Omron FINS Controller Discovery With OTserver
Overview
Factory Interface Network Service (FINS) is used by Omron controllers and related automation products. OTserver sends a fixed controller-information request to identify supported devices without reading or changing process memory.
How OTserver discovers Omron FINS devices
For each ARP-discovered IPv4 address, OTserver queries TCP and UDP port 9600 concurrently. UDP uses the fixed FINS Controller Data Read command (05 01). TCP first completes the FINS node-address handshake, then sends the same controller-information command with the assigned node address.
The parser verifies FINS/TCP framing where applicable, response length, response type, status, service ID, command code, and minimum controller-data length before retaining evidence.
Evidence extracted
| OTserver evidence | FINS response field |
|---|---|
| Vendor | Omron for a valid controller response |
| Model and name | Controller model |
| Firmware | Controller version |
| Capacity evidence | Program area, I/O memory, DM words, timers/counters, steps, and expansion DM |
| Memory card evidence | Memory card kind and size |
| Network evidence | Responding TCP and/or UDP port |
Non-zero controller status codes become warnings rather than fabricated identity values.
Security and read-only safety
Controller Data Read requests controller metadata. OTserver does not send FINS Memory Area Write, force operations, mode changes, program transfers, or other state-changing commands. It sends at most the fixed handshake and identity request on each available transport.
Frequently asked questions
Must an Omron controller support both TCP and UDP?
No. A valid response from either transport is sufficient. OTserver records which of TCP and UDP port 9600 responded.
Does the scan read PLC process memory?
No. The implementation uses Controller Data Read for controller identity and capacity metadata, not Memory Area Read or Write.
Compare all supported discovery protocols or configure the scanner.