ModbusTCP traffic showing up in WireShark as TCP packets

1.5k Views Asked by At

I am using pyModbusTCP to send ModbusTCP packets on my local host. My code seems to work correctly, but in Wireshark my packets are showing as TCP instead of ModbusTCP. When I go to "Analyze > Enable Protocols" ModbusTCP is enabled. Another weird thing is that last week I followed this tutorial YouTube Video and I was able to get Wireshark to recognize ModbusTCP packets. I tried it again today, and I had the same problem with Wireshark labeling ModbusTCP packets as TCP. I have no idea why this is happening and was hoping to get some advice?

Server Code:

from pyModbusTCP.server import ModbusServer, DataBank
from time import sleep
from random import uniform

# set up server on Local Host port 12345
server = ModbusServer('127.0.0.1',12345, no_block=True)
# initialize register 0 with value of 80
DataBank.set_words(0, [80])

try:
        print("Start server...")
        server.start()
        print("Server is online...")
        # change register value every 5 seconds. 
        while True:
            # Set Register @ Address 0 to random int. value
            DataBank.set_words(0, [int(uniform(0,100))])
            sleep(5)
# when hit ctrl+C in CMD line, shut down server
except:
        print("Shutdown server....")
        server.stop()
        print("Server is offline...")
        sleep(0.5)

Client Code:

from pyModbusTCP.client import ModbusClient
from pyModbusTCP.server import ModbusServer, DataBank
import time

# Set up client, tell it to communicate with server on local host port 12345
c = ModbusClient()
c.host("127.0.0.1")
c.port(12345)

while True:
    if not c.is_open():
        if not c.open():
            print("Unable to connect to 127.0.0.1:12345")
    
    if c.is_open():
        # Read Register 0 and print it to cmd line
        regs = c.read_holding_registers(0, 1)
        if regs:
            print("Register #0: " + str(regs))
            
    time.sleep(2)

A picture of my Wireshark window: Wireshark Output

1

There are 1 best solutions below

0
On

I figured it out. Wireshark wasn't labeling packets correctly because I shifted my traffic from port 502 to port 12345 because I needed superuser permissions to talk on port 502. I switched it back to port 502 in my code and now Wireshark labels them as ModbusTCP packets.