What is S7 Comm?
S7 Comm (S7 communication, also S7comm) is the proprietary Siemens protocol that SIMATIC S7 PLCs use to exchange data with HMIs, SCADA systems, engineering software and other controllers, without built-in authentication or encryption. Siemens has used the protocol since the SIMATIC S7 range was introduced in 1994. On Ethernet it runs over ISO-on-TCP on TCP port 102, but it also works over MPI and PROFIBUS. Because the protocol underpins the S7-300 and S7-400 and still runs in a great many plants, an understanding of S7 Comm is essential for anyone who operates or secures OT networks.
S7 Comm forms the core of many Siemens-based OT infrastructures, particularly in manufacturing, water management, chemicals and energy.
🧠 How does S7 Comm work technically?
S7 Comm is a request/response protocol: a client (HMI, SCADA server, engineering station or another PLC) sends a request and the PLC replies. On Ethernet the protocol sits on top of a stack of layers borrowed from the OSI world:
| Layer | Protocol | Function |
|---|---|---|
| Transport | TCP, port 102 | Reliable connection between client and PLC or communication processor |
| ISO-on-TCP | TPKT (RFC 1006) | Wraps ISO transport packets in a TCP stream |
| Connection | COTP (ISO 8073, RFC 905) | Connection setup using TSAP addresses |
| Application | S7 Comm (protocol ID 0x32) | Reading, writing, program handling and diagnostics |
A connection is set up in three steps. The client opens TCP port 102, sends a COTP Connect Request with a destination TSAP, and then negotiates parameters such as the PDU size with the Setup communication function (code 0xF0). The first byte of the TSAP indicates the connection type (1 = PG or programming device, 2 = OP or operator panel), the second byte the rack and slot of the CPU. An S7-300 CPU in rack 0, slot 2 is therefore reached as TSAP 0x0102. The negotiated PDU size lies between 240 and 960 bytes depending on the CPU; larger transfers are split across several telegrams.
Every S7 message carries a header with a message type (ROSCTR): Job (0x01) for a request, Ack (0x02) and Ack_Data (0x03) for responses, and Userdata (0x07) for diagnostic and auxiliary functions such as reading the system status list, the clock or the diagnostic buffer.
🔧 Which functions does S7 Comm offer?
The function code in a Job determines what the PLC does. The most important ones:
| Function code | Function | Meaning in practice |
|---|---|---|
| 0xF0 | Setup communication | Establish the connection and agree the PDU size |
| 0x04 | Read Var | Read variables from data blocks, inputs, outputs, memory bits, timers and counters |
| 0x05 | Write Var | Write variables, for example setpoints or commands |
| 0x1A–0x1C | Request download, Download block, Download ended | Load program blocks into the PLC |
| 0x1D–0x1F | Start upload, Upload, End upload | Read program blocks from the PLC |
| 0x28 | PLC Control | Services such as a warm restart or copying RAM to ROM |
| 0x29 | PLC Stop | Put the CPU into STOP |
Addressing is absolute: a client requests, for example, “DB10, byte 4, length 2”. That makes the protocol fast and simple, but it also means that any client that opens a connection can read and write the PLC’s memory directly.
🏭 Where is S7 Comm used?
S7 Comm is present in virtually every Siemens installation of the past thirty years:
| Use case | Example |
|---|---|
| Data acquisition | SCADA or a historian reads process data (temperature, flow, status bits) from the PLC |
| Operation | An operator panel sends setpoints or switches actuators |
| PLC-to-PLC coupling | Two CPUs exchange data using PUT/GET or S7 connections |
| Diagnostics | Reading CPU status, diagnostic buffer or firmware version |
| Engineering | Downloading and uploading programs with STEP 7 Classic or TIA Portal from an Engineering Station |
A lot of third-party software speaks the protocol too: OPC servers, IIoT gateways and open-source libraries such as Snap7. Modern S7-1200 and S7-1500 CPUs use the successor protocol S7 Comm Plus among themselves and with TIA Portal, but still support classic S7 Comm for PUT/GET access. That access is disabled by default and must be enabled explicitly in TIA Portal; for absolute addressing, optimised block access must also be switched off for the data block concerned.
🔐 What are the security risks of S7 Comm?
S7 Comm was designed for closed networks and has no authentication, encryption or integrity protection at protocol level. Anyone who can reach TCP port 102 can, in principle, read, write, download programs and stop the CPU.
| Vulnerability | Consequence |
|---|---|
| No encryption | All traffic is readable with tools such as Wireshark, which has shipped an S7comm dissector since version 2.0 |
| No authentication | Any client with network access can send Read Var, Write Var or PLC Stop |
| Susceptible to replay attacks | Recorded commands can be replayed unchanged |
| Man-In-The-Middle | Traffic can be altered in transit without the PLC noticing |
| No user identity | The protocol has no notion of users, so no RBAC at protocol level |
| Weak password protection | On S7-300/400 with protection level 2 an attacker can obtain credentials via port 102 or PROFIBUS (CVE-2016-9159) |
Well-known incidents and research show this is not theoretical. Stuxnet (discovered in 2010) subverted the STEP 7 and WinCC communication library to load code into S7-300 and S7-400 PLCs unnoticed and to hide the real process values from operators. At Black Hat 2011, researcher Dillon Beresford demonstrated how S7 PLCs could be stopped with captured and replayed packets. Search engines for internet-connected devices still find PLCs with port 102 exposed. Even S7 Comm Plus is not infallible: in 2019 Israeli researchers showed with Rogue7 that an impersonated engineering station could start, stop and program an S7-1500, after which Siemens strengthened the integrity protection (CVE-2019-10929).
🛡️ How do you secure S7 Comm in practice?
Because the protocol itself cannot be secured, security has to come from the network and the configuration. A practical five-step approach:
- Inventory - use an asset inventory and passive monitoring to map which systems use port 102, which CPUs (S7-300, S7-400, S7-1200, S7-1500) are present and which firmware they run.
- Segment - place PLCs in their own zone following the zones and conduits model of IEC 62443 and the Purdue Model. Apply network segmentation with VLANs and a firewall that only allows fixed HMI, SCADA and engineering addresses to reach TCP/102.
- Filter on content - an industrial firewall with DPI can recognise S7 function codes and, for example, allow only Read Var from the historian while restricting Download and PLC Stop to the engineering station.
- Harden the PLC - enable PUT/GET only where it is needed, configure a password-protected access level, use the mode selector (RUN rather than RUN-P on older CPUs), and route engineering only through a jump server in a secured management zone.
- Detect - have an OT IDS watch for S7 patterns (unexpected downloads, STOP commands, new clients) and forward alerts to the SIEM.
In the longer term, migration is the real fix: from S7-300/400 to S7-1500, with communication running over S7 Comm Plus with TLS or over OPC UA with certificates. Such a migration is part of managing legacy systems and often takes years of planning. Until then, apply the Zero Trust principle: grant no implicit trust within OT segments.
Dutch and European context. Organisations covered by NIS2 and the Dutch Cybersecurity Act (in force since 15 August 2026) must take appropriate measures for their network and information systems. An unprotected port 102 in a drinking water or energy installation is an obvious finding in any audit.
🔁 What is the difference between S7 Comm and S7 Comm Plus?
| Property | S7 Comm (classic) | S7 Comm Plus |
|---|---|---|
| Protocol ID | 0x32 | 0x72 |
| Port | TCP/102 | TCP/102 |
| Typical CPUs | S7-300, S7-400 (S7-1200/1500 via PUT/GET) | S7-1200, S7-1500 |
| Engineering | STEP 7 Classic | TIA Portal |
| Authentication | None | Session protection, TLS with certificates in newer versions |
| Encryption | None | Yes, in newer firmware and TIA Portal versions |
| Addressing | Absolute (DB, byte, bit) | Symbolic, including optimised blocks |
| Analysis in Wireshark | Built-in dissector | Separate plugin required |
S7 Comm Plus is therefore not an extension but a separate protocol. An S7-300 does not speak it, and an S7-1200 or S7-1500 can only be accessed from outside via classic S7 Comm when PUT/GET has been deliberately enabled.
❓ Frequently asked questions
Which port does S7 Comm use?
S7 Comm uses TCP port 102, the standard port for ISO-on-TCP as defined in RFC 1006. S7 Comm Plus uses the same port. A firewall that opens port 102 therefore lets every S7 function through, unless it filters on function code with deep packet inspection.
Is S7 Comm the same as PROFINET?
No, S7 Comm and PROFINET are different protocols. PROFINET handles the cyclic, real-time exchange of I/O data between a controller and field devices, whereas S7 Comm is used for acyclic tasks such as HMI operation, data reading and engineering. Both often run over the same Ethernet network.
Can an S7-1500 still communicate via S7 Comm?
Yes, an S7-1500 supports classic S7 Comm for PUT/GET access, but the function is disabled by default. You have to enable it in TIA Portal and, for absolute addressing, switch off optimised block access for the data block. Only do this when it is genuinely needed, because it opens an unauthenticated access path.
How do I recognise S7 Comm traffic in Wireshark?
You can recognise S7 Comm traffic in Wireshark with the display filter s7comm, or with tcp.port == 102 for all ISO-on-TCP traffic. The dissector shows the message type, the function
code and the addresses read or written. S7 Comm Plus requires a separate plugin.
Why is S7 Comm a cybersecurity risk?
S7 Comm is a cybersecurity risk because the protocol has no authentication, encryption or integrity checking. Anyone who can reach port 102 can change variables, download programs or stop the PLC. Stuxnet showed in 2010 how far such an attack can go.
Do I need to replace S7-300 installations immediately?
Immediate replacement of S7-300 installations is usually neither necessary nor feasible, because migration requires retesting and downtime. Protect them in the meantime with segmentation, function-code filtering, monitoring and strict control of engineering access. Do plan the migration to S7-1500 or another supported controller as part of your lifecycle policy.
📌 In summary
S7 Comm is the classic Siemens protocol on TCP port 102 that lets HMIs, SCADA and engineering software read and write the memory of S7 PLCs directly, without authentication or encryption.
S7 Comm is fast, simple and widely supported, which is why it remains the backbone of many Siemens installations. The same simplicity makes it vulnerable to eavesdropping, manipulation and sabotage. Protect it with segmentation, function-code filtering, PLC hardening and monitoring, and plan the move to S7 Comm Plus with TLS or OPC UA.