Open / standardized
MMS (Manufacturing Message Specification)
A client/server messaging standard used as the IEC 61850 station-bus profile and by several automation platforms over TCP port 102.
102/TCPTCP (via ISO/OSI stack)Encryption: Optional
How it works
A client associates with a server, browses its variable/domain namespace and performs read, write, and control operations.
Communication patternStation client → IED association → read/write/report.
Fact sheet
Also known asISO 9506
TransportTCP (via ISO/OSI stack)
Ports102/TCP
AuthenticationOptional
PurdueLevel 2 – Level 1
EnvironmentsSubstations, Some plant automation
DevicesIED, Station gateway, SCADA server
IndustriesElectric Power
Why should I care?
Understanding MMS (Manufacturing Message Specification) is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Identify
- Read / Write named variables
- Directory browse
- File transfer
- Control
Security concerns
- Namespace browsing reveals device capability in detail
- Authentication frequently disabled in field deployments
- File services can expose configuration
What normal looks like
- Few, known client associations
- Report-based data flow rather than aggressive polling
What deserves attention
- Directory enumeration from a new host
- Write operations from a read-only client
- Repeated association attempts
Hunting ideas
- ot-network-scanning
- protocol-write-activity
Defensive controls
- Restrict 102/TCP to the station client and gateway
- Enable device-level access control where supported
Related ATT&CK for ICS techniques
T0846T0855
Sources & further reading