virus logo Intrusion Prevention

Modbus.TCP.Restart.Communications.Option

description-logoDescription

This indicates that the "Restart Communications" command was sent to a Modbus TCP device.
Modbus TCP is a protocol often found in SCADA networks where it is used for process control. The "Restart Communications" command will cause the device to restart and execute power up self tests. The device will be unavailable for a time and a malicious attacker can continuously send this command to cause a Denial of Service condition.

affected-products-logoAffected Products

Modbus servers.

Impact logoImpact

Denial of Service: Remote attackers can crash vulnerable systems.

recomended-action-logoRecommended Actions

Monitor the traffic from that network for any suspicious activity.

Telemetry logoTelemetry

Coverage

IPS (Regular DB)
IPS (Extended DB)
ID 11522
Created Dec 20, 2005
Updated Jul 05, 2022
Risk black-background-circle-icon lightgray-background-circle-icon lightgray-background-circle-icon lightgray-background-circle-icon lightgray-background-circle-icon
Default Action pass
Active
Affected OS Other
Affected App SCADA