Understanding OPC UA Beyond Port 4840

OPC UA is often identified by TCP port 4840, but a connection to that port is only the beginning of what is happening between a client and server.

Unlike protocols built mainly around direct memory access, OPC UA exposes an information model. Clients can browse objects and variables, follow references, read values, write to permitted nodes and call methods.

From Discovery to Services

A typical OPC UA client interaction can include several stages.

The client may first discover available servers and endpoints. It can then establish a SecureChannel, create a Session and begin using OPC UA services.

Common operations include:

• Browse — explore the address space
• Read — retrieve values and attributes
• Write — change permitted variables
• Call — execute methods
• Subscribe — monitor changes

The address space can contain objects, variables, methods, references and NodeIds that identify individual elements within the server.

Security Is Part of the Protocol

OPC UA includes security mechanisms as part of its architecture.

Endpoints may expose different security modes, including None, Sign and SignAndEncrypt. Application certificates can be used for application identity, while user authentication is handled separately.

For monitoring, this means that identifying an OPC UA connection is not enough.

Useful investigation questions include which endpoint was selected, which security mode was used, which application and user connected, which NodeId was accessed and which service operation followed.

Preparing Mindrock

We are currently preparing Mindrock around this workflow.

The environment combines OPC UA with a chemical process model, Suricata network monitoring and an ELK stack.

The objective is to connect protocol activity with defensive evidence so an analyst can move from “there was traffic on port 4840” to understanding what actually happened inside the OPC UA session.

Mindrock is still being prepared. We will share more once the end-to-end workflow has been tested.