With the development of information technology, the originally closed industrial control system (ICS) protocol has become more public. Existing protocol fuzzing techniques can be directly applied to public ICS protocols to discover their vulnerabilities. However, they do not consider how to obtain the complete ICS protocol message syntax and perform effective state-guided fuzzing based on this syntax. This causes a large number of generated test cases to fail the syntax checking of the ICS protocol program and are eventually discarded. In this paper, we propose CtrlFuzz, a control field aware protocol fuzzer for public ICS protocols. We find that most ICS protocol programs perform different processing based on the value of the control field when processing received messages. These messages with different control field values together constitute the complete ICS protocol message syntax. Based on the above observations, we propose an expert system-based extracting strategy for complete ICS protocol message syntax. Specifically, CtrlFuzz uses an expert system to identify and infer the control fields in ICS protocol messages. To narrow the scope of inference, CtrlFuzz uses static analysis techniques to extract specific values in the program as optional values of the control fields. Moreover, we propose a state-guided fuzzing strategy based on the inferred message syntax. Our evaluation shows that compared with the state-of-the-art protocol fuzzers AFLNET, BooFuzz, StateAFL and ChatAFL, CtrlFuzz improves branch coverage by 6.8%–10.9% and state coverage by 23.7%–147.4% on average within 24 hours. Moreover, CtrlFuzz has exposed a total of 4 unknown vulnerabilities, and all have been confirmed and fixed, with one assigned a CVE number.