KNX IP Secure encrypts the entire IP communication between IP devices.

KNX IP Secure wraps complete KNXnet/IP frames (both routing multicast and tunneling unicast) inside an additional encrypted envelope based on AES-128 CCM with sequence numbers, so that the whole IP payload — including addresses and service identifiers — is confidential on the LAN. This protects the IP backbone against passive sniffing and active replay even if an attacker is connected to the same network segment. Data Secure can still be layered inside, giving defence-in-depth on both transport and application layers.

Use KNX IP Secure on every project where the IP backbone touches a general-purpose LAN; combining it with Data Secure on sensitive groups gives a robust two-layer protection.