Suricata

We are implementing support for EtherNet Industrial Protocol(ENIP) and Common Industrial Protocol(CIP) for SCADA. This will provide the ability to write rules for detecting CIP service, class and attribute. As well as detection for the ENIP command (useful for storm rules)

Information on the protocol can be found here:
http://literature.rockwellautomation.com/idc/groups/literature/documents/wp/enet-wp001_-en-p.pdf

Specification (big file!)
http://read.pudn.com/downloads166/ebook/763211/EIP-CIP-V1-1.0.pdf