Ask Your Question
0

capture filter modbus

asked 2023-07-12 14:41:26 +0000

normando.engr gravatar image

Hi! This may be a dumb question, but I am wondering if there is a way for me to filter (capture filter, not display filter) out protocols, specifically just to "Modbus/TCP".

Entering Modbus, modbus, Modbus/tcp, and modbus/tcp does not work.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2023-07-12 14:49:37 +0000

Chuckc gravatar image

Is it using the default port of 502? (Decoding Modbus TCP on different port number)

If so then capture filter of port 502 should work.

edit flag offensive delete link more

Comments

Thank you for the quick reply chuckc!

I originally filtered (for the capture filter) port 502. He said it may not always be port 502, so I have to find a way to just filter by protocols (if it is, at all possible).

Thank you again!

normando.engr gravatar imagenormando.engr ( 2023-07-12 14:52:14 +0000 )edit

There are no heuristic dissectors for modbus - all are tied to port numbers.
You could specify a list or range of port numbers if they are defined for the network architecture.

Chuckc gravatar imageChuckc ( 2023-07-12 15:02:26 +0000 )edit

That's exactly what I assumed, but I wanted to be 100% sure before I provide the information to my boss.

Thank you for your help! I will let him know, that I can run port ranges and work from there if anything.

normando.engr gravatar imagenormando.engr ( 2023-07-12 15:05:03 +0000 )edit

As Modbus traffic isn't very distinctive, there is no heuristic setting to allow automatic dissection on unusual ports, hence you have to manually set dissection ports using "Decode As ...".

Unless traffic is dissected as Modbus, the display filters you've listed won't work. Bit of a chicken and egg situation.

grahamb gravatar imagegrahamb ( 2023-07-12 15:09:20 +0000 )edit

Well noted! I looked at the last link chuckc provided (Decoding Modbus TCP on different port number). I figured that I will have to set it to "Decode As ..." for it to be displayed as that.

Thank you for the heads up on Display filters!

normando.engr gravatar imagenormando.engr ( 2023-07-12 15:15:08 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2023-07-12 14:41:26 +0000

Seen: 546 times

Last updated: Jul 12 '23