Modbus frame decoder
Paste hex from Wireshark, a log or a manual. The decoder splits it into fields, checks the length and CRC, and names exception codes.
Modbus TCP: Read Holding Registers: address 0, quantity 3
| Offset | Field | Bytes | Meaning |
|---|---|---|---|
| 0 | Transaction ID | 00 01 | 1. The response repeats it. |
| 2 | Protocol ID | 00 00 | 0 = Modbus |
| 4 | Length | 00 06 | 6 bytes follow (Unit ID + PDU) |
| 6 | Unit ID | 01 | 1 |
| 7 | Function | 03 | 03 Read Holding Registers |
| 8 | Address | 00 00 | Protocol address 0 (0-based) |
| 10 | Quantity | 00 03 | 3 register(s) |
Runs in your browser. The values you type stay on your device.
Where to get a frame
- Wireshark decodes Modbus TCP on port 502 by default. Copy the TCP payload as a hex stream.
- On Linux,
tcpdump -X port 502prints the payload next to the headers. - Vendor manuals print example requests. Paste one to see what the manual assumes about addressing.
For the theory, read the Modbus TCP frame, byte by byte and Modbus exception codes.
Questions
How does it tell Modbus TCP from RTU?
If the last two bytes match the CRC of the rest, it reads RTU. Otherwise it reads an MBAP header and checks it. You can also force either one.
Why does it ask about request or response?
A few frames fit both. For example 01 03 xx yy zz could be a read request or a response with three data bytes. The decoder picks a request and warns you; choose Response to see the other reading.
Does it send anything to a device?
No. It only decodes the text you paste, in your browser.