Modbus.TCP.Invalid.Packet.Length
Description
This signature indicates that a Modbus TCP packet was detected that does not have a value for the size field. This could indicate an attempt to corrupt data integrity.
Modbus TCP is a protocol often found in SCADA networks where it is used for process control. Modbus limits the size of the PDU to 253 bytes to allow the packet to be sent on a serial line. A Modbus TCP packet that does not have a value for the size field could indicate an attempt to corrupt data integrity.
Affected Products
Modbus TCP clients and servers.
Impact
System integrity.
Recommended Actions
Investigate the source of the traffic to verify that it is malicious in nature.
Telemetry
Coverage
IPS (Regular DB) | |
IPS (Extended DB) |