Port reference
Port 102 (TCP) – S7comm
Siemens S7 communication over ISO-on-TCP (COTP/TPKT) — controls and programs SIMATIC S7 PLCs.
Quick facts
- Transport
- tcp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on Siemens S7-300/400/1200/1500 PLCs and CPs, typically with no authentication on the protocol itself.
What is port 102 used for?
Port 102 carries S7comm, the protocol Siemens SIMATIC S7 PLCs use to talk to engineering software. Tools like TIA Portal and STEP 7 connect over it to read and write PLC memory, download program logic, and start or stop the controller. You'll see it on factory-floor automation gear: S7-300, S7-400, S7-1200, and S7-1500 controllers and their communication processors.
When would you open it?
Open port 102 only between an engineering workstation and the PLCs it programs, or for a SCADA/HMI system that monitors them. In practice this stays inside an isolated industrial (OT) network — there is almost never a reason to forward it through a router to the wider network, let alone the internet.
Is it safe to open?
Classic S7comm has no authentication, so anyone who can reach the port can control the PLC; keep it on a segmented OT network behind a firewall and never expose it publicly. See the security notes below.
How to check if this port is open
ss -tulpn | grep :102
nmap -p 102 <target>netstat -ano | findstr :102
Test-NetConnection <host> -Port 102lsof -i :102
nmap -p 102 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 102 to your device's local IP, internal port 102, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 102/tcpsudo firewall-cmd --permanent --add-port=102/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 102 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 102" -Direction Inbound -Protocol TCP -LocalPort 102 -Action AllowSecurity & risks
Common attacks
- Unauthenticated PLC start/stop commands halting a process
- Reading and uploading PLC program logic and configuration
- Writing memory/blocks to manipulate the controlled process
- Device enumeration of CPU, firmware, and serial via s7-info
Hardening
- Never expose port 102 to the internet — keep PLCs on an isolated OT network
- Segment with firewalls/DMZ and use unidirectional gateways where possible
- Enable S7 access protection and known-list/communication restrictions on newer CPUs
- Monitor OT traffic with an ICS-aware IDS for anomalous S7 commands
How to block this port
sudo ufw deny 102/tcpsudo firewall-cmd --permanent --remove-port=102/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 102 -j DROPNew-NetFirewallRule -DisplayName "Block 102" -Direction Inbound -Protocol TCP -LocalPort 102 -Action Blocknmap snippet
nmap -p102 --script s7-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does S7comm have authentication?
- Classic S7comm has no authentication. Anyone who reaches port 102 can read, write, start, or stop the PLC. Newer S7-1500 CPUs add access levels and S7comm-plus, but legacy deployments remain wide open.
- Is port 102 related to Stuxnet?
- Yes. Stuxnet targeted Siemens S7 PLCs and manipulated their logic over this S7 communication channel, which is why exposed port 102 is treated as a critical OT risk.