finds nothing. UDP 44818 broadcast is blocked or the device is on another subnet (broadcasts do not cross routers).
Works locally, breaks across a VPN. The VPN tunnels TCP but drops or fragments the UDP 2222 cyclic traffic.
NAT breaks implicit messaging. Cyclic I/O embeds connection IDs that NAT translation can mangle. EtherNet/IP devices generally belong on a flat, unrouted OT subnet.

Security

Classic EtherNet/IP has no authentication and no encryption. Anyone who can reach TCP 44818 can browse and write tags. That makes the firewall posture non-negotiable: keep 44818 and 2222 on an isolated OT network, never exposed to the internet. For remote access, use a VPN or an outbound-only secure tunnel into the OT subnet rather than port-forwarding. CIP Security (the newer profile-based extension) adds certificates and signing, but adoption is still uneven across the installed base — assume a new device is unsecured until you confirm otherwise.

Testing Ports from macOS

MacTools EtherNet/IP Explorer opens the TCP 44818 session and exercises the explicit-messaging path end to end — a quick way to confirm the port is reachable and the PLC responds before you escalate to a firewall ticket. Native macOS app; no RSLinx.

Reach Allen-Bradley PLCs on macOS

MacTools EtherNet/IP Explorer — connect on TCP 44818, browse tags, read and write CIP values. Confirm reachability and protocol health from a native macOS app.

Get MacTools EtherNet/IP Explorer

Frequently Asked Questions

What is EtherNet/IP port 44818 used for?

Port 44818 is the registered EtherNet/IP port. TCP 44818 carries explicit (request-response) messaging including tag browse, read, and write. UDP 44818 carries the ListIdentity broadcast used for device discovery. A related port, UDP 2222, carries implicit (cyclic I/O) messaging. Both 44818 and 2222 must be reachable for a full EtherNet/IP deployment.

Why does EtherNet/IP use both port 44818 and port 2222?

They serve different messaging classes. TCP 44818 handles explicit messaging — the reliable, connection-based, request-response traffic used for tags and configuration. UDP 2222 handles implicit messaging — the cyclic, low-overhead, real-time I/O data exchanged at a fixed RPI. Splitting them lets the cyclic I/O traffic bypass TCP's flow control for deterministic timing.

Should I expose EtherNet/IP port 44818 to the internet?

No. EtherNet/IP has no built-in authentication or encryption for classic deployments — anyone who can reach TCP 44818 can read and write tags. Keep the protocol on an isolated OT network behind a firewall. For remote access, use a VPN or an outbound-only secure tunnel (like WireGuard) into the OT subnet rather than port-forwarding 44818.

How do I open EtherNet/IP ports on a firewall?

Permit TCP 44818 and UDP 2222 (and UDP 44818 if you need discovery) between the controller/clients and the devices, restricted to the specific OT subnet hosts. Do not allow these ports from the corporate LAN or the internet. Use managed switches and ACLs to limit which clients can issue tag writes.

Related: Secure Remote PLC Access

For reaching EtherNet/IP PLCs remotely without opening inbound ports, Voltrus Remote builds an outbound-only WireGuard mesh into the OT subnet — no exposed 44818, no third-party relay.