In Wireshark, there are display filters which reference 32-bit registers (modbus.regnum32, modbus.regval_float, modbus.regval_int32, modbus.regval_uint32). However, there is no indication in the modbus protocol that two registers should be 'joined' into one, forming a 32-bit register. SO - they all appear in a capture as 16-bit registers, thereby making these display filters pointless. The presence of the display filters makes me think that there must be some way to have Wireshark decode modbus response packets such that registers are seen as 32-bit types...but I can't figure out how to do this. Has anybody done this before?
I'm trying to filter out exactly when a modbus server is replying with a specific value in a dual (32-bit) register.
