0
\$\begingroup\$

I'm attempting to use a RS232 tap to sniff a serial connection between two devices that are communicating using Modbus RTU.

I'm looking for any capture files taken from sniffing a COM connection or port that contain Modbus RTU (or Modbus ASCII). I would like to compare the data files that I am capturing to other similar data files. Does anyone have any example Modbus capture files, or could point me to a website that hosts these?

Note that I am not interested in Modbus/TCP.

\$\endgroup\$
7
  • 3
    \$\begingroup\$ Modbus specification is defining precisely the data format and possible messages, so you can easily forge some yourself. The format is very easy, it should not be a problem at all. \$\endgroup\$
    – Eugene Sh.
    Jan 6, 2016 at 20:09
  • \$\begingroup\$ Likely, but I'm trying to do some heuristics with the capture data that won't turn out correctly if I just generate the data. \$\endgroup\$
    – vesche
    Jan 6, 2016 at 20:27
  • \$\begingroup\$ Well, any dump will be a defined stream of message exchange with an arbitrary device. So I don't really see the difference with simulated one.. Anyway, I don't have a dump for you :) \$\endgroup\$
    – Eugene Sh.
    Jan 6, 2016 at 20:29
  • \$\begingroup\$ That message exchange (function code variance for instance) has statistical value to someone concerned with security. \$\endgroup\$
    – vesche
    Jan 6, 2016 at 20:33
  • \$\begingroup\$ Isn't it solely depending on the specific device? \$\endgroup\$
    – Eugene Sh.
    Jan 6, 2016 at 20:43

1 Answer 1

Reset to default
2
\$\begingroup\$

There is no need to compare to someone else's data capture. The Modbus spec is pretty clear about what makes a valid Modbus packet.

Actually there are two specs that apply in your case. The first is the Modbus application protocol spec. That tells you what needs to be in a Modbus packet as seen by the applications on the master and the slave. They refer to this packet as the PDU. Then you also need to read the Modbus over serial spec. That explains how PDUs are wrapped for transmission over a serial line. This adds a address byte at the start and two checksum bytes after the end of the application-level Modbus PDU.

You may want to get software that can generate packets for your device to resepond to, but looking at someone else's data capture isn't going to tell you anything the spec doesn't.

\$\endgroup\$
2
  • \$\begingroup\$ Thanks for the response, this field is somewhat foreign to me. What I'm trying to do is perform some statistical analysis on Modbus traffic. Would generated traffic really be a clear representation of actual traffic? Even if there was a register-level heartbeat being compared over time? \$\endgroup\$
    – vesche
    Jan 6, 2016 at 21:10
  • \$\begingroup\$ @vesche: Each system will probably have quite different statistics. The statistics from someone else's traffic would be largely irrelevant to yours. \$\endgroup\$
    – Olin Lathrop
    Jan 7, 2016 at 12:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.