GICSP: Global Industrial Cyber Security Professional CertificationDemo

In Modbus/TCP, read operations use function codes 3 (Read Holding Registers) or 4 (Read Input Registers), while overwriting a register is performed with function code 6 (Write Single Register). A packet capture with a total of 48 packets cannot contain a packet numbered above 48, which rules out the higher-numbered candidates outright. Given that the traffic begins with a sequence of read query/response/acknowledgment cycles (each consuming roughly three packets per Modbus transaction) before the attacker pivots to overwriting a register value, the first Write Single Register packet falls after several of these read cycles have completed rather than at the very start of the capture, placing it at packet 28.