Port 102 and Siemens PLCs: Why It’s Not That Simple

Port 102 is often associated with Siemens SIMATIC S7 PLCs, but the reality is more nuanced: port 102 is the well-known port for the ISO-on-TCP protocol (RFC 1006), which Siemens uses for its S7 communication, but not every device listening on port 102 is a Siemens PLC, and not every Siemens PLC uses port 102. This article explains the technical background, how to identify Siemens PLCs on a network, and common misconceptions.

Formula

The calculator above converts a time interval in seconds to a packet rate in packets per second (pps). The formula is:

rate = 1000 / t

Where:

• t = time in seconds (must be greater than 0)
• rate = number of packets per second (pps)

This is a simple conversion: if you know how many seconds it takes to send 1000 packets, the rate is 1000 divided by that time.

Worked Example

Using the default value of t = 10 seconds:

1. Start with 1000 packets.
2. Divide by 10 seconds: 1000 / 10 = 100 pps.

The calculator returns 100.00 pps, which matches.

Background: What is Port 102?

Port 102 is assigned by the Internet Assigned Numbers Authority (IANA) to the ISO-TSAP protocol, which is a transport service access point for the OSI model over TCP/IP. This protocol is defined in RFC 1006 and provides a way to carry OSI session-layer data over TCP. Siemens adopted this for its S7 communication protocol, which is used to program, monitor, and exchange data with SIMATIC S7 PLCs. When you see port 102 open on a device, it often means that device is running an ISO-on-TCP service, but it does not guarantee that the service is Siemens-specific.

How Port 102 Works in Siemens Context

Siemens S7 PLCs use port 102 for the S7 protocol, which is encapsulated in ISO-on-TCP. The protocol stack is as follows:

• TCP/IP provides the transport.
• RFC 1006 adds a small header to allow OSI session-layer multiplexing.
• The S7 protocol (also called S7comm) runs on top.

When a client (like TIA Portal or a SCADA system) connects to a Siemens PLC, it opens a TCP connection to port 102 and sends S7comm requests. The PLC responds with data or status information. This is why port 102 is often flagged in network scans as a potential Siemens device.

Why Port 102 Alone Doesn’t Identify a Siemens PLC

Several reasons explain why port 102 is not a reliable indicator:

• Other devices use ISO-on-TCP: Some industrial devices from other vendors (e.g., certain Rockwell or Schneider products) also use RFC 1006 for their own protocols, though not always on port 102.
• Port 102 can be used for other services: Any application can be configured to listen on port 102, even if it has nothing to do with OSI or S7.
• Siemens PLCs can use other ports: Newer S7-1500 PLCs also support other protocols like OPC UA (port 4840) and HTTPS (port 443) for certain functions. The S7 communication itself still uses port 102, but a device may have port 102 closed if the service is disabled.
• NAT and firewalls: In complex networks, port mapping can hide the actual device. A port scan of an external IP might show port 102 open, but the internal device could be a router or a firewall forwarding the traffic.

Therefore, seeing port 102 open is a clue, but not proof.

How to Identify a Siemens PLC on a Network

To confirm a device is a Siemens PLC, you need more than a port scan. Here are common methods:

1. Use the S7 protocol itself: Send a valid S7comm request (e.g., a CPU identification request) and see if the response matches Siemens format.
2. Check the MAC address: Siemens devices often have an Organizationally Unique Identifier (OUI) in the MAC address that starts with 00:1B:1B, 00:0E:8C, or similar. You can look up the OUI to see if it belongs to Siemens.
3. Use a network scanner with industrial protocol detection: Tools like Nmap with the s7comm script can identify S7 devices by sending specific probes.
4. Look for other open ports: Siemens PLCs may also have ports like 102, 443, and 4840 open, but the combination is not unique.

None of these alone are 100% reliable, but combined they give high confidence.

Common Misconceptions and Pitfalls

One common misconception is that port 102 is exclusive to Siemens. In reality, RFC 1006 is a general standard. Another is that if port 102 is closed, the PLC is not present. However, the S7 service can be disabled or the PLC might be in a different mode (e.g., STOP) where it still responds to some requests but not others. Also, some Siemens devices (like older S5 PLCs) use different protocols and ports.

Another pitfall is assuming that a device responding on port 102 is a PLC. It could be a gateway, a soft PLC, or even a honeypot. Always verify with a proper S7 handshake.

Security Implications

Port 102 is a common target for attackers because S7 communication is often unencrypted and lacks authentication. If you find port 102 open, it is a potential security risk. However, not every open port 102 is a Siemens PLC, so a false positive could lead to unnecessary alarm. Conversely, a false negative (thinking a device is not a PLC) could leave you blind to a real asset. Therefore, accurate identification is important for network security.

Alternatives to Port 102

Siemens is moving toward more modern protocols. For example, S7-1500 PLCs support OPC UA, which uses port 4840, and they can be accessed via HTTPS for web-based diagnostics. PROFINET, the industrial Ethernet standard, uses other ports and protocols (like DCP on UDP 34964). So, a Siemens PLC may not always have port 102 open if the S7 service is not needed.

Frequently Asked Questions

Is port 102 always a Siemens PLC?

No. Port 102 is the default for ISO-on-TCP, which Siemens uses, but other devices can also use it. You must verify with a protocol-specific probe.

Can a Siemens PLC have port 102 closed?

Yes. The S7 service can be disabled in the PLC configuration, or the device might be a newer model that uses other protocols for certain functions. However, for programming via TIA Portal, port 102 is typically required.

What is the difference between port 102 and port 502?

Port 502 is used for Modbus TCP, a different industrial protocol. Siemens PLCs can also support Modbus TCP, but that is not the same as S7 communication.

How can I test if a device is a Siemens PLC?

Use a tool like Nmap with the s7comm script, or send a raw S7 communication setup packet and see if the response matches the expected structure. Also check the MAC address OUI.

Is S7 communication secure?

By default, S7 communication is not encrypted and does not require authentication. This is a known security risk. Siemens recommends using VPNs or other security measures.

Related

• How to Choose a VPN for iPhone: Privacy, Speed, Features
• How to Root LG Optimus Extreme L40G
• Steam Deck Battery Settings: Best TDP & FPS Guide

in t | Time (seconds) | s | 10 | 0
out rate | Packets per second | pps | 1000 / t | 2