Connect and browse

What you will be able to do

• You can list a server's endpoints and read the security each one offers.
• You can explain the difference between a secure channel, a session and a subscription.
• You can navigate an address space you have never seen and find real data in it.
• You can write a NodeId reference that survives a PLC program download.

Syllabus

1. 1
   Call GetEndpoints before anything else

   The first request you should ever make. What comes back, how to read it, and why connecting with security None first is a diagnostic step and not a security decision.

   Asset Full EndpointDescription output from three different servers, annotated

   8 min
2. 2
   Read an endpoint URL properly

   Scheme, host, port and path. Why the path matters, why the host in the URL and the host in the certificate must agree, and what the server advertises versus what you dialled.

   Asset Four endpoint URLs, three of which fail, with the exact reason for each

   7 min
3. 3
   Follow the secure channel and session lifecycle

   Hello, OpenSecureChannel, CreateSession, ActivateSession: in order, with what can fail at each step and which status code tells you where you are.

   Asset A Wireshark capture of a full connection handshake with each message labelled

   9 min
4. 4
   Keep a session alive, and know when it died

   Session timeout, keep-alive, and the difference between a dead connection and a quiet one.

   Asset A terminal transcript of a session timing out, with the client's log lines

   7 min
5. 5
   Meet the eight NodeClasses

   Object, Variable, Method, ObjectType, VariableType, ReferenceType, DataType, View. What each is for and which ones you will actually touch.

   Asset One real node of each NodeClass from a live server, with its attributes listed

   8 min
6. 6
   Read the address space as a graph, not a tree

   References are typed and directional. HasComponent, Organizes, HasProperty and HasTypeDefinition mean different things, and a client that treats them alike gets lost.

   Asset The same node's references browsed in both directions, with the reference type on each

   9 min
7. 7
   Take a NodeId apart

   Namespace index plus identifier, in four identifier flavours. What is stable and what is not.

   Asset The same node's NodeId in numeric, string, GUID and opaque form, from a real server

   7 min
8. 8
   Resolve namespaces the right way

   Read NamespaceArray at connect, map URI to index, and store the URI. The one habit that prevents the most common production breakage in OPC UA.

   Asset NamespaceArray from two servers exposing the same model at different indexes

   9 min
9. 9
   Use browse paths instead of browsing everything

   TranslateBrowsePathsToNodeIds when you know the model, RegisterNodes for hot paths, and why recursive browsing on every startup is a scaling bug.

   Asset Timed comparison of recursive browse versus browse-path resolution on a large address space

   7 min
10. 10
    Survive a large address space

    MaxReferencesPerNode, BrowseNext continuation points, and filtering on reference type and NodeClass instead of pulling everything.

    Asset A browse of a 40,000-node address space with and without filtering, with both timings

    7 min

Lab

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.