ethernet-ip-device-discoverylisted

## When to Use - Building the CIP-side asset list for a segment. - Checking which devices expose port 44818 and what identity they advertise. - Investigating connection storms or unknown CIP nodes reported by the controller. - Pre-firewall-review flow inventory on an EtherNet/IP island. ## Prerequisites - tshark 4.x. Verify with `tshark --version`. - nmap 7.94 or newer with the `enip-info` NSE script. - SPAN port or network TAP on the island. - Credentials: none for List Identity or Identity Object reads. - Authorization: segment owner sign-off for active identity queries. - Upstream skills: `passive-ot-network-discovery` for the flow baseline. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Captures and inspects traffic. Sends no packets. Safe to run during normal operations. ## Workflow 1. Resolve the ENIP and CIP field names for this tshark revision: `tshark -G fields | grep -iE "enip|cip" | head -40` Use the resolved names in the commands below. 2. Passive flow map: `tshark -r capture.pcapng -Y "enip or cip" -T fields -e ip.src -e ip.dst -e tcp.port -E separator=, | sort -u > cip_flows.csv` 3. Extract List Identity responses where present: `tshark -r capture.pcapng -Y "enip.command == 0x0063" -T fields -e ip.src -e <resolved-identity-field> | sort -u > identity.txt` Decision point: if no List Identity frames exist, the segment has no UDP 2222 broadcast identity traffic in the window. Do not tre