How to capture modbus tcp traffic on a switch

edit

If you're capturing on a switched network, you won't, by default, see traffic on the network except for broadcast and possibly multicast traffic, and unicast traffic to and from the machine doing the capturing; you won't see unicast traffic going between other machines plugged into the switch. See the "switched Ethernet" section of the Wireshark Wiki page on capture setup on Ethernet for details.

As that page indicates, there are ways to see all the traffic, but not all of them may work with your switch.

The manual for the Stratix Managed Switches uses the term "port mirroring" for the "send a copy of switch traffic to a particular port" feature.

The manual for the Stratix 2000 Unmanaged Switches doesn't mention that term, so it presumably does not implement that feature.

Unfortunately, this means that the "Capture using a monitor mode of the switch" instructions won't work, so you might not be able to capture traffic between the other equipment plugged into the switch.