Port 502Modbus

Modbus is an industrial communication protocol designed to enable communication between devices connected on different types of buses or networks, primarily in automation and control environments. It facilitates data transmission between supervisory computers and devices like PLCs, sensors, and instrumentation, making it a fundamental protocol in industrial control systems..

transport
tcp · udp

2 transports registered

in transit
cleartext

payload readable on path

assignment
unofficial

used by convention

risk
4/10

caution

lookups
13,730

rank 259 of 993 · top 26%

1 other service is registered on port 502. compare all 2

Technical Details

what runs on :502

Modbus is an open, serial communications protocol originally published by Modicon in 1979 for use with its programmable logic controllers (PLCs). Due to its simplicity and strong adoption, it became a de facto standard communication protocol in industrial environments, supporting both serial (RTU and ASCII) and Ethernet (Modbus TCP) implementations. It allows for communication over TCP port 502, the well-known port assigned for Ethernet implementations.

Modbus operates in a master/slave or client/server architecture. A single master/client issues requests to read or write data on one or multiple slave/server devices, which respond only to requests and never initiate communication. Data is structured as registers and coils, which correspond to analog values and digital inputs/outputs respectively, making it flexible for monitoring and controlling diverse devices.

In Ethernet-based setups, Modbus TCP encapsulates Modbus frames in TCP packets, leveraging IP networks for increased range and connectivity. The protocol remains widely adopted in industrial automation (e.g., SCADA systems), building management, and energy management systems due to its ease of use and implementation across many vendors.

Security Information

exposure of :502

risk score

4/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

network services averages 3.9 across 604 ports — this one sits 0.1 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

unofficial

used by convention, not registered — what answers here varies by deployment

reachable over

tcp · udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

Common Vulnerabilities:

  • Modbus lacks native encryption, leaving data susceptible to eavesdropping and man-in-the-middle attacks.
  • The lack of authentication allows unauthorized devices to send commands, enabling spoofing or unauthorized control.
  • Protocol simplicity causes limited error handling, meaning malformed packets could disrupt device operation.
  • Vulnerable to replay attacks, where previously captured valid messages are resent to alter device behavior.

Common Mitigations:

  • Employ network segmentation to isolate industrial networks using VLANs or separate physical infrastructure.
  • Use VPNs or encrypted tunnels to add confidentiality and integrity.
  • Implement firewall rules restricting access to port 502, permitting only authorized hosts.
  • Deploy intrusion detection systems tailored to industrial protocols to identify anomalous traffic.
  • Transition to secure protocol variants or wrap Modbus communication with security protocols such as TLS when feasible.
  • Enforce strong access controls and network monitoring combined with regular vulnerability assessments.

the 8 most looked-up other ports in network services — 604 ports carry that label.

risk mix of the 8 listed

  • caution100%

0 of 8 encrypted