What is Modbus TCP?
Modbus TCP is the variant of the industrial Modbus protocol that carries Modbus messages over Ethernet and TCP/IP on port 502, instead of over a serial link such as RS-485. The protocol is widely used for simple and reliable communication between PLCs, HMIs, SCADA systems, sensors, actuators, I/O modules and energy meters. Schneider Electric published the Open Modbus/TCP specification in March 1999; since 2007 Modbus TCP has also been included in IEC 61158 and IEC 61784-2 (communication profile CPF 15).
🧠 What does Modbus TCP do?
Modbus TCP:
- Sends measurement and control data over standard Ethernet
- Uses the Modbus protocol as its application layer, with the same function codes and data model as Modbus RTU
- Sends messages over TCP port 502, the port registered with IANA for Modbus
- Works on the client/server principle: a client (formerly master) sends requests and a server (formerly slave) responds. The Modbus Organization officially replaced the terms master and slave with client and server in 2020.
Unlike serial Modbus, a client can talk to many servers at once and a server can handle requests from several clients, for example from a SCADA server and a local HMI panel.
🔧 What are the key characteristics?
| Characteristic | Description |
|---|---|
| Protocol type | Open standard, free to use with no licensing fees |
| Transport layer | TCP/IP (port 502) over Ethernet |
| Structure | Client/server (formerly master/slave) |
| Message format | MBAP header (7 bytes) plus Modbus PDU in the TCP payload |
| Maximum message size | 260 bytes (7-byte MBAP + up to 253-byte PDU) |
| Scalability | Multiple clients and servers possible |
| Read/write operations | Coils, discrete inputs, input registers, holding registers |
| Security | None; the secure variant Modbus/TCP Security uses port 802 |
🗂️ What does the Modbus data model look like?
Modbus has four data tables. In the protocol, each table has addresses from 0 to 65535. The familiar notation using 00001, 10001, 30001 and 40001 is a documentation convention: holding register “40001” is simply address 0 in the message.
| Table | Type | Access | Conventional notation | Typical use |
|---|---|---|---|---|
| Coils | 1 bit | Read and write | 0xxxx | Digital outputs, start/stop commands |
| Discrete inputs | 1 bit | Read only | 1xxxx | Digital inputs, limit switches |
| Input registers | 16 bit | Read only | 3xxxx | Measured values such as temperature or pressure |
| Holding registers | 16 bit | Read and write | 4xxxx | Setpoints, parameters, configuration |
Values larger than 16 bits, such as 32-bit floats or energy meter counters, are split across two consecutive registers. The word order differs between manufacturers, a classic source of wrong readings during integration.
🔍 How does a Modbus TCP message work?
📤 1. The client sends a request
The client assembles a message (ADU) containing:
- A Modbus Application Protocol (MBAP) header of 7 bytes:
- Transaction identifier (2 bytes) — matches a response to the right request
- Protocol identifier (2 bytes) — always 0x0000 for Modbus
- Length (2 bytes) — number of bytes that follow
- Unit identifier (1 byte) — address of a device behind a gateway, otherwise 0xFF
- A PDU (Protocol Data Unit) with:
- Function code (such as ‘read holding registers’ = 0x03)
- Start address (zero-based: register “40001” is address 0)
- Number of registers to read or write
Example:
Read 4 holding registers starting at “40001”, i.e. address 0 (function code 0x03).
This is sent over port 502 via TCP/IP to the IP address of the Modbus TCP device. The CRC check of Modbus RTU is dropped and the serial slave address is replaced by the unit identifier; TCP itself takes care of error detection and reliable delivery.
📥 2. The server receives and processes the message
The Modbus server receives the message and performs the following:
- Validates the instruction (function code, address, quantity)
- Reads or writes the requested registers or coils
- Constructs a response with the requested data (or error code)
🔁 3. Response back to the client
The server sends a Modbus TCP response back over the same TCP connection. It contains:
- The MBAP header with the same transaction identifier and unit identifier
- Function code (possibly with the error bit set)
- Read values or confirmation of the successful action
If an error occurs, an exception response is returned with the high bit of the function code set to 1 (e.g. 0x83 = error in 0x03) plus an exception code, such as 01 (illegal function), 02 (illegal data address), 03 (illegal data value), 04 (server device failure), 0A (gateway path unavailable) or 0B (gateway target device failed to respond).
🧪 Sample exchange
- Client sends: “Read 2 holding registers from 40001”
- Server responds: “Register 40001 = 123, Register 40002 = 456”
- The client processes this data for monitoring or control
🧠 Common function codes
| Function code | Description | Maximum per request |
|---|---|---|
0x01 |
Read coils (discrete outputs) | 2000 coils |
0x02 |
Read discrete inputs | 2000 inputs |
0x03 |
Read holding registers | 125 registers |
0x04 |
Read input registers | 125 registers |
0x05 |
Write single coil | 1 coil |
0x06 |
Write single register | 1 register |
0x0F |
Write multiple coils | 1968 coils |
0x10 |
Write multiple registers | 123 registers |
0x17 |
Read and write multiple registers in one request | 125 read / 121 write |
Modbus TCP has no authentication: any device that can reach the network may use these function codes, including the write commands. FrostyGoop showed that this risk is real: malware that used Modbus TCP in January 2024 to cut heating to more than 600 apartment buildings in Lviv.
🔌 What is the difference between Modbus TCP and Modbus RTU?
| Aspect | Modbus TCP | Modbus RTU |
|---|---|---|
| Physical layer | Ethernet (RJ45, fibre) | Serial (RS-232 / RS-485) |
| Speed | High (10/100/1000 Mbit/s) | Lower (typically 9.6–115.2 kbit/s) |
| Topology | Star or switched network | Bus structure |
| Compatibility | Modern networks and IT integration | Simple legacy systems |
| Addressing | IP addresses (plus unit identifier behind gateways) | Slave addresses 1–247 |
| Error checking | By TCP | CRC-16 per message |
| Concurrency | Multiple clients and requests at once | One master, one request at a time |
🌉 How do you connect serial Modbus to Modbus TCP?
Many installations combine both variants through a Modbus gateway. The gateway has a single IP address and translates requests onto the serial network. The unit identifier in the MBAP header determines which RTU device (address 1–247) receives the request. Typical uses are making older energy meters, variable frequency drives and O available to a new SCADA or edge platform.
Watch out for two pitfalls. A gateway usually processes serial requests one at a time, so too many clients or too short a poll interval lead to timeouts. And for devices connected directly to TCP, the specification recommends unit identifier 0xFF, so that a misrouted request after an IP change does not end up at an arbitrary serial device.
🏭 Where is Modbus TCP used?
- SCADA ↔ PLC communication
- PLC ↔ O or variable frequency Drives
- Monitoring of energy or water meters, inverters and battery systems
- Connecting HMIs to Sensors/Actuators
- Integrating existing installations with new systems, for example through a gateway to OPC UA or MQTT
Modbus TCP devices are supplied by Siemens, Schneider Electric, ABB, WAGO, Beckhoff, Advantech and Phoenix Contact, among others: PLCs, HMI panels with Ethernet, I/O modules and smart energy and flow meters.
✅ Benefits
- Simple and robust protocol
- Broadly supported by manufacturers
- Open standard with no licensing fees
- Easy to implement in SCADA or software platforms
🔒 How do you secure Modbus TCP?
Modbus TCP itself provides no built-in security: no authentication, no encryption and no integrity protection. Anyone who can reach port 502 can read and write registers, and traffic can be intercepted or replayed (replay attack). Besides FrostyGoop, the PIPEDREAM toolkit disclosed in 2022 also contained modules for sending custom Modbus commands to PLCs.
A practical step-by-step approach:
- Map the Modbus communication — which clients talk to which servers, using which function codes and register ranges? An asset inventory and traffic analysis with Wireshark form the basis.
- Never expose port 502 to the internet — use a VPN or a managed remote access solution through a DMZ for remote maintenance.
- Segment the network — place Modbus devices in their own zone following the zones and conduits model of IEC 62443, separated by VLANs and a firewall.
- Filter at protocol level — an industrial firewall with DPI can use protocol filtering to allow only read requests, restrict write requests to a single engineering workstation and limit register ranges.
- Monitor the traffic — passive monitoring and an OT IDS flag unexpected write requests, new clients or unusual function codes. Open-source tools such as Zeek and Suricata include built-in Modbus support.
- Use Modbus/TCP Security where possible — this variant from the Modbus Organization wraps the same Modbus message in TLS (based on TLS 1.2) on port 802. Client and server authenticate each other with X.509v3 certificates, and a role embedded in the certificate determines which function codes are allowed.
For organisations under NIS2, implemented in the Netherlands through the Cybersecurity Act, segmentation, access control and monitoring of such unsecured protocols are part of the mandatory network and information security measures.
❓ Frequently asked questions
Which port does Modbus TCP use?
Modbus TCP uses TCP port 502 by default, which is registered with IANA for Modbus. A server must listen on port 502, even if a manufacturer makes an additional port configurable. The secure variant Modbus/TCP Security uses port 802.
Is Modbus TCP the same as Modbus RTU over TCP?
Modbus TCP is not the same as Modbus RTU over TCP. Modbus TCP uses the MBAP header and omits the CRC, whereas “RTU over TCP” wraps the complete serial RTU frame, including the CRC, unchanged inside a TCP connection. The two are not interchangeable, so the client must use the same format as the device.
What is the unit identifier in Modbus TCP?
The unit identifier is the last byte of the MBAP header in Modbus TCP. Behind a gateway, this value determines which serial device (address 1–247) receives the request. For a device connected directly to the IP network, the specification recommends the value 0xFF; 0 is also accepted.
Is Modbus TCP encrypted?
Standard Modbus TCP is not encrypted and has no authentication. All register values and write commands travel across the network in plain text. Encryption and mutual authentication are only available with Modbus/TCP Security over TLS on port 802, and few devices support that variant so far.
Why does a Modbus address sometimes start at 40001 and sometimes at 0?
Modbus TCP always uses zero-based addresses from 0 to 65535 per data table in the message itself. The 40001 notation is a documentation convention in which the first digit indicates the table (4 = holding registers) and counting starts at 1. Register 40001 is therefore address 0 with function code 0x03; an offset of one register is a common integration mistake.
How fast is Modbus TCP?
Modbus TCP runs on 10, 100 or 1000 Mbit/s Ethernet and is therefore much faster than serial Modbus RTU. The actual cycle time is usually determined by the client’s poll interval and the device’s processing time, typically tens to hundreds of milliseconds. For hard real-time control, ProfiNET or EtherCAT are more common choices.
📌 In summary
Modbus TCP is a simple and widely used Ethernet protocol for communication between industrial devices. It combines the simplicity of the Modbus protocol and its data model of coils and registers with the speed and flexibility of modern Ethernet networks, but has no security of its own. Segmentation, protocol filtering, monitoring and, where possible, Modbus/TCP Security on port 802 are therefore essential.