This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Unsupported Display Filter Reference for Modbus in latest Wireshark versions

0

Looking at the Display Filter Reference for Modbus/TCP I noticed that most of the fields are not supported in the newer Wireshark versions. I wonder why, and I'll be more than happy to understand how can I still use these fields

Many Thanks in advance,

A.K.

asked 25 Jul '15, 05:35

ABK's gravatar image

ABK
6●2●2●4
accept rate: 0%

Which specific filters are no longer supported? (i.e., can you provide some of their filter names?)

(25 Jul '15, 07:05) Hadriel

One Answer:

2

I don't think they're gone - I think they just changed names and which protocol they're listed under.

I don't know anything about Modbus, but it looks like Wireshark added support for "Modbus RTU", as well as the previous "Modbus/TCP", so the display filter fields were split up: "Modbus/TCP" only lists the TCP-specific ones, "Modbus RTU" lists the RTU-specific ones, and a generic "Modbus" is where most of them are now, since they presumably apply to both TCP and RTU formats.

answered 25 Jul '15, 07:19

Hadriel's gravatar image

Hadriel
2.7k●2●9●39
accept rate: 18%

You are right thanks!! ABK

(25 Jul '15, 07:32) ABK

For reference, Modbus RTU is the binary protocol originally used over serial links that defines the basic data types and functions of Modbus, Modbus TCP is one of the variants of Modbus over IP that adds some header fields but doesn't alter the data types or functions used.

(25 Jul '15, 08:00) grahamb ♦