Cyber security

9/19/2020 CSCI 397 F20: Analyzing ICS Network Traffic with Network Analysis Tools: ANALYZING MODBUS/TCP TRAFFIC

https://training.icscsi.org/mod/lesson/view.php?id=1813&pageid=168 1/4

Dashboard / My courses / CSCI 397 F20 / Week 4 - Lab Exercise - Network Analysis Tools / Analyzing ICS Network Traffic with Network Analysis Tools

Fundamentals of Industrial Control System Cyber Security

Analyzing ICS Network Traffic with Network Analysis Tools ANALYZING MODBUS/TCP TRAFFIC

(EXPECTED TIME TO COMPLETE = 20 minutes | 1:40)

Using the same “multi-network-architecture.pcap” file from the Analysis of SMB Traffic section, let us now focus on ICS protocols and traffic. This portion will analyzes traffic using the Modbus/TCP protocol over 502/tcp. The architecture consists of a PLC (192.168.1.5), an HMI (192.168.1.129), and a SCADA Server (192.168.1.60).

You can use CIDR notation to create a Display Filter in Wireshark that will narrow the traffic down to just this 192.168.1.0/24 network.

QUESTION 1: What would the Display Filter look like?

Apply the filter now.

Using Wireshark “Conversations” under the “Statistics” menu, select the “TCP” tab. The report shows all the traffic in the capture file, so look at the bottom and select “Limit to display filter” to simply the report.

QUESTION 2: What ports are being used by the PLC (192.168.1.5) for incoming sessions?

QUESTION 3: What is the most common service used by each of the TCP port numbers?

QUESTION 4: What is the manufacturer of the PLC?

QUESTION 5: Where did you find this information?

Let us focus on the same host address using NetworkMiner. Find the PLC (192.168.1.5). Do you notice "Siemens" is presented with the IP Address. Expand the device by clicking the "+" sign.

Is there more information about the manufacturer?

QUESTION 6: Is there more information about the manufacturer?

Expand the “OS: Siemens” entry.

QUESTION 7: What information is provided here that was not provided with Wireshark?

QUESTION 8: What ports are listed under the “Incoming” sessions where the PLC would act as a server?

9/19/2020 CSCI 397 F20: Analyzing ICS Network Traffic with Network Analysis Tools: ANALYZING MODBUS/TCP TRAFFIC

https://training.icscsi.org/mod/lesson/view.php?id=1813&pageid=168 2/4

NetworkMiner uses device signatures to help enumerate the actual device that is present. A feature not possible with Wireshark. The Satori TCP database was used to fingerprint the Siemens PLC. One of the instructors of this course has been actively working with the developer of NetworkMiner to expand this library.

The one piece of information that NetworkMiner is not able to provide is that relating to the Application Layer and the associated ADUs. Recall from the lecture that Wireshark has protocol “dissectors” that allow the packet to be broken down extracting headers from data units. These data units can be further broken down into function codes and data elements.

So, let us return to Wireshark and analyze the Modbus/TCP Application Layer protocol.

QUESTION 9: What TCP port is used by Modbus/TCP?

QUESTION 10: What would the Display Filter look like to display only hosts on the 192.168.1.0/24 network using the Modbus/TCP port and catch any 3-way handshakes if possible?

If you go to the very top of the display, you can see the actual handshake that took place. That is the benefit of generating traffic in a lab versus in the real world. This handshake occurred only a single time throughout the five minutes of traffic collected.

Search for the first Modbus/TCP “Query” packet.

QUESTION 11: What packet number did this occur?

Select the packet and observe the display panel below that displays the various layers of the OSI Model. Two Application Layer entries are provided: Modbus/TCP and Modbus.

QUESTION 12: Why does it show two in this case?

Referring to the lecture material (slide 35) and shown below as Figure 81, what is contained in the “Modbus/TCP” portion of the frame?

QUESTION 13: What is contained in the “Modbus” portion of the frame?

Figure 81

9/19/2020 CSCI 397 F20: Analyzing ICS Network Traffic with Network Analysis Tools: ANALYZING MODBUS/TCP TRAFFIC

https://training.icscsi.org/mod/lesson/view.php?id=1813&pageid=168 3/4

QUESTION 14: What Function Code is used here?

QUESTION 15: What is the meaning of this Function Code?

QUESTION 16: What is the meaning of the “Reference Number”?

QUESTION 17: What is the meaning of the “Word Count”? (Hint: several good documents were referenced in the lecture that dissect the complete Modbus/TCP frame)

Look at the associated Modbus/TCP “Response” packet. This might help you answer the question above!

QUESTION 18: What packet number did this occur?

QUESTION 19: What is the value stored in Register Number 12300?

QUESTION 20: What does “UINT16” stand for?

QUESTION 21: What is the “Byte Count” in the Response different from the “Word Count” in the Request?

9/19/2020 CSCI 397 F20: Analyzing ICS Network Traffic with Network Analysis Tools: ANALYZING MODBUS/TCP TRAFFIC

https://training.icscsi.org/mod/lesson/view.php?id=1813&pageid=168 4/4

You are logged in as Manish Khatri (Log out) CSCI 397 F20 Copyright (c) 2016-2020 ICSCSI LLC. All rights reserved.

Before leaving this portion of the lab exercise, you are encouraged to modify your Wireshark Display Filter and look at the ICS communication taking place on 102/tcp using the Siemens S7COMM protocol. This PLC supports both Modbus/TCP and Siemens S7COMM, and can serve the same data using either protocol. If you look at packets 11579 and 11580, you can see the data request and response. Notice the different syntax used to access the PLC internal registers with S7COMM by expanding the details in the "S7 Communication" ADU in the request packet 11579.

PREV < Analyzing SMB Traffic NEXT > Analyzing EtherNet/IP Traffic

You have completed 33% of the lesson 33%

◄ Downloading and Using Network Analysis Tools

Jump to... QUIZ 2 - ICS Fundamentals 2 ►