I have a Modbus capture file that contains a total of 133,000 packets. Among those packets are 1,500 error register queries. asked 10 Aug '15, 09:19  capesp |
One Answer:
That's a bit tricky as there's no real "direction" indicator in Modbus so you'll maybe have to use the source IP address, are all the responses from the same RTU? If they are, use the RTU address as the source IP address, if not use the master's address as the destination IP address. In addition, determining an error from a reply is done with the function code, an error has 0x80 added to the function code. I think you'll need something like:
answered 10 Aug '15, 09:42  grahamb ♦ edited 10 Aug '15, 09:42 |
Thank you, Graham, for your quick response.
The register data in the valid Modbus response contains the slave device error status that can be OR'd to include more than a single error. This requires a register data search for any non-zero data value.
The captured Modbus traffic is between only two devices 192.168.2.31 and 192.168.1.102. Filtering on FC '3' reduces the packet count to 98K, while filtering on (modbus.reference_num == 2110) reduces packet count to 1534.
The core of the problem is to identify the non-zero register values in the responses to a FC '3' query of register '2110'.
OK, so not a modbus error, but a specific data value. Are the requests only for the single register 2110, or is that register found in other requests, maybe in the middle of a block?
If the register result is always at a specific offset in the response then a filter can be constructed for the offset.
The request is always for the single register 2110 with FC 3.
That's more difficult as the response has no indication of which register(s) was requested, so this would require pattern matching across both the request and response which Wireshark filters can't do.
If all the read holding register (FC 3), single register responses are for the required register address then a filter can be constructed for the specific bytes you're interested in, however if there are reads for other single register addresses mixed in then this can't be done.
The Modbus dissector could be enhanced to add conversation info to the response indicating the requested register addresses to allow such a filter to be created. The Wireshark Bugzilla is the place for an enhancement request.
I appreciate your help and insight, Graham.
The answer was not as promising as I had hoped. Your suggestion for an enhancement to the Modbus dissector is the most probable solution in the long-term. A macro along with some manual searching might be the only way to identify the error packet in the short-term.
An expansion of the 'conversation' feature to a 'query conversation' would be a natural and useful extension of the Modbus dissector.