Skip to main content
OT Atlas
Search

Open / standardized

Modbus TCP

Modbus RTU's application layer carried over TCP/IP, normally on port 502. It is trivially readable, unauthenticated by default and one of the most widely deployed industrial protocols.

502/TCPTCPEncryption: No

How it works

A client opens a TCP session to a server (usually a controller) and sends MBAP-framed requests carrying a function code and register range. The server answers with data or an exception.

Communication patternHMI / SCADA client → controller (server) on 502/TCP → response.

Fact sheet

TransportTCP
Ports502/TCP
AuthenticationNone
PurdueLevel 2 – Level 1
EnvironmentsPlant control networks, SCADA polling, Gateways
DevicesPLC, HMI, SCADA server, Gateway, VFD
IndustriesWater / Wastewater, Manufacturing, Building Automation, Oil & Gas

Why should I care?

Understanding Modbus TCP is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.

Key functions and operations

  • Read coils
  • Read registers
  • Write coil / register
  • Read device identification
  • Diagnostics

Security concerns

  • No authentication or session integrity in the base specification
  • Write function codes can change process values if a host is reachable
  • Flat networks expose 502/TCP far more widely than the process requires
  • Internet-exposed Modbus endpoints are repeatedly reported by public scanning research

What normal looks like

  • A small, stable set of client IPs per controller
  • Consistent poll interval
  • Read-dominant traffic

What deserves attention

  • A new source IP speaking 502/TCP to a controller
  • Write function codes from a host that has only ever read
  • Register enumeration sweeps across address ranges

Hunting ideas

  • protocol-write-activity
  • ot-network-scanning
  • new-device-control-zone

Defensive controls

  • Deny-by-default conduits; permit 502/TCP only between named endpoints
  • Terminate cross-zone polling at an industrial DMZ service
  • Passive monitoring with industrial protocol awareness

Related ATT&CK for ICS techniques

T0855T0836T0846
Packet-level notes+
  • Display filter `modbus` isolates the application layer for baseline review
  • Track `modbus.func_code` distribution per source to separate read-only clients from writers

Sources & further reading