#308 - How to troubleshoot a Modbus TCP communication

- From Windows PowerShell confirm the port of the connection:

TCP test connection on the target port, e.g., Test-NetConnection 192.168.0.1 -port 502

- From nmap: Check open ports, e.g., nmap -e eth3 192.168.0.1 -p 502

Note that the flag -e forces nmap to use a specific NIC. The NICs can be displayed using the command nmap --iflist

- From wireshark open the traffic capture on the NIC and filter by TCP.

- Some open source tools to test are CAS Modbus Scanner and qModMaster.

Setup on qModMaster for Read Holding Registers starting at 40001:

This is the response from wireshark.

Setup on CAS Modbus Scanner for Read Holding Registers starting at 40001:

Understanding the poll request and the response:

Poll (Request): 01 03 00 00 00 64 01: Unit ID / Slave ID (Device #1). 03: Function Code (Read Holding Registers). 00 00: Starting Address (Register 40001 / offset 0). 00 64: Quantity of Registers to read. 0x64 in hex is 100 in decimal.

Response: 01 03 C8 00 00 ... 01: Unit ID / Slave ID (Device #1). 03: Function Code (Read Holding Registers). C8: Byte Count. 0xC8 in hex is 200 in decimal (i.e., 100 registers x 2 bytes/register). At bytes 23–24 (00 09): Register 11 has a value of 9. At bytes 25–26 (00 0A): Register 12 has a value of 10 (0x0A).