Software Secure Firewall Threat Defense
Platform Secure Firewall Threat Defense Virtual
Activity Onboard

Intrusion Detection and Prevention Custom Intrusion Rules Keywords and Arguments in Intrusion Rules SCADA Keywords Modbus Keywords

Last updated: Jul 29, 2025

Modbus Keywords

You can use Modbus keywords alone or in combination with other keywords such as content and byte_jump.

modbus_data

You can use the modbus_data keyword to point to the beginning of the Data field in a Modbus request or response.

modbus_func

You can use the modbus_func keyword to match against the Function Code field in a Modbus application layer request or response header. You can specify either a single defined decimal value or a single defined string for a Modbus function code.

The following table lists the defined values and strings recognized by the system for Modbus function codes.

Table 1. Modbus Function Codes

Value

String

1

read_coils

2

read_discrete_inputs

3

read_holding_registers

4

read_input_registers

5

write_single_coil

6

write_single_register

7

read_exception_status

8

diagnostics

11

get_comm_event_counter

12

get_comm_event_log

15

write_multiple_coils

16

write_multiple_registers

17

report_slave_id

20

read_file_record

21

write_file_record

22

mask_write_register

23

read_write_multiple_registers

24

read_fifo_queue

43

encapsulated_interface_transport

modbus_unit

You can use the modbus_unit keyword to match a single decimal value against the Unit ID field in a Modbus request or response header.