Monitoring SCADA Modbus Traffic Anomalies When to Use - Monitoring OT/ICS networks for unauthorized Modbus commands targeting PLCs, RTUs, or HMIs - Detecting reconnaissance activity such as Modbus device enumeration (function code 43, Read Device Identification) - Identifying unauthorized write operations (function codes 05, 06, 15, 16) to coils and holding registers that could alter physical process parameters - Baselining normal Modbus communication patterns and alerting on deviations in function code distribution, register access ranges, or timing intervals - Investigating suspected sabota…