virus logo Intrusion Prevention

Modbus.TCP.Force.Listen.Only

description-logoDescription

This indicates a possible Denial of Service attack against a Modbus TCP enabled device.
Modbus TCP is a protocol often found in SCADA networks where it is used for process control. When a device is sent a "Force Listen Only Mode" command it will go into an inactive state, so that it will not respond to commands or send any responses. In order to restore full functionality, the device will require a reboot or it must be sent a "Restart Communication" command.

affected-products-logoAffected Products

PLCs and Modbus TCP servers.

Impact logoImpact

Denial of Service.

recomended-action-logoRecommended Actions

Reboot the device or send a Restore Communications command. Investigate the source of the traffic to prevent further attacks.

Telemetry logoTelemetry

Coverage

IPS (Regular DB)
IPS (Extended DB)
ID 11521
Created Dec 20, 2005
Updated Jul 05, 2022
Risk black-background-circle-icon lightgray-background-circle-icon lightgray-background-circle-icon lightgray-background-circle-icon lightgray-background-circle-icon
Default Action pass
Active
Affected OS Other
Affected App SCADA