Modbus TCP

Modbus TCP encapsulates the standard Modbus Protocol Data Unit (PDU) within a TCP/IP frame, replacing the serial checksum with the TCP stack's built-in error detection. The standard Modbus Application Protocol (MBAP) header adds a Transaction Identifier and Unit Identifier to route messages across Ethernet networks. Communication occurs over port 502, the IANA-assigned standard port for Modbus TCP traffic.

Unlike the master-slave terminology of serial Modbus, Modbus TCP operates on a client-server architecture. The client initiates requests, and the server processes them and returns responses. A single client can communicate with multiple servers simultaneously, and multiple clients can access the same server. This model supports concurrent transactions through unique transaction identifiers, enabling parallel data exchange across the network.

Modbus TCP retains the standard function codes for data access and control. Key operations include:

• Read Coils (FC 01): Read discrete outputs
• Read Holding Registers (FC 03): Read 16-bit analog values
• Write Single Register (FC 06): Write to a single holding register
• Write Multiple Registers (FC 16): Write a block of registers These function codes are inspected by deep packet inspection systems for anomaly detection.

Modbus TCP is fundamentally connectionless at the application layer. Each request-response pair is independent, with no session state maintained between transactions. The TCP layer handles reliable delivery, but the Modbus protocol itself does not require persistent connections. This design simplifies implementation but requires stateful whitelisting in security architectures to validate the logical sequence of commands against the industrial process state.

The Modbus data model defines four primary data tables accessible via function codes:

• Discrete Inputs: Read-only single-bit values from field devices
• Coils: Read-write single-bit outputs
• Input Registers: Read-only 16-bit analog measurements
• Holding Registers: Read-write 16-bit configuration and control values Each table supports up to 65,536 addresses, providing extensive data mapping for complex industrial systems.

Distributed Network Protocol 3 is a competing open standard to Modbus TCP, primarily used in North American electric and water utilities. Unlike Modbus TCP's simple master-slave model, DNP3 supports unsolicited reporting where remote devices can initiate communication, and includes time-stamped data for accurate sequence-of-events recording. It operates over TCP/IP but adds robust error checking and link-layer confirmation.

This security technique analyzes the specific Modbus function code within a TCP packet payload to validate its legitimacy. Key codes include:

• FC 03 (Read Holding Registers): Reads current values
• FC 06 (Write Single Register): Overwrites a single data point
• FC 16 (Write Multiple Registers): Bulk write operation Deep inspection ensures a write command to a safety-critical coil is not spoofed by an attacker.

A foundational OT security control that permits only pre-authorized Modbus TCP function codes and register ranges to traverse the network. Instead of blocking known bad signatures, it denies all traffic by default and allows only the specific read/write operations required for normal operations. This prevents an attacker from issuing a malicious FC 05 (Write Single Coil) command to trip a breaker.

The non-intrusive method for observing Modbus TCP traffic by analyzing a copy of network packets via a SPAN port or Network TAP. This approach introduces zero latency to the deterministic control loop and cannot be detected by an attacker. A passive monitor reconstructs Modbus transactions to build a behavioral baseline of normal master-slave polling rhythms and register access patterns.

The international standard series defining a comprehensive security framework for Industrial Automation and Control Systems (IACS). It addresses Modbus TCP security at multiple levels:

• IEC 62443-3-3: System security requirements, including network segmentation
• IEC 62443-4-2: Component-level requirements for devices like PLCs Compliance ensures that Modbus TCP endpoints have hardened authentication and resource management.

An advanced enforcement mechanism that validates Modbus TCP commands against the current operational state of the industrial process. For example, a command to open a high-voltage breaker is only permitted if the system confirms the line is de-energized. This prevents logically valid but physically dangerous commands that simple protocol whitelisting would miss.