Modbus.TCP.Invalid.Packet.Length

description-logoDescription

This signature indicates that a Modbus TCP packet was detected that does not have a value for the size field. This could indicate an attempt to corrupt data integrity.
Modbus TCP is a protocol often found in SCADA networks where it is used for process control. Modbus limits the size of the PDU to 253 bytes to allow the packet to be sent on a serial line. A Modbus TCP packet that does not have a value for the size field could indicate an attempt to corrupt data integrity.

affected-products-logoAffected Products

Modbus TCP clients and servers.

Impact logoImpact

System integrity.

recomended-action-logoRecommended Actions

Investigate the source of the traffic to verify that it is malicious in nature.

Telemetry logoTelemetry

Coverage

IPS (Regular DB)
IPS (Extended DB)