Rockwell Automation — 14 prefixes (MA-L)

Rockwell Automation holds 14 MA-L blocks, every one registered to the bare string "Rockwell Automation" at 1 Allen-Bradley Dr., Mayfield Heights, OH, US 44124-6118 (a registry address; the company's corporate HQ is in Milwaukee, Wisconsin). Rockwell is one of the largest industrial-automation makers in the world, and its hardware ships almost entirely under the Allen-Bradley brand: ControlLogix / CompactLogix / MicroLogix and Micro800 PLCs, PowerFlex variable-frequency drives, Stratix industrial Ethernet switches, Kinetix servo drives, PanelView HMIs, and the PlantPAx DCS and FactoryTalk software platform. These devices speak EtherNet/IP (the CIP-over-Ethernet protocol associated with TCP/UDP port 44818), plus ControlNet, DeviceNet, Modbus, and legacy DF1 serial. Because these OUIs land on operational-technology (OT) and industrial-control-system (ICS) gear rather than office equipment, a Rockwell/Allen-Bradley OUI is a strong asset-classification signal: it almost always marks a PLC, drive, HMI, or controller, frequently on a plant floor or in critical infrastructure. The security context here is unusually material and well-documented. In May 2024 Rockwell itself urged customers to disconnect from the internet any ICS device not specifically designed for public exposure, citing heightened malicious activity; Censys subsequently catalogued thousands of internet-exposed hosts self-identifying as Rockwell/Allen-Bradley over EtherNet/IP, the majority in the United States, and Iran-affiliated actors have actively targeted exposed Allen-Bradley PLCs in campaigns against water, energy, and government targets. CISA carries a long run of ICS advisories spanning Rockwell's Micro800, ControlLogix, FactoryTalk, and AADvance lines. For triage, treat a Rockwell OUI as an OT/ICS device that warrants segmentation review and should never be directly internet-exposed.

IEEE assignment

14 prefixes → "Rockwell Automation", registered 1 Allen-Bradley Dr., Mayfield Heights, OH, US 44124-6118 [Confirmed] — IEEE MA-L (enrichment/registries/oui.csv); corroborated maclookup.app/vendors/rockwell-automation

Registry / block size

MA-L only (24-bit OUI); 14 blocks. No Rockwell Automation entries exist in MA-M (mam.csv) or MA-S/OUI-36 (oui36.csv). [Confirmed] — enrichment/registries/oui.csv, mam.csv, oui36.csv. NOTE: IEEE's public OUI data publishes NO assignment/registration date (oui.csv columns are only Registry, Assignment, Organization Name, Organization Address); any "date registered" on third-party tools (e.g. a "1998-04-22" shown for 00:00:BC) is a database artifact, not an IEEE fact, and must not be displayed as an IEEE registration date.

HQ / country

1 Allen-Bradley Dr., Mayfield Heights, OH 44124-6118, US (registry address); corporate HQ is Milwaukee, WI, US. [Confirmed registry address; corporate HQ per company site] — IEEE MA-L, rockwellautomation.com/en-us/company/about-us.html

Company status

active; one of the largest industrial-automation / OT vendors globally. Lineage: founded 1903 as Allen-Bradley; acquired by Rockwell International 1985; became Rockwell Automation 2001 after the Rockwell International spin-off. [Confirmed] — rockwellautomation.com, en.wikipedia.org/wiki/Allen-Bradley

Device types

PLCs (ControlLogix, CompactLogix, MicroLogix 1400, Micro820/850/870), HMIs (PanelView / OptixEdge), variable-frequency drives (PowerFlex), industrial Ethernet switches (Stratix), servo/motion (Kinetix), I/O modules, safety/SIS (Logix SIS, AADvance), and the PlantPAx DCS + FactoryTalk software platform [Confirmed] — rockwellautomation.com/en-us/products/hardware.html

Notable products

Allen-Bradley PLC/controller line, PowerFlex drives, Stratix switches, FactoryTalk / Studio 5000

Network protocols

EtherNet/IP (CIP over Ethernet; associated with port 44818/TCP+UDP), ControlNet, DeviceNet, Modbus, legacy DF1 serial [Confirmed] — rockwellautomation.com, en.wikipedia.org/wiki/Allen-Bradley

Verified prefix sample (all MA-L, "Rockwell Automation")

00:00:BC, 00:1D:9C, 08:61:95, 34:C0:F9, 5C:21:67, F4:54:33 [Confirmed] — IEEE MA-L (enrichment/registries/oui.csv). Full 14: 00:00:BC, 00:1D:9C, 08:61:95, 18:4C:08, 34:C0:F9, 40:41:01, 44:CC:6E, 5C:21:67, 5C:88:16, 68:C8:EB, BC:F4:99, E4:8E:BB, E4:90:69, F4:54:33

Security context

In May 2024 Rockwell advised customers to disconnect from the public internet any ICS device not designed for such exposure, citing increased malicious activity. Censys reported thousands of internet-exposed hosts (~5,219) self-identifying as Rockwell/Allen-Bradley over EtherNet/IP, most in the US; Iran-affiliated actors have targeted exposed Allen-Bradley PLCs against critical-infrastructure (water/wastewater, energy, government). CISA carries numerous Rockwell ICS advisories (e.g. Micro820/850/870 CVE-2025-13823/-13824; ControlLogix ICSA-26-029-03; AADvance ICSA-25-317-10; FactoryTalk CVE-2024-21914/-21915/-21917). [Confirmed — multi-source: CISA, Bleeping Computer, Industrial Cyber, The Hacker News] — cisa.gov ICS advisories, bleepingcomputer.com, industrialcyber.co, thehackernews.com

Aggregate CVE tally

reported as ~23 critical and ~73 high-severity CVEs across CISA ICS advisories for Rockwell products (2024–2025), with several known-exploited; figure drifts and is a third-party rollup, not an official Rockwell/CISA published total. [Likely — single aggregating source] — socradar.io/blog/cisa-industrial-control-systems-ics-advisories-2025

Data note

PowerFlex 525 drives were reported shipping with duplicate MAC addresses — a real-world MAC-uniqueness failure in industrial hardware worth flagging for OUI-based asset tracking. [Likely — single source] — industrial hardware reporting (industrialmonitordirect.com search context)

Related vendors

Allen-Bradley is Rockwell's own brand (not a separate registrant); historically distinct from Rockwell Collins / Rockwell International (avoid conflation — those are unrelated entities)

Analyst note

A Rockwell/Allen-Bradley OUI almost always identifies an OT/ICS device (PLC, drive, HMI, switch). Treat its appearance as an asset-classification and segmentation signal; such devices should not be directly internet-exposed and warrant ICS-advisory tracking.