Quantifying Active Reconnaissance Strain and Designing Passive Protocol-Level Anomaly Detection in Modbus TCP Industrial Control Networks

Operational Technology (OT) networks running legacy protocols like Modbus TCP face significant risks due to the lack of native authentication, transport encryption, and session verification. Traditional Information Technology (IT) security practices, such as active network discovery scanning, introduce severe operational strain when applied to resource-constrained Level 1 Programmable Logic Controllers (PLCs). This white paper empirically quantifies the impact of active reconnaissance on target PLCs within the GRFICSv3 chemical plant simulation, demonstrating CPU load spikes up to 26.73% (~25x baseline) and response latency degradation up to 409ms (~131x baseline). Furthermore, stateful parameter manipulation over TCP Port 502 using PyModbus demonstrates a 100% successful execution rate for unauthorized Function Code 06 (Write Single Register) commands. To address these vulnerabilities without introducing inline latency or packet dropping risks, a streaming, non-intrusive C-backed passive protocol anomaly detection engine (modbus_detector_fast.py) was engineered using a tshark subprocess backend. The passive engine achieved a 100% detection rate across synthetic attack vectors with zero false positives on baseline industrial traffic and execution times under 2 seconds. Defense-in-depth recommendations aligned with IEC 62443 are provided for OT network security architects.