Protocol filtering is the inspection and selective enforcement of industrial protocol traffic at the command level. A protocol-filtering proxy understands the application protocol — not just TCP ports — and applies allow/deny rules to specific function codes, register ranges, or object operations.
Why port-level filtering is not enough
Traditional firewalls filter by 5-tuple: source IP, destination IP, source port, destination port, protocol. This works for HTTPS and SSH. It is insufficient for industrial protocols, where the difference between a read operation and a write operation is a single function-code byte inside the payload.
A Modbus TCP session on port 502 can carry function code 03 (read holding registers) or function code 06 (write single register) in the same packet structure. The firewall cannot distinguish them. An engineer's diagnostic tool and a malicious actor attempting to change a valve setpoint look identical at the port level.
Protocol filtering inspects the payload, identifies the function code, and applies a policy: allow reads from the SCADA historian, deny writes from anything other than the approved engineering workstation during the approved change window.
Protocols commonly filtered
- Modbus TCP (port 502) — function codes 01–06 cover reads and writes; function codes 08, 16, 23 are frequently restricted.
- DNP3 (port 20000) — Control Relay Output Block and Analog Output Block operations are typically deny-by-default.
- EtherNet/IP (port 44818/2222) — CIP services Set Attribute Single and Set Attribute All are restricted.
- Profinet (port 34962+) — cyclic I/O exchange versus acyclic configuration writes.
- OPC UA (port 4840) — Write Service and Call Service with attribute-level granularity.
- BACnet (port 47808) — WriteProperty and WritePropertyMultiple in building automation.
What a protocol-filtering proxy adds
Three things a port-level firewall cannot:
- Command-level audit. Every request and response is logged with the function code and parameters, not just bytes transferred.
- Per-session role enforcement. A read-only operator account can reach the device over the exact same port as an engineer, but only writes from the engineer are allowed.
- Protocol-aware anomaly detection. A sudden burst of write operations outside the change-control window becomes a detectable event.
Related terms
Access Gate connection
Access Gate filters Modbus, DNP3, EtherNet/IP, Profinet, and OPC UA at the command level, enforcing per-session role-based policies that port firewalls cannot express. See Securing Modbus.
