:PROPERTIES: :ID: d588e9b0-8ad8-4a26-a1ed-62f50957e4a4 :END: #+title: ot-ics-security-ramp/protocol-comparison #+filetags: :project: :knowledge: :cybersecurity: :protocols: :reference: Side-by-side quick-reference comparing the ICS/OT protocols covered in [[ot-ics-security-ramp/curriculum]] (deep-dive session 2026-10-06). Full prose definitions live in [[ot-ics-security-ramp/glossary]] — this node is for comparison at a glance, not canonical definitions. ** Transport / Addressing | Protocol | Transport | Port/Layer | Topology | |----------+---------------------------------------------------+-------------------------------------+--------------------------------------------| | Modbus | Serial (RTU/ASCII) or TCP | TCP 502 | Master/slave (req-resp) | | DNP3 | Serial or TCP (tunnels serial framing inside TCP) | TCP 20000 | Master/outstation (req-resp + unsolicited) | | IEC 104 | TCP (IP version of serial IEC 101) | TCP 2404 | Controlling/controlled station (req-resp) | | GOOSE | Raw Ethernet, no IP/TCP/UDP at all | L2, EtherType 0x88B8, multicast MAC | Publish-subscribe | | OPC-UA | Own binary protocol, or HTTPS | TCP 4840 or HTTPS | Client/server, cross-vendor interop | | SNMP | UDP | UDP 161 (agent), 162 (trap) | Manager/agent (poll + trap push) | ** Data Model | Protocol | Data model | |----------+-------------------------------------------------------------------------------------------------------------------------------------------------| | Modbus | Flat, untyped: coils / discrete inputs / holding registers / input registers, addressed by number only — no semantic meaning in the wire format | | DNP3 | Object-based with real semantics: Binary/Analog Input/Output, Counters | | IEC 104 | ASDUs containing typed Information Objects (Type Identification field: single-point info, measured value, command, ...) | | GOOSE | Dataset of pre-engineered values per GOOSE Control Block, identified by stNum/sqNum for state/retransmission tracking | | OPC-UA | Full object-oriented address space: Nodes (variables, methods, types, relationships), self-describing and browsable at runtime | | SNMP | MIB tree of named values addressed by OIDs (dotted-numeric path) | ** Security Posture | Protocol | Built-in security | Retrofit extension | Real-world adoption of retrofit | |----------+--------------------------------------------------------------------+----------------------------------------------+-------------------------------------------------------------------------------------------------------------------------| | Modbus | None | Modbus Security (TLS, ~2018) | Rare | | DNP3 | None | DNP3-SA (IEEE 1815, HMAC challenge-response) | Rare; Aggressive Mode has a known replay flaw | | IEC 104 | None | IEC 62351-3/5 (TLS) | Rare | | GOOSE | None (sub-4ms budget leaves no room) | IEC 62351-6 (digital signature) | Very rare — genuine timing-vs-security tension, not just inertia | | OPC-UA | Real, from the start: X.509 mutual auth, Sign/SignAndEncrypt modes | N/A — native | "Security Policy: None" is valid and often left set anyway; ~80% of exposed servers found in plaintext (2026 scan data) | | SNMP | v1/v2c: plaintext community string only (no real auth) | SNMPv3 (real auth + encryption) | Often not enabled; v1/v2c still common | ** Purdue Level / Typical Role | Protocol | Typical Purdue level | Typical use | |----------+-----------------------------------------------------------------------+-----------------------------------------------------------------------------| | Modbus | Level 0-1 | PLC/RTU to field I/O, SCADA polling | | DNP3 | Level 1-2 | Utility master station to RTU, esp. electric/water, North America | | IEC 104 | Level 1-2 | Utility master station to RTU, Europe/Middle East/Asia/Africa | | GOOSE | Level 0-1 | Peer-to-peer protection-relay coordination within a substation | | OPC-UA | Level 2-4 (increasingly pushed to Level 1 on modern PLCs) | Cross-vendor interop (SCADA-historian-MES), and Level 2/3-to-cloud bridging | | SNMP | Network infrastructure (switches/routers/firewalls around all levels) | Device health monitoring, not process control | ** Known Real-World Attacks | Protocol | Case study | |----------+------------------------------------------------------------------------------------------------------------------------------------| | Modbus | FrostyGoop (2024) — injected Modbus TCP commands to disable district heating, Ukraine | | DNP3 | No single named malware yet exploiting DNP3 directly at scale; risk is mainly from it being unauthenticated by default | | IEC 104 | No single named malware yet exploiting IEC 104 directly at scale; same unauthenticated-by-default risk | | GOOSE | Industroyer (2016) — forged GOOSE stNum to spoof breaker-open state, Ukraine grid | | OPC-UA | No single named malware yet; risk driven by internet-exposed misconfigurations (Security Policy: None) rather than a protocol flaw | | SNMP | Russian FSB Center 16 — exfiltrated critical-infrastructure router configs via SNMP + Cisco Smart Install | ** Regional / Vendor Notes - DNP3 dominates North America; IEC 104 dominates Europe/Middle East/Asia/Africa — functionally parallel protocols serving the same utility master-to-RTU role in different regions. - OPC-UA's founding purpose was horizontal cross-vendor interoperability (replacing the Windows-only COM/DCOM-based original OPC); vertical IT/cloud bridging and field-level PLC-native deployment are both newer extensions of that original role. - SNMP isn't an ICS-native protocol at all — it rides alongside the other protocols on the same network infrastructure (switches, routers, sometimes OT devices themselves, as Conpot's multi-protocol emulation reflects).