Function Code Inspection

Unlike simple port-based filtering, function code inspection parses the application-layer payload to understand the exact operation being requested. For example, it distinguishes between a Modbus Read Coils (FC01) request, which is passive, and a Write Single Coil (FC05) request, which actively changes a physical state. This allows a firewall to enforce a policy that permits a specific PLC to read data from a remote terminal unit but explicitly blocks any write commands from that same source, preventing unauthorized actuation.

Advanced inspection engines maintain a state machine for each industrial session. This tracks the expected sequence of commands. A critical alert is generated if a Function Code 8 (Diagnostics) sub-function is sent to a controller that is currently in a 'Run' state, as this combination is a known technique for denial-of-service attacks against PLCs. The system understands that certain diagnostic commands are only legitimate during a maintenance window or 'Stop' mode, enforcing a temporal and state-based security policy.

This technique validates the data payload associated with a write command. For a DNP3 Direct Operate (FC05) command, the system inspects the output point index and the value being written. A rule can be defined to block any command that attempts to set an analog output value outside a pre-defined safe operating range, such as a pressure setpoint exceeding a physical safety limit. This prevents malicious manipulation that stays within the correct protocol syntax but violates the physics of the industrial process.

The core technology relies on protocol dissectors that fully decode serial-based protocols encapsulated in TCP/IP. The engine must reassemble fragmented packets and extract specific byte offsets to identify the function code. For Modbus TCP, this involves stripping the MBAP header to find the Protocol Data Unit (PDU). The inspection engine then compares the extracted function code against a dynamic whitelist, generating a Zeek conn.log entry with the specific function code metadata for threat hunting.

In OT environments, a default-deny whitelist approach is standard. The inspection engine is configured with a finite list of authorized function codes per device pair. For instance, an engineering workstation may be authorized to send Code 0x2B (Read Device Identification) to a relay, but a historian server is only authorized for Code 0x01 (Read Coils). Any function code not on the explicit whitelist is blocked and flagged as an anomaly, providing immediate protection against zero-day exploits that use obscure or vendor-proprietary function codes.

Mature inspection goes beyond the primary function code to analyze sub-function codes. A Modbus FC 08 (Diagnostics) command has over a dozen sub-codes. Sub-code 0x000A (Clear Counters and Diagnostic Register) is purely informational, while sub-code 0x0001 (Restart Communications Option) forces a logic re-initialization. The inspection engine must parse these two bytes to differentiate a benign status query from a disruptive command that could cause a loss of view for operators.

A security enforcement model that defines an explicit allowlist of permitted function codes for each device pair in the ICS network. For example, a Human-Machine Interface (HMI) may be authorized to issue Read Holding Registers (03) but blocked from executing Write Multiple Coils (15) to a PLC. Whitelisting operates on the principle of default-deny, blocking any command not explicitly authorized, which catches zero-day exploits that signature-based systems miss.

An advanced evolution of protocol whitelisting that validates commands against the current operational state of the industrial process. A Write Single Register (06) command to start a pump may be permitted during normal operation but blocked if the system is in emergency stop or maintenance mode. This context-aware inspection prevents valid function codes from being exploited at dangerous moments, correlating network commands with the physical process state.

A statistical model of normal function code patterns established by observing ICS traffic over weeks or months. The baseline captures typical sequences—such as a PLC polling cycle that alternates between Read Discrete Inputs (02) and Read Input Registers (04) every 500ms. Deviations like an unexpected Force Single Coil (05) command or a sudden burst of write operations trigger anomaly alerts, enabling detection of compromised engineering workstations.

Recurrent neural networks trained to predict the next expected function code in a SCADA communication sequence. By learning the temporal dependencies between commands—such as a Read Holding Registers (03) typically preceding a Preset Multiple Registers (16) during setpoint changes—the model flags out-of-sequence commands as potential replay attacks or unauthorized control actions. LSTMs capture long-range patterns that simple threshold-based detectors miss.