0
\$\begingroup\$

I'm attempting to use a RS232 tap to sniff a serial connection between two devices that are communicating using Modbus RTU.

I'm looking for any capture files taken from sniffing a COM connection or port that contain Modbus RTU (or Modbus ASCII). I would like to compare the data files that I am capturing to other similar data files. Does anyone have any example Modbus capture files, or could point me to a website that hosts these?

Note that I am not interested in Modbus/TCP.

\$\endgroup\$
  • 3
    \$\begingroup\$ Modbus specification is defining precisely the data format and possible messages, so you can easily forge some yourself. The format is very easy, it should not be a problem at all. \$\endgroup\$ – Eugene Sh. Jan 6 '16 at 20:09
  • \$\begingroup\$ Likely, but I'm trying to do some heuristics with the capture data that won't turn out correctly if I just generate the data. \$\endgroup\$ – vesche Jan 6 '16 at 20:27
  • \$\begingroup\$ Well, any dump will be a defined stream of message exchange with an arbitrary device. So I don't really see the difference with simulated one.. Anyway, I don't have a dump for you :) \$\endgroup\$ – Eugene Sh. Jan 6 '16 at 20:29
  • \$\begingroup\$ That message exchange (function code variance for instance) has statistical value to someone concerned with security. \$\endgroup\$ – vesche Jan 6 '16 at 20:33
  • \$\begingroup\$ Isn't it solely depending on the specific device? \$\endgroup\$ – Eugene Sh. Jan 6 '16 at 20:43
2
\$\begingroup\$

There is no need to compare to someone else's data capture. The Modbus spec is pretty clear about what makes a valid Modbus packet.

Actually there are two specs that apply in your case. The first is the Modbus application protocol spec. That tells you what needs to be in a Modbus packet as seen by the applications on the master and the slave. They refer to this packet as the PDU. Then you also need to read the Modbus over serial spec. That explains how PDUs are wrapped for transmission over a serial line. This adds a address byte at the start and two checksum bytes after the end of the application-level Modbus PDU.

You may want to get software that can generate packets for your device to resepond to, but looking at someone else's data capture isn't going to tell you anything the spec doesn't.

\$\endgroup\$
  • \$\begingroup\$ Thanks for the response, this field is somewhat foreign to me. What I'm trying to do is perform some statistical analysis on Modbus traffic. Would generated traffic really be a clear representation of actual traffic? Even if there was a register-level heartbeat being compared over time? \$\endgroup\$ – vesche Jan 6 '16 at 21:10
  • \$\begingroup\$ @vesche: Each system will probably have quite different statistics. The statistics from someone else's traffic would be largely irrelevant to yours. \$\endgroup\$ – Olin Lathrop Jan 7 '16 at 12:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.