skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-s7comm-protocol-security-analysis

Analyzes Siemens S7comm protocol traffic from pcap captures to detect unauthorized PLC operations.

954|172|Updated Mar 13, 2026
Search Tags:#protocol analysis#SCADA#ICS#OT security#PCAP analysis#s7comm#siemens plc
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-s7comm-protocol-security-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-s7comm-protocol-security-analysis
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ot-ics-security/performing-s7comm-protocol-security-analysis
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-s7comm-protocol-security-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires scapy.

What problem does it solve?

Siemens SIMATIC S7 PLCs communicate over the S7comm protocol on TCP port 102 with little or no built-in authentication, making it hard for security teams to spot unauthorized CPU stop commands, program downloads, or logic exfiltration hidden in normal industrial traffic.

Core Features & Use Cases

  • S7comm Traffic Parsing: Decodes TPKT/COTP/S7 PDU layers from pcap captures and extracts ROSCTR types and function codes such as Read/Write Variable, Program Download (0x1A-0x1C), and PLC Stop (0x29).
  • Unauthorized Access Detection: Flags critical operations originating from hosts outside an authorized engineering workstation list, including CPU stop commands and program uploads.
  • Known Vulnerability Assessment: Maps observed environments against known Siemens issues such as CVE-2019-13945 replay attacks, S7CommPlus integrity bypass, and CVE-2022-38773.
  • Use Case: An OT security analyst captures traffic from the S7 network segment, runs the analyzer against the pcap with the authorized TIA Portal workstation IPs configured, and receives a report listing unauthorized program downloads and CPU stop attempts for incident response.

Quick Start

Analyze the captured file plant-traffic.pcap for unauthorized S7comm operations using 10.10.2.50 and 10.10.2.51 as authorized engineering stations.

Frequently Asked Questions about performing-s7comm-protocol-security-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze S7comm traffic for security vulnerabilities?▼

Capture traffic from the S7 network segment into a pcap file, then run the analyzer script with the pcap path as an argument. It parses S7comm function codes and reports unauthorized engineering access, CPU stop commands, and program downloads.

What tools can decode Siemens S7comm protocol packets?▼

Wireshark with the S7comm dissector, Zeek with the S7comm analyzer, or a Python script using scapy can decode S7comm. The protocol rides on TPKT and COTP over TCP port 102 with protocol ID 0x32 marking the S7 PDU.

Which S7comm function codes indicate attacks on a PLC?▼

The highest-risk codes are Request Download (0x1A), Download Block (0x1B), PI Service start/stop (0x28), PLC Stop (0x29), and program upload (0x1D-0x1F). These modify or halt control logic and exfiltrate PLC programs.

Does this analysis work on live production PLCs?▼

No, the analysis is performed offline against captured pcap files and must never send commands to production PLCs. Active probing of S7 controllers can crash the CPU, so any replay testing belongs in a lab during a maintenance window.

Are S7-300 and S7-400 PLCs protected by passwords?▼

No, S7-300 and S7-400 transmit passwords in cleartext over S7comm and lack cryptographic integrity checks, so any host reaching TCP port 102 can issue commands. Network segmentation is the effective control, not PLC passwords.

Can S7CommPlus integrity protection be bypassed?▼

Yes, on S7-1200 firmware below V4.5 and S7-1500 below V2.9, the S7CommPlus integrity mechanism can be bypassed by an attacker who observes one legitimate session, per the Biham et al. research and CVE-2019-13945.

Related Skills

Explore More Software Engineering Skills→
jcastillotxjcastillotx

Wireshark Network Traffic Analysis

Capture, filter, and inspect packets from live captures or PCAP files.

Community
Intermediate
swarm-ai-safetyswarm-ai-safety
39

regression-check

Re-run pytest suites and compare performance metrics against historical baselines.

Official
Intermediate
YukiIto1999YukiIto1999

analyzing-network-traffic-for-incidents

Detect adversary activity in PCAPs, Zeek logs, and IDS alerts.

Community
Advanced
G36maidG36maid
6

ics-traffic

Analyze ICS/SCADA Modbus/TCP, IEC 104, and DNP3 traffic using Ettercap ARP spoofing and Scapy scripts.

Community
Advanced