Table of Contents
10 S7 Communication
Even though Siemens never officially released their PLC communication protocol, there is a lot of information available, most of which was gained by reverse-engineering the network communication.
Disclaimer: All the information reproduced here is shared with best intentions. It has NOT been vetted for a production setting. It might or might not contain wrong or incomplete information. Use at your own risk!
Bits and bytes about the actual Siemens S7 protocol can be found in various places.
Tools and Driver websites
Snap7: Online Protocol DescriptionLibNoDave: Packages the documentation with the download
- S7 Communication in the Wireshark Wiki
- Kepware: Siemens TCP/IP Ethernet Driver
- Automation Direct C-more: https://www.automationdirect.com/microsites/c-more/software-help/Content/480.htm
- S7NetPlus: https://github.com/S7NetPlus/s7netplus
Specifications and Papers
- Amit Kleinmann, Avishai Wool: Accurate Modeling of the Siemens S7 Scada Protocol for Intrusion Detection and Digital Forensics
- Jan Tore Sørensen, Martin Gilje Jaatun: An Analysis of the Manufacturing Messaging Specification Protocol
Blog Posts and Articles