I'm capturing frames of Modbus RTU protocol through a RS485/USB converter using USBPcap plugin. The problem is that I want to see the frames in Modbus RTU protocol because it appears as USB encapsulated. Is it possible to change the protocol/encapsulated from USB to Modbus RTU? How? Thank you in advanced Regards, Julio asked 01 Mar '16, 00:10  JCada edited 01 Mar '16, 00:19 |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
Dear Sirs,
Can you share a capture in a publicly accessible spot, e.g. CloudShark, Google Drive, Dropbox etc.?
@JCada, let me draw your attention to the fact that USB dissectors may need to "see" the enumeration phase in order to choose the proper sub-dissector for the (otherwise pretty generic) USB frame contents - in this case, the data must be dissected as serial communication over the prolific chip, which in turn may be dissected as Modbus RTU. I do not promise it will work, but try to capture the following way:
stop the Modbus control application and gracefully unplug the USB Modbus adaptor
start capturing on the relevant root hub (#2 in your case)
plug the USB Modbus adaptor back to the same socket where it was before
start the Modbus control application and capture the issue you are interested in
stop the capture
see whether it has helped
if not, save and publish the capture as @grahamb has suggested, otherwise there is little chance you could get more help unless someone has exactly the same experience and has managed to solve it in the past.