Ask Your Question

Modbus on UDP

asked 2017-12-24 09:09:27 +0000

F. Chaxel gravatar image


Why Wiresark still not decode Udp Port 502 as Modbus ?

A long time ago a Wireshark version did (some years ago). It as been removed, saying it's not in the specification.

But Udp port 502 for Modbus is today implemented on All Wago Plc (also using broadcast), Eurotherm EPack device (Schneider Electric now !) , Kepware OPC DA-UA Server, Schneider Advantys ETB IO Block Modules (even if it's not says in the documentation !). ... and certainly a lot of others devices all arround the world, a simple request on Internet shows Matrikon, Janitza, Beckhoff, B&R, Phoenix Contact

And unfortunatly one cannot use the decode as function, Modbus is associated to TCP so it do not appears in the proposed list.


edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2017-12-24 11:45:08 +0000

Uli gravatar image

Don't know if I get your question right: In current Wireshark (2.4.3 and developer build 2.5.X) the Modbus dissector has been registered for UDP/502. Also "Decode As" "Modbus/UDP" is available for UDP data.

What version of Wireshark are you referencing? Any other issues I'm not able to see?

edit flag offensive delete link more



Sorry. My 2.2.1 version when I'm checking for update says it is the last one.

I will update manualy now.

Thank you.


F. Chaxel gravatar imageF. Chaxel ( 2017-12-24 12:04:01 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2017-12-24 09:09:27 +0000

Seen: 1,190 times

Last updated: Dec 24 '17