Display Filter Reference: Modbus/TCP

Protocol field name: mbtcp

Versions: 1.0.0 to 2.6.1

Back to Display Filter Reference

Field name Description Type Versions
mbtcp.cannot_classify Cannot classify packet type. Try setting Modbus/TCP Port preference to this destination or source port Label 2.2.0 to 2.6.1
mbtcp.len Length Unsigned integer, 2 bytes 1.8.0 to 2.6.1
mbtcp.modbus.and_mask AND mask Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.bit_cnt bit count Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.byte_cnt byte count Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.byte_cnt_16 byte count (16-bit) Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.conformity_level Conformity Level Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.data Data Sequence of bytes 1.8.0 to 1.8.15
mbtcp.modbus.diagnostic_code diagnostic code Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.ev_count event count Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.ev_msg_count message count Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.ev_recv_broadcast Broadcast Received Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.ev_recv_char_over Character Overrun Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.ev_recv_comm_err Communication Error Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.ev_recv_lo_mode Currently in Listen Only Mode Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.ev_send_lo_mode Currently in Listen Only Mode Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.ev_send_read_ex Read Exception Sent Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.ev_send_slave_abort_ex Slave Abort Exception Sent Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.ev_send_slave_busy_ex Slave Busy Exception Sent Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.ev_send_slave_nak_ex Slave Program NAK Exception Sent Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.ev_send_write_timeout Write Timeout Error Occurred Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.ev_status status Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.exception_code exception code Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.func_code function code Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.mei MEI type Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.more_follows More Follows Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.next_object_id Next Object ID Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.num_objects Number of Objects Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.object_id Object ID Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.object_str_value Object String Value Character string 1.8.0 to 1.8.15
mbtcp.modbus.objects_len Object length Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.or_mask OR mask Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.read_device_id Read Device ID Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.read_reference_num read reference number Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.read_word_cnt read word count Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.reference_num reference number Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.reference_num_32 reference number (32 bit) Unsigned integer, 4 bytes 1.8.0 to 1.8.15
mbtcp.modbus.reference_type reference type Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.unit_id unit identifier Unsigned integer, 1 byte 1.8.0 to 1.8.15
mbtcp.modbus.word_cnt word count Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.write_reference_num write reference number Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.modbus.write_word_cnt write word count Unsigned integer, 2 bytes 1.8.0 to 1.8.15
mbtcp.prot_id Protocol Identifier Unsigned integer, 2 bytes 1.8.0 to 2.6.1
mbtcp.trans_id Transaction Identifier Unsigned integer, 2 bytes 1.8.0 to 2.6.1
mbtcp.unit_id Unit Identifier Unsigned integer, 1 byte 1.10.0 to 2.6.1
modbus_tcp.and_mask AND mask Unsigned integer, 2 bytes 1.0.0 to 1.6.16
modbus_tcp.bit_cnt bit count Unsigned integer, 2 bytes 1.0.0 to 1.6.16
modbus_tcp.byte_cnt byte count Unsigned integer, 1 byte 1.0.0 to 1.6.16
modbus_tcp.byte_cnt_16 byte count (16-bit) Unsigned integer, 1 byte 1.0.0 to 1.6.16
modbus_tcp.data Data Sequence of bytes 1.6.0 to 1.6.16
modbus_tcp.exception_code exception code Unsigned integer, 1 byte 1.0.0 to 1.6.16
modbus_tcp.func_code function code Unsigned integer, 1 byte 1.0.0 to 1.6.16
modbus_tcp.len length Unsigned integer, 2 bytes 1.0.0 to 1.6.16
modbus_tcp.or_mask OR mask Unsigned integer, 2 bytes 1.0.0 to 1.6.16
modbus_tcp.prot_id protocol identifier Unsigned integer, 2 bytes 1.0.0 to 1.6.16
modbus_tcp.read_reference_num read reference number Unsigned integer, 2 bytes 1.0.0 to 1.6.16
modbus_tcp.read_word_cnt read word count Unsigned integer, 2 bytes 1.0.0 to 1.6.16
modbus_tcp.reference_num reference number Unsigned integer, 2 bytes 1.0.0 to 1.6.16
modbus_tcp.reference_num_32 reference number (32 bit) Unsigned integer, 4 bytes 1.0.0 to 1.6.16
modbus_tcp.reference_type reference type Unsigned integer, 1 byte 1.0.0 to 1.6.16
modbus_tcp.trans_id transaction identifier Unsigned integer, 2 bytes 1.0.0 to 1.6.16
modbus_tcp.unit_id unit identifier Unsigned integer, 1 byte 1.0.0 to 1.6.16
modbus_tcp.word_cnt word count Unsigned integer, 2 bytes 1.0.0 to 1.6.16
modbus_tcp.write_reference_num write reference number Unsigned integer, 2 bytes 1.0.0 to 1.6.16
modbus_tcp.write_word_cnt write word count Unsigned integer, 2 bytes 1.0.0 to 1.6.16
Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ Packet Analyzer PE
  • • Visually rich, powerful LAN analyzer
  • • Quickly access very large pcap files
  • • Professional, customizable reports
  • • Advanced triggers and alerts
Learn More

Buy Now

No, really, I have a LOT of traffic…

ANSWER: SteelCentral™ NetShark appliance
  • • Troubleshoot problems faster
  • • Quickly identify the applications running on your network
  • • Monitor your virtual machine traffic
Learn More