Modbus/TCP Explained: Industrial Control, No Authentication & OT Segmentation (Animated)
Factories, water plants and building systems run on PLCs controlled with simple industrial protocols. Modbus, from 1979, is the most common. It has no authentication and no encryption: any device that can reach a PLC can read and change its values. Protection depends entirely on network separation.
1. Read values: the hmi polls the plc
The operator screen reads registers from the PLC every second: tank level, pump speed, pressure.
- READ (FC 3) (Operator HMI → PLC): A simple read.
- RESPONSE (PLC → Operator HMI): The HMI shows the values.
Wireshark filter:
modbus.func_code == 3
2. Write a setpoint: the operator changes a value
To adjust the process, the HMI writes a new value into a PLC register. The PLC acts on it immediately.
- WRITE (FC 6) (Operator HMI → PLC): The operator raises the pump speed.
- CONTROL (PLC → Water pump): A network packet becomes a physical action.
Wireshark filter:
modbus.func_code == 6
3. No authentication: attack: anyone who can reach port 502
If office IT and the industrial network are connected without strict controls, an intruder on an office PC can reach the PLC. Modbus doesn’t ask who is sending a command, so unauthorised writes are accepted like the operator’s own.
- READ (FC 3) (Attacker → PLC): The intruder can read the process without any login.
- WRITE (FC 6) (Attacker → PLC): An unauthorised write is accepted. In real incidents this means safety and service risks.
Wireshark filter:
modbus && ip.src == 10.1.0.66
4. Segment ot: defence: separate zones, allow-lists, ot monitoring
Keep industrial networks separate from office IT (Purdue model), allow Modbus only from the HMI and engineering stations, put a DMZ between zones, monitor OT traffic for unexpected writes, and use PLC write protection where available.
- WRITE (FC 6) (Attacker → PLC): The office network can’t reach the PLC at all.
Ot firewall rule:
Allow TCP 502: 10.20.0.10 (HMI) → 10.20.0.50 (PLC) Deny all other sources · alert on any FC 5/6/15/16 from new hosts
Practise this in a real lab
Read and write registers on a lab PLC simulator, watch Modbus in Wireshark, and design segmentation between IT and OT networks.
Explore ER Segment training →FAQ
What is a PLC?
A programmable logic controller: a rugged computer that reads sensors and drives motors, valves and pumps.
What are Modbus function codes?
Numbers for each action, e.g. 3 = read holding registers, 6 = write single register, 16 = write multiple registers.
What is the Purdue model?
A reference architecture that separates enterprise IT from industrial control zones, with controlled conduits (firewalls, DMZ) between them.