Control System Security

PROTOCOL
GUIDES.

Understand the vulnerabilities and scanning requirements for critical control systems. Explore safe, deterministic discovery techniques for Modbus, CIP, DNP3, and Profinet.

Modbus TCP

Active Port:502 (TCP)
OSI Layer:Layer 7 (Application)
Uptime Risk:Critical

The standard for PLC automation. Simple but lacks encryption or authentication. Aggressive active scans overflow the processing queues on older modules, causing CPU lockups.

Deterministic ScanRead Safety Guide

EtherNet/IP & CIP

Active Port:44818 (TCP) / 2222 (UDP)
OSI Layer:Layer 5-7 (CIP Session)
Uptime Risk:High

Common Industrial Protocol primarily used by Rockwell/Allen-Bradley. Mapping its deep object tree using rapid requests causes PLC resource exhaustion and triggers safety watchdog faults.

Deterministic ScanRead Safety Guide

DNP3

Active Port:20000 (TCP/UDP)
OSI Layer:Layer 7 / Data Link
Uptime Risk:Moderate

Backbone protocol for water utilities and electrical grids. Strict response timing means heavy scan buffers easily saturate low-bandwidth telemetry lines, dropping RTU sync.

Deterministic ScanRead Safety Guide

Profinet

Active Port:Layer 2 Multicast
OSI Layer:Layer 2 (Raw Ethernet)
Uptime Risk:High

Siemens precision manufacturing standard. Real-time control frames bypass IP routing. Standard IP scans overwhelm co-processors, delaying real-time IO frames and tripping safety limits.

Deterministic ScanRead Safety Guide

Operational Availability vs. Standard IT Scanning

Standard enterprise vulnerability scanners operate under assumptions of device resilience. Industrial control endpoints possess limited memory buffers and CPU resources. Directly translating IT scans onto OT networks leads to buffer locks and active loop failures. Solapse bridges this gap using protocol-native, pacing-calibrated safe probes.