I85PREP
⌘ K
ICS/SCADA study materials
ICS/SCADA study resources

ICS/SCADA: TCP/IP 101

ICS/SCADA · Work through your exam, one topic at a time.

All guide sections

TCP/IP 101

What this domain tests

This domain checks whether you can trace a packet from application data to Ethernet frame, read IPv4 addressing and subnet masks, explain TCP versus UDP behavior, and recognize the ports used by ICS protocols. You need enough fluency to troubleshoot why an HMI cannot reach a PLC and to write a firewall rule that permits only the required conversation.

Core rules

  • Encapsulation: ICS application data becomes a TCP/UDP segment, then an IP packet, then an Ethernet frame. Each layer adds its own header and addressing.
  • IPv4 addresses are logical; MAC addresses are local to a broadcast domain. A host ARPs for its default gateway when the destination is on another subnet, not for the remote host itself.
  • TCP is connection-oriented: SYN, SYN-ACK, ACK, then sequence/acknowledgment numbers, flags, and connection state. UDP is connectionless and has no handshake or delivery guarantee.
  • Common ICS ports: Modbus/TCP 502, DNP3 20000 TCP/UDP, EtherNet/IP 44818/TCP and 2222/UDP, Siemens S7comm 102/TCP, BACnet 47808/UDP. Verify direction and protocol in each rule.
  • A stateful firewall must see the return traffic or be configured to permit the established session; asymmetric routing breaks stateful inspection.

Worked example

An engineering workstation at 192.168.10.50/24 must write to a PLC at 192.168.20.10 on Modbus/TCP 502. The /24 mask makes the workstation's network 192.168.10.0, so the PLC is remote. The workstation ARPs for its default gateway, sends the packet to the router, and the router forwards it. A firewall between the subnets must allow TCP 502 from 192.168.10.50 to 192.168.20.10 and permit the return direction for the established session. Without a gateway or route, the write fails even if the cable and PLC are fine.

Traps

  • Confusing MAC and IP addressing, or thinking a switch routes between subnets.
  • Assuming Modbus is always TCP; serial Modbus has no IP port.
  • Forgetting the return path or asymmetric routing when writing firewall rules.
  • Blocking UDP 47808 or 2222 because only TCP was considered.