skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-modbus-protocol-anomalies

Detect anomalies in Modbus/TCP traffic using pcap analysis and baseline comparison.

954|172|Updated Mar 13, 2026
Search Tags:#anomaly detection#Modbus#scapy#SCADA#ICS#OT security#PCAP analysis
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-modbus-protocol-anomalies
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-modbus-protocol-anomalies
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ot-ics-security/detecting-modbus-protocol-anomalies
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-modbus-protocol-anomalies

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires scapy, pymodbus.

What problem does it solve?

Industrial control systems using Modbus have no built-in authentication, so unauthorized clients, rogue write commands, and timing deviations can manipulate physical processes undetected. This Skill provides a structured workflow and Python-based detector to surface those anomalies from captured traffic.

Core Features & Use Cases

  • Rule-Based Anomaly Detection: Flags unauthorized clients, non-allowlisted function codes, write operations, broadcast writes (unit ID 0), timing deviations, and protocol violations, each mapped to MITRE ICS techniques.
  • Baseline Modeling: Loads per-session baselines of polling intervals and allowed function codes to distinguish normal polling from suspicious behavior.
  • Use Case: An OT security analyst captures two weeks of Modbus/TCP traffic on port 502, builds a baseline, then runs the detector over new pcaps to catch an unauthorized engineering workstation issuing FC16 write commands to a PLC.

Quick Start

Analyze the attached Modbus pcap file for unauthorized clients, write operations, and timing anomalies using my baseline.json profile.

Frequently Asked Questions about detecting-modbus-protocol-anomalies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect anomalies in Modbus TCP traffic?▼

Capture Modbus/TCP traffic on port 502 via SPAN or TAP, then parse the MBAP header and function codes with a scapy-based detector. Compare observed clients, function codes, and polling intervals against an authorized baseline to flag violations.

What tools can monitor Modbus protocol traffic?▼

Zeek with its Modbus analyzer, Suricata with ET Open ICS rules, and Wireshark's Modbus dissector all decode Modbus traffic. For custom detection logic, Python with scapy and pymodbus lets you build rule-based anomaly detectors.

Can Modbus anomaly detection catch replayed authorized commands?▼

No. Modbus has no authentication, so an attacker replaying permitted write function codes from a spoofed authorized IP appears normal to sequence models. Add register value and setpoint bounds checking alongside function-code allowlisting.

Why does Modbus monitoring miss RTU serial traffic?▼

TCP/502 SPAN monitoring only sees Modbus/TCP; Modbus RTU serial behind gateways is invisible to network sensors. Cover serial segments with gateway-level monitoring or dedicated serial taps, and alert on unit ID 0 broadcast writes.

Is it safe to test Modbus detection on live industrial systems?▼

Never fuzz or send write commands to live devices. Validate detectors offline by replaying a recorded pcap with injected anomalies such as unauthorized function codes, broadcast writes, and off-interval polls.

Related Skills

Explore More Software Engineering Skills→
BCDA-APSBCDA-APS
1

modbus

Translate PLC register maps into EPICS Modbus IOC configurations.

Official
Intermediate
starwreckntxstarwreckntx

Intrusion Detection Agent

Detect intrusions by correlating alerts and analyzing attack patterns in networked environments.

Community
Basic
doanchienthangdevdoanchienthangdev
4

Industrial Protocols

Facilitates Modbus, OPC UA, BACnet communication for industrial control systems.

Community
Advanced
YukiIto1999YukiIto1999

analyzing-network-traffic-of-malware

Analyze malware network traffic PCAPs to identify C2 protocols and generate Suricata rules.

Community
Advanced