Skip to main content
OT Atlas
Search

Open / standardized

Modbus RTU

A serial master/slave protocol published in 1979 and still extremely common in field wiring. It carries register and coil reads/writes with no authentication, no integrity protection and no encryption.

N/A — serialSerial (RS-232 / RS-485)Encryption: NoLegacy

How it works

A single master polls addressed slaves on a shared serial bus. Each frame carries a slave address, a function code, data and a CRC. Only one master typically exists per segment.

Communication patternMaster polls slave address → slave replies or returns an exception code.

Fact sheet

TransportSerial (RS-232 / RS-485)
PortsN/A — serial
AuthenticationNone
PurdueLevel 1 – Level 0
EnvironmentsLegacy field networks, Remote sites, Small plants
DevicesPLC, RTU, VFD, Sensor, Protective relay
IndustriesWater / Wastewater, Oil & Gas, Manufacturing

Why should I care?

Understanding Modbus RTU is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.

Key functions and operations

  • Read coils / discrete inputs
  • Read holding / input registers
  • Write single & multiple registers
  • Diagnostics

Security concerns

  • No authentication — any device on the bus that can transmit is trusted
  • No integrity beyond a CRC intended for noise, not tampering
  • Serial media is usually invisible to network monitoring
  • Address collisions and rogue masters are hard to attribute

What normal looks like

  • Fixed polling cadence from one master
  • Stable set of slave addresses
  • Predominantly read function codes

What deserves attention

  • New slave address responding
  • Unexpected write bursts outside a maintenance window
  • Repeated exception responses

Hunting ideas

  • protocol-write-activity
  • rogue-master-controller

Defensive controls

  • Terminate serial links at a monitored gateway rather than extending them
  • Physically secure cabinets and marshalling panels
  • Capture serial-to-TCP gateway telemetry where a gateway exists

Related ATT&CK for ICS techniques

T0855T0836

Sources & further reading