> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/ics-ot/modbus.md).

# Modbus

Modbus is a simple protocol used for communicating with PLC devices. PLC devices perform, monitor, or otherwise manage physical processes like manufacturing.

Modbus uses a master/slave architecture. The slave devices, PLCs, await requests for read/write instructions from a master client. These instructions often include reading or writing to `coils` and `registers`, containing discrete or 16-bit values respectively. The protocol is structured via Function Codes, which allow you to specify a function as well as a data buffer. This buffer can be used to write data, or read data (specifying a specific memory address, for example)

```
[ Device ID ] [ Function Code ] [ Data ] [ Error Check ]
     0x01           0x03          ...         CRC
     
Common function codes:

0x01 — Read coils
0x03 — Read holding registers
0x06 — Write single register
0x10 — Write multiple registers
```

To actually issue Modbus commands, you can use `mbtget` for base-level operations:

```
❯ mbtget -a 9947 -r1 -p 31057 154.57.164.68 (read the coil with ID 9947)
```