Skip to main content
Modbus is the oldest and most widely deployed industrial communication protocol, developed in 1979 by Modicon. Despite its age, it remains the de facto standard for communication between industrial devices — PLCs, sensors, actuators, and SCADA systems — across virtually every industrial sector.

​
How Modbus works

Modbus operates on a master/slave model. A master device (typically a SCADA system or HMI) sends requests to slave devices (PLCs, sensors). Slaves respond with data or execute commands. Modbus TCP runs over standard Ethernet on port 502. The protocol has no built-in authentication, encryption, or authorization. Any device that can reach a Modbus slave on port 502 can read sensor values, write coil states, or issue control commands. Key function codes:
  • FC01 — Read Coils (digital outputs)
  • FC02 — Read Discrete Inputs (digital inputs)
  • FC03 — Read Holding Registers (analog values, configuration)
  • FC04 — Read Input Registers
  • FC05 — Write Single Coil
  • FC06 — Write Single Register
  • FC16 — Write Multiple Registers

​
Why attackers target Modbus

The combination of ubiquity, no authentication, and direct physical control makes Modbus uniquely dangerous. An attacker who reaches a Modbus-exposed PLC can:
  • Read process values (temperatures, pressures, flow rates) for reconnaissance
  • Write register values to alter setpoints
  • Toggle coil states to activate or deactivate physical equipment
  • Issue commands that cause physical damage (as demonstrated by Stuxnet)
Shodan indexes over 90,000 Modbus-accessible devices publicly reachable on the internet.

​
What Reyhford observes

Modbus (port 502) is the highest-volume ICS protocol in our honeypot network. Our sensors observe:
  • Reconnaissance scanning — FC03 read requests probing register ranges to fingerprint device type and extract configuration
  • Function code enumeration — systematic testing of all function codes to identify supported operations
  • Write attempts — FC06 and FC16 write requests attempting to modify register values
  • Global source distribution — scanning originates from infrastructure across Asia, Europe, and North America simultaneously
MITRE ATT&CK for ICS mapping: T0855 (Unauthorized Command Message), T0830 (Man in the Middle).