S7comm is Siemens’ communication protocol for engineering and controlling S7 programmable logic controllers. It carries read and write operations used by authorized tools to inspect controller state, transfer logic, change parameters, and support maintenance. In practice, it often travels over TCP port 102, so any exposed S7comm service can become a direct path to the industrial control plane.
In cyber security, S7comm matters because it is dual use: the same traffic that supports legitimate engineering can also be abused if an attacker gains network reach and access. Malicious use may include reading process data, altering memory, modifying ladder logic, or disrupting control behavior. Defenders monitor port 102, restrict which hosts may speak S7comm, segment engineering workstations from general networks, and alert on unusual read/write patterns or off-hours sessions.