Port 502 (Modbus/TCP)

Modbus over TCP, the most common industrial control protocol (PLCs, meters, inverters).

Well-known (system) port, 0-1023 TCP Industrial control (ICS/SCADA) Do not expose to the internet

What port 502 is used for

Modbus over TCP, the most common industrial control protocol (PLCs, meters, inverters).

Security: should port 502 be open?

Do not expose to the internet. Modbus has no authentication: anyone who can reach port 502 can read and write coils and registers. Never expose it; use segmented OT networks and VPNs.

IANA assignment

Service nameProtoDescriptionAssigneeReference

mbap TCP Modbus Application Protocol modbus.org -

mbap UDP Modbus Application Protocol modbus.org -

Registry dates for this port: last modified 2014-06-10.

Check what is listening on port 502

Linux: is anything listening on TCP 502?

sudo ss -tlnp 'sport = :502'

Linux / macOS: which process owns the port

sudo lsof -nP -i :502

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':502 '

Windows (Command Prompt)

netstat -ano | findstr :502

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 502 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 502

From Windows

Test-NetConnection HOST -Port 502

Block port 502 in the firewall

ufw

sudo ufw deny 502/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 502 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 502 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 502' -Direction Inbound -Protocol TCP -LocalPort 502 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.