Three Industrial Ports, Three Very Different Numbers: Reading 102, 502 and 44818 Together
Industrial protocol exposure is usually reported as a single figure, and the single figure is usually wrong for the question being asked. A count of hosts on port 102 is not a count of exposed S7 controllers, and a count of hosts on port 502 is not a count of exposed Modbus devices. The three ports most often cited in industrial exposure reporting respond to very different numbers, and the difference between them is informative rather than incidental.
A ZoomEye query set collected on 22 September 2026 returned the following totals:
| Query | Total results |
|---|---|
port:102 |
261 |
port:502 |
844 |
port:44818 |
52 |
These are counts of indexed results matching a port filter at a point in time. They are not counts of vulnerable devices, and they are not directly comparable to each other without understanding what each port carries.
What each port actually indicates
Port 102 is the ISO Transport Service Access Point used by Siemens S7 communication (S7comm) and by other ISO-TSAP-based protocols. A host answering on 102 is a candidate for S7comm, which is the protocol used by Siemens SIMATIC controllers. The protocol is used for programming, diagnostics and process data exchange, and it has historically had no authentication on the base protocol.
Port 502 is the registered port for Modbus TCP. Modbus is a simple request-response protocol with no native authentication or encryption. It is implemented by a very wide range of devices: PLCs, gateways, energy meters, building controllers and industrial sensors. The breadth of implementations is the reason the port 502 count is larger than the port 102 count.
Port 44818 is the registered port for EtherNet/IP, which carries the Common Industrial Protocol (CIP). EtherNet/IP is used predominantly in Rockwell Automation environments and in equipment from other vendors that implement CIP. It is the least common of the three in this dataset.
The three protocols serve different vendor ecosystems and different industry segments. A single organisation is unlikely to have all three, and the global distribution of the three ports reflects where each ecosystem is deployed.
Why the numbers should not be added together
The temptation is to sum the three and report a total industrial exposure figure. That is not defensible for three reasons.
First, a single host can answer on more than one port. A gateway device may expose both Modbus TCP and EtherNet/IP. Summing the counts double-counts such hosts.
Second, the three counts describe different populations with different risk profiles. An exposed Modbus gateway on a building management network is a different risk from an exposed S7 controller on a production line.
Third, the counts are of indexed results, not of unique organisations or unique devices. Index coverage varies by protocol, by region and by how the service responds to a probe.
What the difference between the counts suggests
Modbus TCP has the largest count of the three in this dataset, and that is consistent with its implementation breadth. Modbus is implemented in firmware on low-cost devices, in gateways that bridge serial Modbus to TCP, and in software stacks that run on general-purpose hardware. EtherNet/IP has the smallest count, consistent with a narrower vendor ecosystem and a more specialised device population.
Port 102 sits between the two. S7comm is implemented by Siemens and by a limited set of compatible products, which constrains the population, but the installed base of SIMATIC equipment is large and long-lived.
What a defender should take from this
The relevant question is not the global count. It is which of these protocols are reachable from the internet in your own estate. The measurement method that answers that question is the same query set applied to your own address space, not a global total.
Three checks are worth running:
- Query your own netblocks for the three ports. A result in your own address space is an actionable finding; a global total is context.
- Identify the device behind each result. A port 502 result on a corporate network is usually a misconfigured gateway. A port 102 result on a production network is a different conversation.
- Check whether the exposure is intentional. Some organisations expose industrial protocols deliberately for remote maintenance. That is a decision that should be documented, not discovered.
Limitations of this measurement
These figures are a snapshot from a single collection on 22 September 2026. Indexed counts change as scanning coverage changes, and a protocol that does not respond to a standard probe will be undercounted. A host that answers on port 102 is not confirmed to be a Siemens controller; the port indicates a candidate, and protocol-level confirmation requires a different method.
The three numbers are useful as a comparison against each other and against a baseline collected later. They are not useful as a standalone statement about industrial risk.
References
- ZoomEye, cyberspace search engine. Query set:
port:102,port:502,port:44818; collected 22 September 2026. - IANA, Service Name and Transport Protocol Port Number Registry.
- CISA, Advisory AA26-231A and related industrial control system advisories.
- NIST, SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security.
Top comments (0)