Kaspersky Industrial CyberSecurity for Networks

Connections description file: connections.csv

March 22, 2024

ID 129113

A connections description file contains the IDs of connections, codes of application-layer protocols, and full network addresses of devices.

The file should begin with header strings containing the data needed for file processing. An example of header strings of the connections.csv file is provided below.

Example:

'Connections

'Format Version V1.0.0.0;KICS Importer Version V1.0.0.0

'Field separator: ; Decimal separator: . Text quotes: " Var name separator: .

'Connection;Protocol;Address

The first three header strings are identical to the header strings in the devices.csv file.

The string Connection;Protocol;Address contains the names of columns with data:

  • Connection – connection ID for description files.

    Connection ID is used to link protocols to devices and tags.

  • Protocol – code of the application-level protocol. The following protocol codes are used:
    • 0 – MODBUS TCP
    • 1 – SIEMENS S7COMM over TCP
    • 2 – SIEMENS S7COMM over INDUSTRIAL ETHERNET
    • 3 – MITSUBISHI MELSEC SYSTEM Q
    • 4 – ALLEN-BRADLEY ETHERNET/IP
    • 5 – IEC 61850 MMS
    • 6 – IEC 61850 GOOSE
    • 7 – IEC 60870-5-104
    • 8 – GENERAL ELECTRIC SRTP
    • 9 – IEC 61850 SAMPLED VALUES
    • 10 – SIEMENS S7COMMPLUS over TCP
    • 11 – EMERSON DELTAV
    • 12 – OMRON FINS over UDP
    • 13 – MMS for ABB AC 800M
    • 14 – YOKOGAWA VNET/IP
    • 15 – CODESYS V3 GATEWAY over TCP
    • 16 – DNP3
    • 17 – OMRON FINS over TCP
    • 18 – OPC UA BINARY
    • 19 – DMS for ABB AC 700F
    • 20 – OPC DA
    • 21 – OMRON FINS over ETHERNET/IP
    • 22 – CODESYS V3 GATEWAY over UDP
    • 23 – BECKHOFF ADS/AMS
    • 24 – IEC 60870-5-101
    • 25 – FOXBORO FCP280 / FCP270 INTERACTION
    • 26 – BSAP
    • 27 – HONEYWELL CONTROLEDGE 900 INTERACTION
    • 28 – WMI INTERACTION
    • 29 – HONEYWELL EXPERION INTERACTION
    • 30 – MiCOM C264 INTERACTION
    • 31 – SCHNEIDER ELECTRIC UMAS
    • 32 – TASE.2
    • 33 – PROFINET IO
    • 34 – DIRECTLOGIC INTERACTION
    • 35 – BACNET
    • 36 – YARD
    • 37 – COS
    • 38 – IPU-FEU INTERACTION
    • 39 – VALMET DNA INTERACTION
    • 40 – CODESYS V2
    • 41 – PNU20
    • 42 – GENERAL ELECTRIC EGD
    • 43 – KNXnet/IP
    • 44 – DTS
  • Address – a string containing the full network address of the device, which is specific to the given protocol.

    Example:

    Connection with the Schneider Momentum controller (one IP address):

    "Barline1";0;"IP-Address=192.168.0.7;Port=502"

    Connection with the Mitsubishi System Q controller (one IP address, two ports):

    "Station1";3;"IP-Address=192.168.0.8;Port=5001 Network=0;Station=0;PC=255"

    "Station1";3;"IP-Address=192.168.0.8;Port=5002 Network=0;Station=0;PC=255"

    Connection with the redundant Siemens S7-400 controller, two controllers (two IP addresses, one set of tags):

    "S7$Program";1;"IP-Address=192.168.0.21;Port=102;Rack=0;Slot=2"

    "S7$Program";1;"IP-Address=192.168.0.22;Port=102;Rack=0;Slot=2"

    The connection with the Siemens S7-400 controller uses two protocols: S7Comm over the TCP/IP stack, and S7Comm over the Industrial Ethernet network (one set of tags):

    "S7$Program";1;"IP-Address=192.168.0.21;Port=102;Rack=0;Slot=2"

    "S7$Program";2;"MAC=00:01:02:03:04:05;Rack=0;Slot=2"

The header strings are followed by the file body containing the values of parameters (connection ID, application-level protocol code, full network address of the device). An example of the connections.csv file is provided below.

Example:

'Connections

'Format Version V1.0.0.0;KICS Importer Version V1.0.0.0

'Field separator: ; Decimal separator: . Text quotes: " Var name separator: .

'Connection;Protocol;Address

"ms_plc";3;"IP-Address=192.168.0.77;Port=1025"

"mc_SysQ";7;"IP-Address=192.168.0.77;Port=2404;Asdu=555"

The format of the device network address in the file connections.csv depends on the type of protocol used.

Example:

The following address formats can be used for protocols supported by Kaspersky Industrial CyberSecurity for Networks:

  • MODBUS TCP:

    "IP-Address=192.168.0.7;Port=502"

  • SIEMENS S7COMM over TCP:

    "IP-Address=192.168.0.7;Port=502;Rack=0;Slot=2"

  • SIEMENS S7COMM over INDUSTRIAL ETHERNET:

    "MAC=00:01:02:03:04:05;Rack=0;Slot=2"

  • MITSUBISHI MELSEC SYSTEM Q:

    "IP-Address=192.168.0.7;Port=502;Network=0;Station=0;PC=255"

  • ALLEN-BRADLEY ETHERNET/IP:

    "IP-Address=192.168.0.7;Port=44818"

  • IEC 61850 MMS:

    "IP-Address=192.168.0.7;Port=502;Domains=IED_0009CTRL,IED_0009PROT;Vendor=SIEMENS;Model=Siprotec-6MD66x"

  • IEC 61850 GOOSE:

    "Domains=IED_0009CTRL,IED_0009PROT;Vendor=SIEMENS;Model=Siprotec-6MD66x"

  • IEC 60870-5-104:

    "IP-Address=192.168.0.7;Port=104;Asdu=2"

  • GENERAL ELECTRIC SRTP:

    "IP-Address=192.168.0.50;Port=18245"

  • IEC 61850 SAMPLED VALUES:

    "MAC=00:01:02:03:04:05;Domains=IED_TRANSFORMER1;Vendor=TMW;Model=IED"

  • SIEMENS S7COMMPLUS over TCP:

    "IP-Address=192.168.0.22;Port=102"

  • EMERSON DELTAV:

    "IP-Address=192.168.0.38;Port=18507"

  • OMRON FINS over UDP:

    "IP-Address=192.168.0.1;Port=9600"

  • MMS for ABB AC 800M:

    "IP-Address=192.168.0.60;Port=102"

  • YOKOGAWA VNET/IP:

    "IP-Address=192.168.0.4;Port=5313"

  • CODESYS V3 GATEWAY over TCP:

    "IP-Address=192.168.0.4;Port=11740"

  • DNP3:

    "IP-Address=192.168.1.10;Port=20000"

  • OMRON FINS over TCP:

    "IP-Address=192.168.0.1;Port=9600"

  • OPC UA BINARY:

    "IP-Address=192.168.0.213;Port=49320"

  • DMS for ABB AC 700F:

    "IP-Address=192.168.0.7;Port=9991"

  • OMRON FINS over ETHERNET/IP:

    "IP-Address=192.168.0.1;Port=44818"

  • OPC DA:

    "IP-Address=192.168.0.7;Port=135"

  • CODESYS V3 GATEWAY over UDP:

    "IP-Address=192.168.0.7;Port=1740"

  • BECKHOFF ADS/AMS:

    "IP-Address=192.168.0.7;Port=48898"

  • IEC 60870-5-101:

    "IP-Address=192.168.0.7;Port=950"

  • FOXBORO FCP270, FCP280 INTERACTION:

    "MAC=00:00:6C:C0:00:0A"

  • BSAP:

    "IP-Address=192.168.0.7;Port=1234"

  • HONEYWELL CONTROLEDGE 900 INTERACTION:

    "IP-Address=192.168.1.99;Port=41103"

  • HONEYWELL EXPERION INTERACTION:

    "IP-Address=192.168.1.10;Port=55553"

  • SCHNEIDER ELECTRIC UMAS:

    "IP-Address=192.168.0.7;Port=502"

  • TASE.2:

    "IP-Address=192.168.0.20;Port=102"

  • PROFINET IO:

    "MAC=00:01:02:03:04:05;\IP-Address=192.168.0.20;\Frame=IDS_TEL352"

  • DIRECTLOGIC INTERACTION:

    "IP-Address=192.168.0.70;Port=28784"

  • BACNET:

    "IP-Address=192.168.5.200;Port=47808"

  • YARD:

    "MAC=00:01:02:03:04:05\;IP-Address=192.168.12.1\;Port=2002"

  • COS:

    "IP-Address=192.168.1.131;Port=3077"

  • IPU-FEU INTERACTION:

    "IP-Address=192.168.5.200;Port=57005"

  • VALMET DNA INTERACTION:

    "IP-Address=192.168.10.11;Port=2519"

  • CODESYS V2:

    "IP-Address=192.168.7.200;Port=1210"

  • PNU20:

    "IP-Address=192.168.7.200;Port=43962"

  • GENERAL ELECTRIC EGD:

    "IP-Address=192.168.0.51\;Port=18246"

  • KNXnet/IP:

    "IP-Address=192.168.10.76;Port=3671"

  • DTS:

    "IP-Address=192.168.50.11;Port=30000"

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.