Trying to figure out what modbus register addresses are being requested in a capture

edit

The Modbus dissector shows Modbus addresses as sent over the wire, these are always 0 based and the function code used indicates the I/O type.

Modbus requests indicate the starting bit number or register and the number of bits or registers to read. For write requests the Write Single Coil (5) and Write Single Register (6) commands obviously write a single bit\register, for the multiple equivalents a count of bits or registers is also sent. There is no direct representation of all the registers being accessed.

When dissecting Modbus requests, the dissector adds the filter modbus.reference_num for the starting reference, either a bit number for digitals, or a register for analogs and for multiple values adds the filter modbus.bit_cnt or modbus.word_cnt for the number of digitals or analogs respectively.

Using these values the range of registers read\written can be calculated. In your example 3 analog output registers starting at 8416 are being read, i.e 8416, 8417, 8418.

It's usually best to post a trace file in a publicly available location with a sample of the packets you have questions about. Text copies do not always yield the same information that a real trace may provide.

In this case, the reference number is the register start range from the request:

Function Code: Read Holding Registers (3) Reference Number: 8416 Word Count: 3

Start at holding register 8416 and read three registers (Word Count).

Modbus is classically all over the map when it comes to register numbering - some start counting at 0, others at 1. Also some use related, but different, numbering:

Holding register: 8416 Register: 48416 or 408416 <-- where the leading 4 implies holding register

Here is a paper on addressing: https://cdn.selinc.com/assets/Literat...ModbusRegisterCB_20160523.pdf?v=20170217-161433