Modbus
Modbus is the open industrial control protocol you keep meeting at the AV/facilities boundary. It is not a media transport and it is not a rich modern API; it is a simple request/response protocol for reading and writing coils, discrete inputs, input registers, and holding registers in field devices. For AV work the firewall conversation is mostly about Modbus TCP on port 502, with the important caveat that the classic profile is unencrypted and that the newer Modbus Security profile moves the same application payload into TLS on port 802. Native Modbus RTU / ASCII over serial has no firewall-port footprint.
Scope: Modbus — select the deployed product/version; optional services require separate selection.
protocol · Catalog reviewed 2026-10-22
Infrastructure Requirements
- Modbus RTU: disciplined RS-485 serial bus with one master/client at a time, unique device addressing, bias/termination/timing handled correctly, and a control system or gateway that actually documents the register map
- Modbus TCP: standard IP LAN, TCP session reachability to port 502, plus the same register-map discipline and any required serial/Ethernet gateway handling
Network & Physical Requirements
| Port / allocation | Transport | Connection / signal flow | Feature and requirement | Evidence |
|---|---|---|---|---|
| 502 (default) | TCP | Modbus client → Modbus server | Profile requirement · Core Modbus TCP requests Modbus TCP client-to-server service; default TCP 502 Use the configured server listener. Client source ports are distinct from the server destination port and are not a separate inbound listener allowance. | Source checked 2026-10-22 Section 4.2.1.2 Connection management description, p. 12: client connects to server listener 502; section 4.2.1, p. 9: configurable portModbus Messaging on TCP/IP Implementation Guide V1.0b, 2006-10-24 |
| 802 (default) | TCP | Secure Modbus client → Secure Modbus server | Optional · TLS security Modbus Security Modbus Security (mbap over TLS/TCP), devices explicitly supporting the profile Select this optional TLS profile only where both peers implement it. Provision certificates and use the configured secure server listener. | Source checked 2026-10-22 Section 5 Introduction, p. 5 and Appendix A, p. 20: mbap/TLS/TCP at port 802Modbus/TCP Security v36, 2021-07-30 |
Physical, link and configuration requirements
physical · Optional · Serial
Modbus RTU/ASCII uses a serial line; match the transmission mode and serial parameters across devices.
Native Modbus RTU/ASCII serial line
All serial devices on the line must share the selected transmission mode and serial parameters. Native serial operation has no TCP/UDP listener.
Source checked 2026-10-22
Section 2.5 The two serial Transmission Modes, p. 12; chapter 3 Physical LayerModbus over Serial Line V1.02, 2006-12-20
Gotchas & IT Notes
- ⚠Port 502 is the normal Modbus TCP service port. Treat it as an internal control/facilities service, not something to expose broadly.
- ⚠Modbus TCP is typically client-initiated polling. In AV terms that usually means the control processor, BMS gateway, or monitoring server opens the session and the field device behaves as the server.
- ⚠If a TCP device is front-ending serial downstream devices, the Unit Identifier field matters for routing to the correct target behind the gateway.
- ⚠Classic Modbus TCP is not encrypted or authenticated. If the brief has real security requirements, confirm whether the devices actually support the Modbus Security profile on 802 rather than assuming "Modbus over Ethernet" is good enough.
- ⚠Modbus Security exists, but the installed base is still heavily classic 502. Mixed estates are normal, and secure deployment requires certificate provisioning and operational ownership.