802

Port 802/tcp is registered with IANA as mbap-s with the expected description "Modbus Application Protocol Secure" (dual-registered on TCP and UDP); the IANA row was corroborated against the Modbus Organization specification and Schneider Electric documentation but was not re-verified against the live IANA CSV this session, so the exact Description and Reference strings should be confirmed before promotion. It is Modbus/TCP Security, the Modbus Organization's secured variant of Modbus/TCP and the secured counterpart to the cleartext 502/mbap flagship: it encapsulates the unchanged Modbus Application Protocol (MBAP) ADU/PDU inside TLS — the relationship of mbap to mbaps mirrors that of http to https — and adds X.509v3 certificate-based mutual client/server authentication plus role-based authorization carried in an X.509v3 certificate Role extension (an ASN.1-encoded UTF8 string registered under Modbus.org's IANA OID). The specification mandates TLS 1.2 or higher (no SSL 3.0 or earlier TLS), forbids HMAC-MD5 and HMAC-SHA-1, and requires HMAC-SHA-256; the Modbus Organization assigned system port 802 for the protocol, and some deployments allow fallback to cleartext 502 if TLS negotiation fails, which is a downgrade risk to control for. The IANA reference may be a Modbus.org spec or blank. Standardization-wise the Modbus Security protocol was published in August 2018 (interoperability demonstrated May 2017), and Schneider Electric's blog confirms it utilizes port 802, though adoption remains limited and maturing, with INCIBE-CERT noting that most legacy devices do not support 802 and that VPN tunnels remain the common encryption approach for existing installations. Security-wise 802 is better than cleartext 502 — it adds confidentiality, integrity, anti-replay, and authentication — but it is still an ICS/OT endpoint that must be network-segmented into an isolated OT zone and never internet-exposed, since TLS does not eliminate denial-of-service exposure and pre-encapsulation sensor-spoofing or physical-layer attacks remain. For an analyst, an open 802 indicates a TLS-secured Modbus endpoint (typically a TLS-capable PLC or IIoT gateway from vendors such as Schneider Electric, ABB, or Siemens), and it is the key cross-reference to the 502/mbap page as its secured counterpart.

IANA assignment

mbap-s — "Modbus Application Protocol Secure" (expected; IANA row not re-confirmed against the live CSV this session — verify before DONE); reference (possibly a Modbus.org spec or blank — verify); dual-registered 802/tcp + 802/udp

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

rare (limited adoption); nmap-services de-facto low [Well-established] — nmap-services file

Related ports

502 (mbap — cleartext Modbus, the primary cross-reference); 20000 (DNP3), 44818 (EtherNet/IP), 47808 (BACnet)

Primary use

TLS-secured Modbus/TCP (the secured counterpart to 502/mbap)

Other/unofficial uses

none [Well-established]

Security implications

better than cleartext 502 (TLS 1.2+, X.509 mutual auth, role-based authz, HMAC-SHA-256) BUT still ICS/OT — segment, never internet-expose; watch for 502 fallback downgrade; TLS doesn't stop DoS or pre-encapsulation spoofing

Typically seen on

TLS-capable PLCs/IIoT gateways (Schneider Electric, ABB, Siemens)

Analyst note

An open 802 indicates a TLS-secured Modbus endpoint — still ICS; segment it, never internet-expose, and watch for cleartext-502 fallback. The key cross-reference is the 502/mbap page.