Modbus TCP

Modbus TCP carries the Modbus application protocol over TCP/IP. A client sends a request naming a function code and a register or coil address, and the server replies with the data or an exception code. It has no built-in authentication in its original form.

Source checked7/7 values · 2026-10-25

Specification

2 sources

Transports	tcp
Architecture	client server
Encoding	binary

Default ports

IANA assignments

502TCPModbus Application Protocol

802TCPModbus Application Protocol Secure

Study notes

Data lives in four tables: coils (1-bit read/write), discrete inputs (1-bit read-only), input registers (16-bit read-only) and holding registers (16-bit read/write).
Each request carries an MBAP header with a transaction id, so a client can match replies to requests.

Safety

Plain Modbus TCP has no authentication or encryption. Anyone who can reach port 502 can write holding registers, so keep it on an isolated OT network.