Industry consortium
PROFIBUS
A widely installed fieldbus predating industrial Ethernet, still carrying a large share of process I/O in older plants.
N/A — fieldbusRS-485 serial (DP) / MBP (PA)Encryption: NoLegacy
How it works
A master cyclically exchanges I/O images with addressed slaves on a token-passing / master-slave bus.
Communication patternClass 1 master ↔ slaves cyclic exchange; class 2 master for diagnostics.
Fact sheet
TransportRS-485 serial (DP) / MBP (PA)
PortsN/A — fieldbus
AuthenticationNone
PurdueLevel 1 – Level 0
EnvironmentsLegacy field networks, Process instrumentation
DevicesPLC, Remote I/O, Transmitter, Valve positioner
IndustriesChemical, Oil & Gas, Manufacturing
Why should I care?
Understanding PROFIBUS is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Cyclic data exchange
- Diagnostics
- Parameterisation
Security concerns
- No security controls at all
- Requires physical access, so cabinet security matters more than network rules
- Invisible to standard network monitoring
What normal looks like
- Stable slave count and diagnostic status
What deserves attention
- Unexplained bus diagnostics or address changes
- Live-list changes outside maintenance
Hunting ideas
- new-device-control-zone
Defensive controls
- Physical security of panels
- Use gateway diagnostics as a telemetry source
- Document the bus inventory in the asset register
Related ATT&CK for ICS techniques
T0842
Sources & further reading