detecting-modbus-protocol-anomalies - Detect anomalies in Modbus communications
Detects Modbus/TCP and Modbus RTU anomalies using function-code monitoring, register validation, timing analysis, client checks, and packet inspection.
Tags
Updated: 2026-09-28Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Capture Modbus traffic
- Parse Modbus frames
- Monitor function codes
- Validate register access
- Analyze polling timing
- Detect unauthorized clients
- Detect protocol violations
- Detect broadcast writes
Inputs
- Modbus/TCP traffic
- Network SPAN or TAP access
- Baseline traffic capture
- Authorized client list
- Function-code mappings
- Register mappings
- Baseline profile file
- PCAP files
Outputs
- Anomaly records
- Severity classifications
- Detection messages
- Loaded baseline status
Requirements
- OT network monitoring access
- Zeek with Modbus analyzer or Suricata with OT rules
- Python 3.9 or later
- scapy package
- pymodbus package
- Authorized Modbus documentation