Modbus Mayhem

Analyse an industrial control network capture and find the command that changed a physical setpoint.

Scenario

At the Verde Water District's treatment plant, a boiler control loop tripped its high-temperature alarm in the small hours. The plant's process network speaks Modbus/TCP, a protocol that never asks anyone to prove who they are, and a control engineer had a capture running when it happened.

Normally a human-machine interface (HMI) sits there politely polling the programmable logic controller (PLC) for sensor readings. Hidden in that steady poll traffic is one command that wrote a new setpoint. Track it down, and say who sent it and to which device.