{"id":"modbus-tcp","model_id":"Modbus-TCP","name":"Modbus TCP","summary":"Modbus TCP carries the Modbus application protocol over TCP/IP. A client sends a request naming a function code and a register or coil address, and the server replies with the data or an exception code. It has no built-in authentication in its original form.","study_notes":["Data lives in four tables: coils (1-bit read/write), discrete inputs (1-bit read-only), input registers (16-bit read-only) and holding registers (16-bit read/write).","Each request carries an MBAP header with a transaction id, so a client can match replies to requests."],"safety_notes":["Plain Modbus TCP has no authentication or encryption. Anyone who can reach port 502 can write holding registers, so keep it on an isolated OT network."],"sources":[{"url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=mbap","title":"IANA Service Name and Transport Protocol Port Number Registry (mbap, mbap-s)","accessed":"2026-10-25"},{"url":"https://www.modbus.org/modbus-specifications","title":"Modbus Organization: Modbus specifications","accessed":"2026-10-25"}],"verification":{"status":"source_checked","checked_at":"2026-10-25","values":7,"method":"llm_source_check"},"updated_at":"2026-10-25","type":"protocol","spec":{"transports":["tcp"],"architecture":"client_server","encoding":"binary","default_ports":[{"port":502,"transport":"tcp","secure":false,"purpose":"Modbus Application Protocol"},{"port":802,"transport":"tcp","secure":true,"purpose":"Modbus Application Protocol Secure"}],"data_types":[],"related":[]},"url":"https://machineschema.com/protocol/modbus-tcp","license":"https://creativecommons.org/licenses/by/4.0/"}