502

Port 502/tcp is registered with IANA as mbap with the description "Modbus Application Protocol," assignee modbus.org and contact Dennis Dube (Schneider Electric), a modification date of 2014-06-10, and a blank reference field (dual-registered on TCP and UDP — but TCP 502 is the real one; Modbus over UDP exists in some implementations but is not part of the official spec). It is the ubiquitous industrial request/response protocol — historically called master/slave, now client/server — for reading and writing PLC and field-device data over Ethernet. Modbus was created by Modicon in 1979 (Modicon to Schneider Electric, with rights transferred to the Modbus Organization in 2004); serial variants are Modbus RTU and ASCII, while Modbus/TCP (around 1999) wraps the Modbus PDU in a seven-byte MBAP header (the Modbus Application Protocol header: Transaction ID, Protocol ID of zero, Length, Unit ID), dropping the serial CRC because TCP provides integrity. The data model is coils (1-bit read/write), discrete inputs (1-bit read-only), input registers (16-bit read-only), and holding registers (16-bit read/write), addressed 0–65535 and accessed via function codes such as 0x01 Read Coils, 0x03 Read Holding Registers, 0x05 Write Single Coil, and 0x10 Write Multiple Registers; the current specification is Modbus Application Protocol V1.1b3 (April 2012), free at modbus.org, and the server listens on TCP 502 while the client connects from an ephemeral port. The IANA reference field is blank, and the TLS-secured variant mbap-s is registered on port 802. Security-wise this is the flagship concern: Modbus/TCP has no authentication, no encryption, and no integrity or message checking by design, so anyone who can open a TCP connection to port 502 can read and write coils and holding registers — directly reading process values and commanding PLCs, actuators, and industrial processes. All traffic is cleartext (trivially read in Wireshark), stateless requests make replay trivial, and ARP-spoofing man-in-the-middle can alter register values in transit. It is one of the most-exposed and most-targeted ICS protocols, with Shodan/Censys/Bitsight ICS datasets framing Modbus as roughly half of internet-reachable ICS/OT devices (Bitsight's 2026 report puts total ICS/OT exposure around 170,000 monthly), and tooling is mature (nmap modbus-discover NSE, Metasploit modbusdetect/modbus_findunitid, smod, mbpoll). CISA issues recurring Modbus ICS advisories, and NIST SP 800-82 covers ICS hardening; defenses include never internet-exposing 502, segmenting OT from IT, allowlisting source IPs to the HMI/historian/engineering workstation only, using VPN plus a jump host with MFA for remote access, and considering the Modbus/TCP Security TLS variant on port 802 (changing the default port provides no security, since devices are fingerprinted by protocol response, not port). For an analyst, an open 502 is a critical OT-perimeter finding — an exposed PLC, RTU, or Modbus gateway, fully controllable by anyone who can reach it, and a top ICS target — and if found exposed it should be isolated immediately rather than waiting for a maintenance window.

IANA assignment

mbap — "Modbus Application Protocol"; reference (blank — no RFC cited in IANA registry); assignee modbus.org (contact Dennis Dube, Schneider Electric); modification date 2014-06-10; dual-registered 502/tcp + 502/udp (TCP 502 is the real transport); TLS variant mbap-s on 802

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000151 (de-facto; understates OT prevalence — Shodan/Censys/Bitsight are better gauges) [Well-established] — nmap-services file

Related ports

802 (mbap-s / Modbus Security TLS); other ICS — 102 (iso-tsap/Siemens S7), 20000 (DNP3), 44818 (EtherNet/IP), 47808 (BACnet), 2404 (IEC 104)

Primary use

industrial client/server protocol to read/write PLC and field-device data over Ethernet (Modbus/TCP)

Other/unofficial uses

building automation, energy, water/wastewater, manufacturing fieldbus-over-IP [Well-established]

Security implications

NO authentication/encryption/integrity by design; reaching 502 = read/write coils & registers = direct control of industrial processes; cleartext, trivial replay, ARP-spoof MITM; one of the most-exposed/most-targeted ICS protocols; CISA advisories; never internet-expose; segment OT; TLS variant on 802

Typically seen on

PLCs, RTUs, industrial gateways, building-automation controllers, SCADA HMIs

Analyst note

An open 502 is a CRITICAL OT-perimeter finding — an exposed PLC/RTU or Modbus gateway, fully controllable by anyone who can reach it. Never on the Internet; if found exposed, isolate immediately and move remote access behind VPN + jump host.

Port 502/udp carries the IANA registration for mbap (Modbus Application Protocol), but Modbus is fundamentally a TCP-based industrial protocol, and any UDP traffic on this port should be treated as a non-standard vendor extension with no legitimate place on the public internet.

IANA registers 502/udp identically to 502/tcp under the name mbap, assignee modbus.org, contact Dennis_Dube, with a modification date of 2014-06-10 and a blank Reference field. The dual TCP/UDP registration is a formal IANA artifact, not evidence that Modbus was designed to run over UDP.

Modbus/TCP wraps the Modbus PDU in a seven-byte MBAP header and is the protocol's real, standardized transport. Multiple technical sources state Modbus TCP itself does not use UDP, and that UDP support, where implemented, is a non-standard, vendor-specific extension outside the official Modbus specification and not recommended for production use.

No source found in this research names a specific application observed generating live traffic on 502/udp itself; the vendor and SCADA/HMI associations with port 502 found in the literature (Schneider Electric/Modicon PLCs, Siemens PLCs, WAGO controllers, CODESYS-based devices) describe Modbus/TCP, not the UDP variant. That narrower claim is left Unknown rather than inferred from TCP-only evidence.

IANA assignment

mbap — "Modbus Application Protocol"; reference (blank — no RFC cited in IANA registry); assignee modbus.org; contact Dennis_Dube; modification date 2014-06-10; dual-registered 502/tcp + 502/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry mbap 502/udp

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services open-frequency for 502/udp = 0.001318 (~0.13%), read from this site's own tooling (502/tcp = 0.000151 for comparison) [Confirmed] — this site's own tooling

Related ports

502/tcp (the standard Modbus/TCP transport — see /port/502/); 802 (mbap-s, Modbus Security TLS variant)

Primary use

IANA-registered name is shared with Modbus/TCP, but Modbus is fundamentally a TCP protocol; UDP transport is a non-standard, vendor-specific extension outside the official spec, not recommended for production

Other/unofficial uses

no source specifically documents applications or use cases for the UDP variant; vendor/PLC associations found for port 502 in general (Schneider Electric, Siemens, WAGO, CODESYS-based devices) describe Modbus/TCP, not UDP

Security implications

no authentication/encryption by protocol design; UDP variant is non-standard and should never be internet-exposed; SANS ISC tracks port 502 scanning activity without a TCP/UDP split; the Havex RAT's port-502 scanning is documented as TCP-specific, not UDP

Typically seen on

industrial/OT devices implementing a non-standard Modbus-over-UDP extension, if any; otherwise anomalous for this port's UDP transport [Unknown]

Analyst note

An open 502/udp is unusual — Modbus is a TCP protocol by design, so UDP traffic here is either a non-standard vendor extension on an OT device or an anomaly worth investigating; apply the same never-internet-expose posture as 502/tcp.