Modbus register filtering

retag add tags

I would like to find a way to filter specific Modbus register number out of a capng capture. For example there is a register which reads the asset frequency at register 39 Function code 4. Is there a filter command in WS which will filter just this one register? Thanks, Don

There is a capture attached to 13734: Modbus dissector - FC2 Response reference number which uses FC 3. Have not found an example with FC 4.

(modbus.func_code == 3) && (modbus.regnum16 == 4)

Looks like you need to know if the register is a modbus.regnum16 or modbus.regnum32 field.
Or brute force it:
(modbus.func_code == 3) && ((modbus.regnum16 == 4) or (modbus.regnum32 == 4))

Chuckc

answered 2023-09-15 22:06:31 +0000

edit flag offensive 0 remove flag delete link

Comments

Hi ChuckC,

This is a great step and I was able to filter on FC 4. The next step would be to filter on a particular register. In this case register 39.

 I tried (modbus.regval_int16 == 39) but that yielded no values. Any suggestions on filtering on a specific register number?

Thanks so much,

    Don

WireSharkStudent (2023-09-15 22:19:03 +0000) edit

Did you try with the regnum fields instead of the regval ones?

Chuckc (2023-09-15 23:33:43 +0000) edit

Hi ChuckC,

Indeed using the modbus.regnum16 worked great! Thanks so much for your help as I can now do much more capable work with WS.

 Have a great week,

        Don

WireSharkStudent (2023-09-18 15:23:21 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Modbus register filtering edit

Comments

1 Answer

Comments