Common Industrial Protocol (CIP) is a core industrial communications protocol used to exchange device, controller, and diagnostics data in OT networks. It is common in Rockwell and EtherNet/IP environments, where engineering tools, gateways, and control software rely on CIP messages to read tags, configure equipment, and coordinate automation tasks.
CIP matters in cyber security because it is trusted infrastructure: if a device, gateway, or middleware service parses CIP incorrectly, malformed packets can cause crashes, disruption, or unsafe behavior. Attackers may abuse crafted CIP traffic to trigger denial of service, while defenders look for the opposite goal: robust parsing, strict input validation, rate limiting, segmentation, and restricted access to control-system ports. In practice, CIP is not dangerous by itself, but any implementation that handles it becomes part of the attack surface.