monitoring-scada-modbus-traffic-anomalies

Monitor write function codes 05, 06, 15, and 16 and alert when they originate from source IPs outside an authorized writers list or exceed baseline frequency. Combine this with per-register safe range checks to catch dangerous setpoint changes.

Scapy's contrib.modbus module dissects captured packets to extract function codes, register addresses, and values, while pymodbus implements full Modbus client and server logic. Zeek provides passive structured logging via its modbus.log without custom scripting.

A minimum of 48 to 72 hours is recommended, spanning at least one full operational cycle. Shorter baselines miss shift-change writes and weekly batch jobs, producing false positives against legitimate but infrequent operations.

Common gaps include SPAN ports mirroring only one traffic direction, overly coarse function-code allow-lists that ignore FC 43 reconnaissance, and missing per-register value limits. Validate bidirectional capture and replay a known enumeration pcap to confirm alerts fire.

No, this is a passive monitoring approach and should not be used for active injection or fuzzing against production SCADA systems. It also requires authorization from the asset owner and does not replace safety-instrumented systems.