SCADA Modbus TCP/RTU Frame Builder, CRC-16 Calculator & MQTT Auditor (2026)

Modbus RTU uses a 16-bit Cyclic Redundancy Check initialized to 0xFFFF with the reflected polynomial 0xA001 (normal 0x8005). Per the Modbus over Serial Line specification, the resulting 16-bit CRC is appended to the frame in Little-Endian order (Low Byte first, High Byte second), whereas all data addresses and register values inside the PDU are Big-Endian.

Modbus RTU is a binary serial protocol (RS-485/RS-232) that wraps the Protocol Data Unit (PDU) with a 1-byte Slave ID prefix and a 2-byte CRC-16 suffix. Modbus TCP (Port 502) drops the CRC-16 (relying on TCP/IP checksums) and prepends a 7-byte MBAP (Modbus Application Protocol) header containing Transaction ID (2B), Protocol ID (2B = 0x0000), Length (2B), and Unit ID (1B).

Traditional Modicon convention uses 1-based human numbering where prefix '4' indicates Holding Registers (40001–49999) and prefix '3' indicates Input Registers (30001–39999). On the wire inside the Modbus PDU, the prefix is implied by the Function Code (0x03 vs 0x04) and the register offset is 0-indexed—so Holding Register 40001 is transmitted as 0x0000.

Designed in 1979 for isolated serial buses, standard Modbus has zero authentication, zero encryption, and no session signing. Any host with network reachability to TCP port 502 can issue Function Code 0x05 (Write Single Coil) or 0x10 (Write Multiple Registers) to trip breakers, alter setpoints, or halt industrial processes unless protected by OT firewalls or Modbus/TLS.

In MQTT, the multi-level wildcard '#' matches every topic hierarchy on the broker. If a broker permits unauthenticated connects or overly broad ACLs, an attacker subscribing to '#' and '$SYS/#' can harvest all sensor payloads, firmware URLs, client IDs, and command channels across the facility.