Internet-Security raven logo internet-security.com

TCP 102

ProtocolTCP
Port102
Labelsiso-tsap tsap, part of ISODE

Synopsis

  • TCP port 102 is used for ISO on TCP (RFC 1006/ISO-TSAP) and is common in industrial control systems.
  • Siemens SIMATIC S7 PLCs (S7-300/400/1200/1500) and their engineering software (STEP 7, TIA Portal, and SIMATIC NET RFC1006) use S7comm/S7commPlus over port 102.
  • IEC 61850 MMS (ISO 9506) runs on TCP 102 in many substation IEDs, including Siemens SIPROTEC 5, ABB Relion, GE Multilin, and SEL protection relays.
  • MMS-capable gateways and SCADA products, such as Schneider Electric IEC 61850 gateways and implementations based on OpenIEC61850/OpenMUC, also listen on 102.
  • Security note: Port 102 has been leveraged in real attacks—most famously Stuxnet communicated with Siemens S7 PLCs over S7comm on 102—and exposed services are frequently scanned, with multiple Siemens advisories addressing authentication and protocol weaknesses.

Observed activity

Last 30 days Detailed chart

More information