August 11, 2026 · How-To

How to Read Allen-Bradley Tags Without RSLinx or FactoryTalk

The received wisdom is that to talk to an Allen-Bradley PLC you need RSLinx (or its successor, FactoryTalk Linx) running on Windows. That is what Rockwell sells, and for a long time it was the only practical option. It is no longer true. The protocol the PLC speaks — EtherNet/IP carrying CIP tag services — is publicly documented, and any client that implements it can browse and read tags directly. No Rockwell driver layer, no Windows.

This guide walks through what actually happens when you read a tag from a ControlLogix or CompactLogix controller, so you understand why RSLinx is optional. For the protocol background, see the CIP protocol guide.

What RSLinx Actually Does

RSLinx is a driver layer. It manages EtherNet/IP sessions, browses the network, resolves tag names, and presents a uniform API to Studio 5000, FactoryTalk View, and other Rockwell products. It is convenient if you live entirely inside the Rockwell ecosystem. The cost is that it is Windows-only, licensed for industrial use, and a heavy dependency for any non-Rockwell tool that merely wants to read a tag value.

The Sequence on the Wire

Reading a tag named Tank1.Level from a Logix controller is four protocol steps:

1. RegisterSession — open a TCP connection to port 44818 and send a RegisterSession command (encapsulation command 0x0065). The PLC returns a session handle.
2. List tags (optional) — query the Logix tag object (CIP class 0x6B) to enumerate every controller tag with its name, type, and size. This is the self-description step — the PLC hands you its tag database.
3. Read Tag — send a CIP Read Tag service (0x4C) with the symbolic path for Tank1.Level and the element count. The PLC returns the raw bytes.
4. Decode — interpret the bytes against the tag's CIP data type (DINT, REAL, STRING, UDT...).

Writes are symmetric: service 0x4D (Write Tag) carries the new value with its type. See explicit vs implicit messaging for where this fits in the wider protocol.

Why This Works on Any Platform

Every step above is plain TCP plus a documented binary protocol. There is no COM object, no .NET runtime, no Windows registry. That means a native client on Linux, macOS, or embedded Rust can do exactly what RSLinx does. The open-source libplctag library and tools built on it prove the point on every platform. The only thing that was ever Windows-specific was Rockwell's packaging, not the protocol.

Doing It on macOS

MacTools EtherNet/IP Explorer implements the full sequence natively. You type the PLC IP, connect, and the tool handles session registration, enumerates the tag database, and lets you read or write any tag — decoding DINTs, REALs, STRINGs, and user-defined types automatically so Tank1.Level shows as 74.3, not a hex blob. No RSLinx, no FactoryTalk, no Parallels.

When You Still Need RSLinx

• You are programming the PLC in Studio 5000 (tag browsing inside the IDE).
• You need legacy DH+/ControlNet/serial drivers RSLinx Classic exposes.
• Your FactoryTalk application integrates tightly with the Linx gateway.

For monitoring, ad-hoc reads, data extraction, and SCADA integration, none of those apply — and the protocol is enough on its own.

Frequently Asked Questions

Do I need RSLinx to read Allen-Bradley tags?

No. RSLinx and FactoryTalk Linx are Rockwell's proprietary driver layers, but the underlying protocol (EtherNet/IP encapsulation plus CIP tag services) is publicly documented. Any client that implements RegisterSession, the tag-listing service on the Logix tag object (class 0x6B), and CIP Read Tag (0x4C) / Write Tag (0x4D) can browse and read tags directly without Rockwell software.

What port does EtherNet/IP use to read tags?

TCP port 44818 for explicit (request-response) messaging, which is what tag browse, read, and write use. UDP port 2222 carries implicit (cyclic I/O) data. UDP 44818 also carries the ListIdentity broadcast used for device discovery.

Can I read ControlLogix tags from Linux or macOS?

Yes. Because the EtherNet/IP tag protocol is open and platform-independent, native tools exist for non-Windows platforms. MacTools EtherNet/IP Explorer implements the protocol natively in Rust on macOS; on Linux, libs like libplctag provide a C library for the same operations.

Why can a tool read tags by name on a Logix controller?

Allen-Bradley Logix controllers (ControlLogix, CompactLogix) publish their tag database over CIP. A client queries the tag object class to enumerate every tag with its name, data type, and size, then resolves a tag name to a symbolic path and reads it. This self-description is what makes tag-based addressing possible without an external register map.

Further Reading

• EtherNet/IP and CIP Protocol Explained
• CIP Explicit vs Implicit Messaging
• EtherNet/IP ListIdentity: How Device Discovery Works
• EtherNet/IP Explorer for macOS