Port 502Modbus
Modbus is an industrial communication protocol designed to enable communication between devices connected on different types of buses or networks, primarily in automation and control environments. It facilitates data transmission between supervisory computers and devices like PLCs, sensors, and instrumentation, making it a fundamental protocol in industrial control systems..
- transport
- tcp · udp
- in transit
- cleartext
- assignment
- unofficial
- risk
- 4/10
- lookups
- 13,730
2 transports registered
payload readable on path
used by convention
caution
rank 259 of 993 · top 26%
1 other service is registered on port 502. compare all 2 →
Technical Details
what runs on :502Modbus is an open, serial communications protocol originally published by Modicon in 1979 for use with its programmable logic controllers (PLCs). Due to its simplicity and strong adoption, it became a de facto standard communication protocol in industrial environments, supporting both serial (RTU and ASCII) and Ethernet (Modbus TCP) implementations. It allows for communication over TCP port 502, the well-known port assigned for Ethernet implementations.
Modbus operates in a master/slave or client/server architecture. A single master/client issues requests to read or write data on one or multiple slave/server devices, which respond only to requests and never initiate communication. Data is structured as registers and coils, which correspond to analog values and digital inputs/outputs respectively, making it flexible for monitoring and controlling diverse devices.
In Ethernet-based setups, Modbus TCP encapsulates Modbus frames in TCP packets, leveraging IP networks for increased range and connectivity. The protocol remains widely adopted in industrial automation (e.g., SCADA systems), building management, and energy management systems due to its ease of use and implementation across many vendors.
Security Information
exposure of :502risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
network services averages 3.9 across 604 ports — this one sits 0.1 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
unofficial
used by convention, not registered — what answers here varies by deployment
reachable over
tcp · udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common Vulnerabilities:
- Modbus lacks native encryption, leaving data susceptible to eavesdropping and man-in-the-middle attacks.
- The lack of authentication allows unauthorized devices to send commands, enabling spoofing or unauthorized control.
- Protocol simplicity causes limited error handling, meaning malformed packets could disrupt device operation.
- Vulnerable to replay attacks, where previously captured valid messages are resent to alter device behavior.
Common Mitigations:
- Employ network segmentation to isolate industrial networks using VLANs or separate physical infrastructure.
- Use VPNs or encrypted tunnels to add confidentiality and integrity.
- Implement firewall rules restricting access to port 502, permitting only authorized hosts.
- Deploy intrusion detection systems tailored to industrial protocols to identify anomalous traffic.
- Transition to secure protocol variants or wrap Modbus communication with security protocols such as TLS when feasible.
- Enforce strong access controls and network monitoring combined with regular vulnerability assessments.
Related Ports
the 8 most looked-up other ports in network services — 604 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :9080 | Groove RPC | TCPUDP | Web Services | caution | 70.8k |
| :6543 | Jetnet | UDP | Network Services | caution | 65.3k |
| :5938 | TeamViewer | TCPUDP | Remote Access | caution | 65.0k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3233 | WhiskerControl Protocol | TCPUDP | Network Services | caution | 61.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Tatsoft Default HTTP Proxy | TCP | Web Services | caution | 46.8k |
risk mix of the 8 listed
- caution100%
0 of 8 encrypted