Ask Your Question

ModbusTCP capture not working on certain Laptops

asked 2022-09-30 11:04:02 +0000

updated 2022-09-30 11:16:49 +0000

grahamb gravatar image

Good morning,

I am finding a strange problem and my company IT guy cannot figure out too.

For a test I have three laptops running wireshark, installed absolutely the same way (default setting, full install, same version):

  • LaptopA=company laptop, windows 11
  • LaptopB=company laptop, windows 10
  • LaptopC=personal laptop, windows 10

When I capture packets from a mirror port of a switch or of a PLC, with LaptopsA&B (the company laptops) it captures all but fails capturing modbusTCP packets, while with LaptopC (personal laptop) it also captures modbusTCP packets correctly.

When I don't use switch port in mirror mode i.e. I just want to monitor packets running through the laptop (generating traffic with a modbusTCP simulated server for example, or a PLC project platform) ethernet port, it catches them correctly with all my three laptops.

So, anyone has any idea about what maybe hidden setting may affect the two company laptop such a way that they miss the modbusTCP packets only while in "sniffing" mode? Thanks

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2022-10-01 11:48:17 +0000

SYN-bit gravatar image

Could it be that the PLC packets coming from the mirror port are VLAN-tagged? In that case, you might need to change some registry settings to make the NIC pass on the packets. You might also need to change some registry settings to make Laptop-C show the vlan tags (as the NIC driver will normally strip them before NPCAP sees them).

Have a look at:

Also, I assume you are using promiscuous mode on all 3 laptops and no capture filter. Is that correct?

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-09-30 11:04:02 +0000

Seen: 112 times

Last updated: Oct 01