▮ Learn Modbus
·
Module 12Physical Network & Transport8 min.md

Modbus TCP

▮ Overview

What you'll learn

MBAP, unit identifiers, ports, and what changes (and doesn't) moving from RTU.

Sections
12
Labs
1
Quiz
7 Qs
What you'll be able to do
  • Parse the 7-byte MBAP header from a capture.
  • Explain when Unit ID matters and when 0xFF is fine.
  • Predict what a Modbus TCP frame for FC 03 looks like end-to-end.
Why you'll need this
  • "A capture shows transaction IDs jumping from 0x0001 to 0x0F2A — concerning or not?"
Three things people get wrong
  1. 1.
    Appending a CRC over TCP
    Fix TCP handles integrity. No CRC bytes belong in a Modbus TCP frame.
  2. 2.
    Hard-coding Unit ID 1
    Fix Through a gateway, Unit ID picks the serial address. Hard-coding 1 breaks multi-drop topologies.
  3. 3.
    Ignoring MBAP length
    Fix Length covers Unit ID + PDU. Mis-calculating it confuses servers that strictly validate.
From the field

Port 502 is not magic

An IT team blocked port 502 'because it's unencrypted' without realizing the SCADA box used it for every poll. Production trends went flat for an hour. The eventual compromise was a Modbus Security gateway on 802 and a documented allowlist — same protocol, different posture.

Cited sources

Primary sources come from protocol and standards publishers. Secondary sources provide supporting tool, vendor, or reference context.

This module is paginated — step through the sections, run the labs, then take the quiz. Progress is saved locally.

Print one-pager →
Email feedback