 | 1 | initial version |
It's usually best to post a trace file in a publicly available location with a sample of the packets you have questions about. Text copies do not always yield the same information that a real trace may provide.
In this case, the reference number is the register start range from the request:
Function Code: Read Holding Registers (3) Reference Number: 8416 Word Count: 3
Start at holding register 8416 and read three registers (Word Count).
Modbus is classically all over the map when it comes to register numbering - some start counting at 0, others at 1. Also some use related, but different, numbering:
Holding register: 8416 Register: 48416 or 408416 <-- where the leading 4 implies holding register
Here is a paper on addressing: https://cdn.selinc.com/assets/Literature/Publications/White%20Papers/0020_ModbusRegister_CB_20160523.pdf?v=20170217-161433
