Ask Your Question

Modbus dual (32-bit) registers

asked 2022-11-14 14:51:31 +0000

Ammunist gravatar image

In Wireshark, there are display filters which reference 32-bit registers (modbus.regnum32, modbus.regval_float, modbus.regval_int32, modbus.regval_uint32). However, there is no indication in the modbus protocol that two registers should be 'joined' into one, forming a 32-bit register. SO - they all appear in a capture as 16-bit registers, thereby making these display filters pointless. The presence of the display filters makes me think that there must be some way to have Wireshark decode modbus response packets such that registers are seen as 32-bit types...but I can't figure out how to do this. Has anybody done this before?

I'm trying to filter out exactly when a modbus server is replying with a specific value in a dual (32-bit) register.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2022-11-14 15:32:16 +0000

Jaap gravatar image

Have a look at the ModBus protocol preferences. There you can configure how these registers are to be interpreted.

edit flag offensive delete link more


YES! Thank you! Under Edit -> Preferences -> Protocols -> Modbus, I can set how the registers are interpreted. Wow, this helps a lot!

Ammunist gravatar imageAmmunist ( 2022-11-14 15:50:18 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-11-14 14:51:31 +0000

Seen: 140 times

Last updated: Nov 14