UADP

Where UADP actually runs

Four transport mappings matter. UDP, addressed as opc.udp:// with unicast or multicast, and the DTLS variant opc.dtls://; raw Ethernet Layer 2, opc.eth://, using OPC Foundation EtherType 0xB62C with no IP and no UDP header at all, and optional 802.1Q tagging where the VLAN id and priority are given as vid and pcp query parameters on the address; MQTT, where the profile is pubsub-mqtt-uadp; and AMQP, which Part 14 specifies but which has essentially no open implementation, so treat it as specified and unused. The default UDP discovery address is opc.udp://224.0.2.14:4840. Raw Ethernet needs CAP_NET_RAW or root on Linux, which is why it is a machine-builder technology rather than an IT-network one.

What is on the wire

A NetworkMessage begins with a version and flags byte, then optional PublisherId, group header with WriterGroupId, payload header listing the DataSetWriterIds present, optional timestamp, picoseconds and promoted fields, then the DataSetMessages themselves. Almost everything is optional and selected by NetworkMessageContentMask and DataSetMessageContentMask, so two implementations can both be conformant and produce completely different byte layouts for the same data. The message types are key frame, delta frame, event, keep-alive, DataSetMetaData and discovery.

Nothing on the wire is self-describing

UADP carries values and field indexes, not names or types. The schema lives in DataSetMetaData, which the subscriber either has configured locally or has received in a DataSetMetaData message. This is the whole reason a PubSub subscriber can receive traffic correctly at the network layer and still show you nothing: it has the bytes but no contract to decode them against.

UADP security has no session

There is no handshake to negotiate keys in, so PubSub uses symmetric group keys distributed by a Security Key Service and identified by SecurityGroupId. The cryptography is AES-128-CTR or AES-256-CTR for encryption with HMAC-SHA-256 for integrity, plus a replay window checked against the message sequence number. Signing without encryption is available and is usually the right choice on a closed cell network, because it authenticates the publisher without costing you packet-capture visibility.

Example

The four UADP address forms you will actually type into a configuration

opc.udp://239.0.0.1:4840          # UDP multicast, the classic machine-to-machine case
opc.udp://224.0.2.14:4840         # default PubSub discovery multicast address
opc.eth://01-00-5E-00-00-01?vid=100&pcp=6   # raw Ethernet II, EtherType 0xB62C, VLAN 100, priority 6
mqtt://broker.plant.local:1883    # UADP payload over MQTT (profile pubsub-mqtt-uadp)

Defined in: Part 14 - PubSub, UADP message mapping.

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.