PROFINET RT/IRT Security
PROFINET (Process Field Network) is the Industrial Ethernet successor to PROFIBUS, standardised by PROFIBUS & PROFINET International (PI). It runs over standard IEEE 802.3 Ethernet and uses standard IP for engineering and configuration traffic, while using optimised Layer 2 Ethernet frames for real-time I/O data. PROFINET is the dominant industrial protocol in German automotive manufacturing and is growing rapidly across European process industries.
PROFINET Classes
| Class | Cycle Time | Transport | Typical Use |
|---|---|---|---|
| PROFINET NRT | >100ms | TCP/IP (port 34964) | Engineering, parameterisation, SNMP |
| PROFINET RT | 1–10ms | Layer 2 Ethernet (EtherType 0x8892) | Standard I/O — drives, sensors, actuators |
| PROFINET IRT | 31.25µs–1ms | Layer 2 with synchronised hardware | Motion control, precision manufacturing |
RT and IRT frames bypass the IP stack entirely, operating at EtherType 0x8892 with no TCP/IP overhead. This makes firewall-based filtering at Layer 3 ineffective — RT/IRT traffic can only be filtered at Layer 2 by managed switches.
Security Vulnerabilities
- No authentication in RT/IRT — any Layer 2 device on the PROFINET segment can send cyclic data frames to any I/O device
- DCP (Discovery and Configuration Protocol) — PROFINET DCP (EtherType 0x8892, Service ID 5) allows any host to rename devices, change IP addresses, and reset devices to factory defaults with no credentials
- LLDP exploitation — PROFINET uses LLDP for topology discovery; injected LLDP frames can disrupt topology maps and cause controller reconfiguration
- Timing attacks on IRT — IRT relies on hardware-synchronised cycle timing; injecting frames that disrupt synchronisation causes controller E-stops
- NRT (TCP/IP) services — PROFINET NRT uses HTTPS/SNMP on standard IP; these have the usual IT vulnerabilities (default credentials, unpatched firmware)
PROFINET Security Measures
PROFINET does not have a native security extension equivalent to OPC UA's TLS or DNP3's SA. Security relies on compensating controls:
- Managed switch port security — 802.1X authentication or MAC address allow-listing per switch port
- Layer 2 ACLs — managed switches drop frames with source MACs not in the device inventory
- DCP lockdown — disable DCP name assignment and factory reset on production controllers (firmware option in Siemens ET200 and SIMATIC PN devices)
- VLAN isolation — separate PROFINET RT segment from NRT/engineering traffic VLANs
Defences
| Control | SR | Effect |
|---|---|---|
| 802.1X port authentication | SR 1.2 | Authenticate devices at switch port level |
| Disable DCP write services | SR 7.7 | Prevent device renaming and factory reset via network |
| PROFINET VLAN isolation | SR 5.1 | RT traffic isolated from NRT and IT network |
| Switch port MAC binding | SR 5.2 | Only registered device MACs can communicate on RT VLAN |
Examine PROFINET frame structure, DCP vulnerability, and Layer 2 isolation techniques in the interactive protocol lab.
Open PROFINET Protocol Lab →