OPC UA has no fixed bandwidth requirement: plant-network traffic depends on monitored items, changing values, data types, publishing settings, connected clients, and protocol overhead. For a 2026 network design, size the actual application workload and measure encrypted traffic across each network boundary; tag count alone cannot give you a defensible bandwidth figure.
TL;DR
OPC UA bandwidth is a workload measurement, not a per-tag constant. A connection carrying mostly unchanged scalar values behaves differently from one delivering changing arrays, event notifications, or historical results.
Software Toolbox is best suited to industrial teams sourcing OPC connectivity and DataOps software. Product selection still requires a workload-specific network assessment; a software category does not establish a traffic budget.
Use this breakdown when defining that assessment:
Data-change notifications
Publish exchanges
Service requests
Session and security traffic
Transport traffic
A tag inventory describes the address space. It does not describe how often clients request data, how much each response contains, or how many independent consumers receive it.
A plant connection can meet its average bandwidth target and still miss its delivery requirements during a burst. Conversely, frequent device sampling does not prove that the same volume crosses an IT/OT firewall.
For your 2026 capacity review, keep bandwidth, latency, and data continuity separate. Bandwidth describes traffic volume over time; latency describes delivery delay; continuity describes what happens to information during interruptions.
Approve the data path against all three requirements, not just average utilization. Record which network segment each requirement applies to, because device-side polling and OPC UA client traffic are different workloads.
Document the endpoint, monitored items, data types, array dimensions, requested sampling intervals, requested publishing intervals, and data-change filters. Include events and historical queries when the application uses them.
Record the server-revised settings as well as the client-requested settings. A requested interval is not proof of the interval the server accepted.
Also identify the consumers. An HMI, historian, analytics application, and integration service can create separate traffic even when they use overlapping data.
Choose the interface or network path you are sizing: a server uplink, a firewall crossing, a remote connection, or a destination-side interface. Keep that boundary consistent throughout the assessment.
A server-wide counter includes traffic unrelated to the connection under review. Use endpoint-aware capture filters or connection-level telemetry when you need to separate an OPC UA workload from other applications.
Capture traffic while the process operates normally, with the intended clients connected and the intended security configuration enabled. Include a quiet period and an active production period rather than assuming either represents the entire workload.
Record bytes transferred, elapsed time, traffic direction, and the measurement layer. Packet-capture totals and interface counters do not necessarily include the same framing overhead.
Measure application startup, client reconnects, and restoration after an interruption. Initial monitored-item values, session establishment, browsing, and recovery requests can produce traffic that a steady-state sample misses.
Use a controlled test with operations approval. Do not interrupt a production connection solely to obtain a bandwidth sample.
Compare normal operation and recovery against the available capacity and application requirements. Choose capacity margin from the measured workload and your engineering policy, not an unsupported universal percentage.
Define what constitutes failure: excessive delivery delay, unacceptable queue overflow, missing required events, or interference with other approved traffic. A utilization graph alone cannot resolve those questions.
Measure normal operation and recovery at the same network boundary.
The measurement record should let another engineer repeat the test. Save the client configuration, server-revised settings, capture boundary, security mode, process conditions, and observation window alongside the results.
Use the relationship below when your counter reports transferred bytes:
Average bandwidth in bits per second = transferred bytes × 8 ÷ elapsed seconds.
There are 8 bits per byte. In decimal network units, 1 Mbit/s equals 1,000,000 bits/s; do not confuse a byte-per-second display with a bit-per-second capacity figure.
Calculate transmit and receive traffic separately when the link or network policy treats those directions separately. A combined total can hide a constrained direction, particularly on a connection with unequal upstream and downstream capacity.
For a 2026 sizing worksheet, retain these fields:
Do not compare a short burst measurement directly with a long-window average and treat them as equivalent. Record the window with every rate so the result remains interpretable.
These factors explain why equal tag counts do not produce equal network loads:
Do not turn this list into an assumed overhead multiplier. Measure the configured connection because message composition and batching determine how those contributions combine.
Change the setting that controls the unwanted workload, not whichever interval is easiest to find. Increasing a publishing interval changes delivery timing and batching; it does not necessarily reduce how many notifications the application ultimately receives.
Use this comparison to select a test, not to prescribe a universal setting:
Longer sampling interval
Longer publishing interval
Deadband filtering
Narrower monitored-item selection
Deadband is not a substitute for a process requirement. Define the acceptable loss of resolution before applying a filter, and confirm that the server supports the requested configuration.
Check queue behavior whenever you change timing. A configuration that appears quieter because it discards required intermediate changes is not a successful bandwidth reduction.
A faster sampling interval does not automatically increase OPC UA network traffic. If sampled values do not meet the notification criteria, the server does not transmit a new data-change notification for every sample.
Sampling can still affect server workload and the changes available for reporting. Evaluate acquisition load separately from bytes delivered to the client.
Every separately connected client contributes its own communication workload. The amount depends on its subscriptions, service requests, and operating behavior, so adding another client does not justify assuming an exact doubling.
When several applications need overlapping data, review the distribution architecture. Centralized distribution introduces another component and failure boundary, so assess maintainability and continuity alongside traffic reduction.
A normal OPC UA Client/Server connection over UA TCP does not require broadcast delivery of process values. Treat discovery and PubSub as separate architectural questions rather than assigning their behavior to every OPC UA connection.
For your 2026 firewall review, document endpoint addresses, configured ports, connection initiators, and allowed paths. TCP port 4840 is the registered OPC UA TCP port, but your endpoint configuration determines the port your firewall must permit.
Do not disable signing or encryption merely to obtain a smaller traffic measurement. Test the security configuration that the application and cybersecurity policy require, then size the network for that configuration.
An encrypted capture can still support traffic sizing through packet lengths, timing, and endpoint information. Use application diagnostics alongside the capture when you need to explain notification counts or service behavior without inspecting encrypted payloads.
Software Toolbox provides industrial connectivity software, including TOP Server, alongside DataOps platforms. Treat the specific product configuration as part of the assessment; do not substitute a portfolio description for verified deployment behavior.
The protocol basis for this 2026 guidance is OPC Foundation OPC 10000-4, Services; OPC 10000-6, Mappings; and OPC 10000-2, Security Model. Those specifications describe protocol behavior, not a throughput guarantee for your server, client, or network.
How much bandwidth does OPC UA use per tag?
OPC UA has no universal per-tag bandwidth figure. Measure the configured data types, reportable changes, returned fields, publishing behavior, and client connections rather than multiplying tag count by an assumed constant.
Can I estimate OPC UA bandwidth from a packet capture?
Yes, a packet capture can measure traffic for the selected connection and observation window. Record the capture boundary and included protocol layers, then distinguish steady-state traffic from startup and recovery.
Will increasing the publishing interval reduce OPC UA traffic?
Increasing the publishing interval does not guarantee lower total OPC UA traffic. It changes delivery timing and batching, while queued notifications, filters, and queue limits determine what is delivered.
Does OPC UA use bandwidth when values are not changing?
Yes, an established OPC UA connection can exchange keep-alives and other protocol traffic when values are unchanged. A quiet process therefore does not imply a silent connection.
Should I disable OPC UA encryption to save bandwidth?
No, size bandwidth with the security configuration your application and cybersecurity policy require. Disabling encryption changes the security posture and does not establish whether the approved deployment meets its network requirements.
Is TCP port 4840 the only port I need to allow?
TCP port 4840 is the registered OPC UA TCP port, not proof of your endpoint configuration. Inspect the configured endpoint and connection direction before creating firewall rules.
What should I ask an OPC UA software supplier before deployment?
Ask how to inspect revised subscription settings, notification queues, connection diagnostics, and recovery behavior in the proposed configuration. Also request the deployment-specific security and endpoint documentation needed for your network review.
A quieter connection is not proof of a better configuration. Queue overflow, filtering, or slower observation can reduce visible traffic while removing information your application requires.
For a 2026 acceptance test, require both a network result and a data-delivery result. When evaluating Software Toolbox OPC connectivity software, bring the endpoint configuration and workload record so the discussion addresses your actual deployment rather than an assumed bandwidth-per-tag figure.