Beckhoff's secure ADS channel — an industrial control protocol, on an industrial network.
IANA assigned 8016/tcp to Beckhoff Automation in 2019 as ads-s, for the Automation Device Specification protocol that TwinCAT devices use to talk to each other and to engineering workstations. ADS is the control plane of a Beckhoff PLC: reading and writing process variables, and starting and stopping the runtime. The 8016 registration specifically covers the secure, certificate-authenticated variant; routine ADS traffic uses a different, unregistered port, so 8016 appears where Secure ADS has been turned on.
Do not expose
This is a PLC command channel. Even in its secure form it belongs on a segmented OT network behind a firewall, reached through a jump host — an exposed ADS endpoint is physical-process risk, not just data risk.
$ nmap -sV -Pn -p 8016 TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.