{
  "port": 8016,
  "protocol": "tcp",
  "service": "Beckhoff Secure ADS (ads-s)",
  "oneLiner": "Beckhoff's secure ADS channel — an industrial control protocol, on an industrial network.",
  "whatItIs": "IANA assigned 8016/tcp to Beckhoff Automation in 2019 as ads-s, for the Automation Device Specification protocol that TwinCAT devices use to talk to each other and to engineering workstations. ADS is the control plane of a Beckhoff PLC: reading and writing process variables, and starting and stopping the runtime. The 8016 registration specifically covers the secure, certificate-authenticated variant; routine ADS traffic uses a different, unregistered port, so 8016 appears where Secure ADS has been turned on.",
  "exposure": {
    "verdict": "never",
    "note": "This is a PLC command channel. Even in its secure form it belongs on a segmented OT network behind a firewall, reached through a jump host — an exposed ADS endpoint is physical-process risk, not just data risk."
  },
  "checkCommand": "nmap -sV -Pn -p 8016 TARGET",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 8016 (ads-s, Beckhoff)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=8016",
      "kind": "iana"
    }
  ],
  "ianaName": "ads-s"
}