2 * Routines for Modbus/TCP and Modbus/UDP dissection
3 * By Riaan Swart <rswart@cs.sun.ac.za>
4 * Copyright 2001, Institute for Applied Computer Science
5 * University of Stellenbosch
9 * http://www.modbus.org/
11 * for information on Modbus/TCP.
13 * Updated to v1.1b of the Modbus Application Protocol specification
14 * Michael Mann * Copyright 2011
18 * Wireshark - Network traffic analyzer
19 * By Gerald Combs <gerald@wireshark.org>
20 * Copyright 1998 Gerald Combs
22 * This program is free software; you can redistribute it and/or
23 * modify it under the terms of the GNU General Public License
24 * as published by the Free Software Foundation; either version 2
25 * of the License, or (at your option) any later version.
27 * This program is distributed in the hope that it will be useful,
28 * but WITHOUT ANY WARRANTY; without even the implied warranty of
29 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30 * GNU General Public License for more details.
32 * You should have received a copy of the GNU General Public License
33 * along with this program; if not, write to the Free Software
34 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
41 #include <epan/packet.h>
42 #include "packet-tcp.h"
43 #include "packet-mbtcp.h"
45 /* Initialize the protocol and registered fields */
46 static int proto_mbtcp = -1;
47 static int proto_modbus = -1;
48 static int hf_mbtcp_transid = -1;
49 static int hf_mbtcp_protid = -1;
50 static int hf_mbtcp_len = -1;
51 static int hf_mbtcp_unitid = -1;
52 static int hf_mbtcp_functioncode = -1;
53 static int hf_modbus_reference = -1;
54 static int hf_modbus_lreference = -1;
55 static int hf_modbus_reftype = -1;
56 static int hf_modbus_readref = -1;
57 static int hf_modbus_writeref = -1;
58 static int hf_modbus_wordcnt = -1;
59 static int hf_modbus_readwordcnt = -1;
60 static int hf_modbus_writewordcnt = -1;
61 static int hf_modbus_bytecnt = -1;
62 static int hf_modbus_lbytecnt = -1;
63 static int hf_modbus_bitcnt = -1;
64 static int hf_modbus_exceptioncode = -1;
65 static int hf_modbus_diag_sf = -1;
66 static int hf_modbus_status = -1;
67 static int hf_modbus_event_count = -1;
68 static int hf_modbus_message_count = -1;
69 static int hf_modbus_event_recv_comm_err = -1;
70 static int hf_modbus_event_recv_char_over = -1;
71 static int hf_modbus_event_recv_lo_mode = -1;
72 static int hf_modbus_event_recv_broadcast = -1;
73 static int hf_modbus_event_send_read_ex = -1;
74 static int hf_modbus_event_send_slave_abort_ex = -1;
75 static int hf_modbus_event_send_slave_busy_ex = -1;
76 static int hf_modbus_event_send_slave_nak_ex = -1;
77 static int hf_modbus_event_send_write_timeout = -1;
78 static int hf_modbus_event_send_lo_mode = -1;
79 static int hf_modbus_andmask = -1;
80 static int hf_modbus_ormask = -1;
81 static int hf_modbus_data = -1;
82 static int hf_modbus_mei = -1;
83 static int hf_modbus_read_device_id = -1;
84 static int hf_modbus_object_id = -1;
85 static int hf_modbus_num_objects = -1;
86 static int hf_modbus_list_object_len = -1;
87 static int hf_modbus_conformity_level = -1;
88 static int hf_modbus_more_follows = -1;
89 static int hf_modbus_next_object_id = -1;
90 static int hf_modbus_object_str_value = -1;
92 /* Initialize the subtree pointers */
93 static gint ett_mbtcp = -1;
94 static gint ett_modbus_hdr = -1;
95 static gint ett_group_hdr = -1;
96 static gint ett_events = -1;
97 static gint ett_events_recv = -1;
98 static gint ett_events_send = -1;
99 static gint ett_device_id_objects = -1;
100 static gint ett_device_id_object_items = -1;
102 static dissector_table_t mbtcp_dissector_table;
103 static dissector_table_t modbus_dissector_table;
104 static dissector_handle_t modbus_handle;
106 static gboolean mbtcp_desegment = TRUE;
109 classify_packet(packet_info *pinfo)
111 /* see if nature of packets can be derived from src/dst ports */
112 /* if so, return as found */
113 if (( pinfo->srcport == PORT_MBTCP ) && ( pinfo->destport != PORT_MBTCP ))
114 return RESPONSE_PACKET;
115 if (( pinfo->srcport != PORT_MBTCP ) && ( pinfo->destport == PORT_MBTCP ))
118 /* else, cannot classify */
119 return CANNOT_CLASSIFY;
122 /* Translate function to string, as given on p6 of
123 * "Open Modbus/TCP Specification", release 1 by Andy Swales.
125 static const value_string function_code_vals[] = {
126 { READ_COILS, "Read coils" },
127 { READ_INPUT_DISCRETES, "Read input discretes" },
128 { READ_MULT_REGS, "Read multiple registers" },
129 { READ_INPUT_REGS, "Read input registers" },
130 { WRITE_COIL, "Write coil" },
131 { WRITE_SINGLE_REG, "Write single register" },
132 { READ_EXCEPT_STAT, "Read exception status" },
133 { DIAGNOSTICS, "Diagnostics" },
134 { GET_COMM_EVENT_CTRS, "Get Comm. Event Counters" },
135 { GET_COMM_EVENT_LOG, "Get Comm. Event Log" },
136 { WRITE_MULT_COILS, "Write Multiple Coils" },
137 { WRITE_MULT_REGS, "Write Multiple Registers" },
138 { REPORT_SLAVE_ID, "Report Slave ID" },
139 { READ_FILE_RECORD, "Read File Record" },
140 { WRITE_FILE_RECORD, "Write File Record" },
141 { MASK_WRITE_REG, "Mask Write Register" },
142 { READ_WRITE_REG, "Read Write Register" },
143 { READ_FIFO_QUEUE, "Read FIFO Queue" },
144 { ENCAP_INTERFACE_TRANSP, "Encapsulated Interface Transport" },
148 /* Translate exception code to string */
149 static const value_string exception_code_vals[] = {
150 { ILLEGAL_FUNCTION, "Illegal function" },
151 { ILLEGAL_ADDRESS, "Illegal data address" },
152 { ILLEGAL_VALUE, "Illegal data value" },
153 { SLAVE_FAILURE, "Slave device failure" },
154 { ACKNOWLEDGE, "Acknowledge" },
155 { SLAVE_BUSY, "Slave device busy" },
156 { MEMORY_ERR, "Memory parity error" },
157 { GATEWAY_UNAVAILABLE, "Gateway path unavailable" },
158 { GATEWAY_TRGT_FAIL, "Gateway target device failed to respond" },
162 /* Translate Modbus Encapsulation Interface (MEI) code to string */
163 static const value_string encap_interface_code_vals[] = {
164 { CANOPEN_REQ_RESP, "CANopen Request/Response " },
165 { READ_DEVICE_ID, "Read Device Identification" },
169 /* Translate Modbus Diagnostic subfunction code to string */
170 static const value_string diagnostic_code_vals[] = {
171 { RETURN_QUERY_DATA, "Return Query Data" },
172 { RESTART_COMMUNICATION_OPTION, "Restart Communications Option" },
173 { RETURN_DIAGNOSTIC_REGISTER, "Return Diagnostic Register" },
174 { CHANGE_ASCII_INPUT_DELIMITER, "Change ASCII Input Delimiter" },
175 { FORCE_LISTEN_ONLY_MODE, "Force Listen Only Mode" },
176 { CLEAR_COUNTERS_AND_DIAG_REG, "Clear Counters and Diagnostic Register" },
177 { RETURN_BUS_MESSAGE_COUNT, "Return Bus Message Count" },
178 { RETURN_BUS_COMM_ERROR_COUNT, "Return Bus Communication Error Count" },
179 { RETURN_BUS_EXCEPTION_ERROR_COUNT, "Return Bus Exception Error Count" },
180 { RETURN_SLAVE_MESSAGE_COUNT, "Return Slave Message Count" },
181 { RETURN_SLAVE_NO_RESPONSE_COUNT, "Return Slave No Response Count" },
182 { RETURN_SLAVE_NAK_COUNT, "Return Slave NAK Count" },
183 { RETURN_SLAVE_BUSY_COUNT, "Return Slave Busy Count" },
184 { RETURN_BUS_CHAR_OVERRUN_COUNT, "Return Bus Character Overrun Count" },
185 { CLEAR_OVERRUN_COUNTER_AND_FLAG, "Clear Overrun Counter and Flag" },
189 /* Translate read device code to string */
190 static const value_string read_device_id_vals[] = {
191 { 1, "Basic Device Identification" },
192 { 2, "Regular Device Identification" },
193 { 3, "Extended Device Identification" },
194 { 4, "Specific Identification Object" },
199 /* Translate read device code to string */
200 static const value_string object_id_vals[] = {
202 { 1, "ProductCode" },
203 { 2, "MajorMinorRevision" },
205 { 4, "ProductName" },
207 { 6, "UserApplicationName" },
212 static const value_string conformity_level_vals[] = {
213 { 0x01, "Basic Device Identification (stream)" },
214 { 0x02, "Regular Device Identification (stream)" },
215 { 0x03, "Extended Device Identification (stream)" },
216 { 0x81, "Basic Device Identification (stream and individual)" },
217 { 0x82, "Regular Device Identification (stream and individual)" },
218 { 0x83, "Extended Device Identification (stream and individual)" },
223 /* Code to actually dissect the packets */
225 dissect_mbtcp_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
227 /* Set up structures needed to add the protocol subtree and manage it */
229 proto_tree *mbtcp_tree;
230 int offset, packet_type;
232 const char *func_string = "";
233 const char *pkt_type_str = "";
234 const char *err_str = "";
235 guint16 transaction_id, protocol_id, len;
236 guint8 unit_id, function_code, exception_code, subfunction_code;
237 void *p_save_proto_data;
239 /* Make entries in Protocol column on summary display */
240 col_set_str(pinfo->cinfo, COL_PROTOCOL, "Modbus/TCP");
241 col_clear(pinfo->cinfo, COL_INFO);
243 transaction_id = tvb_get_ntohs(tvb, 0);
244 protocol_id = tvb_get_ntohs(tvb, 2);
245 len = tvb_get_ntohs(tvb, 4);
247 unit_id = tvb_get_guint8(tvb, 6);
248 function_code = tvb_get_guint8(tvb, 7) & 0x7F;
250 /* Make entries in Info column on summary display */
253 /* Find exception - last bit set in function code */
254 if (tvb_get_guint8(tvb, 7) & 0x80) {
255 exception_code = tvb_get_guint8(tvb, offset + 8);
261 if ((function_code == ENCAP_INTERFACE_TRANSP) && (exception_code == 0)) {
262 func_string = val_to_str(tvb_get_guint8(tvb, offset + 8), encap_interface_code_vals, "Encapsulated Interface Transport");
263 subfunction_code = 1;
265 else if ((function_code == DIAGNOSTICS) && (exception_code == 0)) {
266 func_string = val_to_str(tvb_get_ntohs(tvb, offset + 8), diagnostic_code_vals, "Diagnostics");
267 subfunction_code = 1;
270 func_string = val_to_str(function_code, function_code_vals, "Unknown function (%d)");
271 subfunction_code = 0;
274 /* "Request" or "Response" */
275 packet_type = classify_packet(pinfo);
277 if (check_col(pinfo->cinfo, COL_INFO))
279 switch ( packet_type ) {
281 pkt_type_str="query";
283 case RESPONSE_PACKET :
284 pkt_type_str="response";
286 case CANNOT_CLASSIFY :
287 err_str="Unable to classify as query or response.";
288 pkt_type_str="unknown";
293 if ( exception_code != 0 )
294 err_str="Exception returned ";
296 if (subfunction_code == 0) {
297 if (strlen(err_str) > 0) {
298 col_add_fstr(pinfo->cinfo, COL_INFO,
299 "%8s: trans: %5u; unit: %3u, func: %3u: %s. %s",
300 pkt_type_str, transaction_id, unit_id,
301 function_code, func_string, err_str);
304 col_add_fstr(pinfo->cinfo, COL_INFO,
305 "%8s: trans: %5u; unit: %3u, func: %3u: %s",
306 pkt_type_str, transaction_id, unit_id,
307 function_code, func_string);
311 if (strlen(err_str) > 0) {
312 col_add_fstr(pinfo->cinfo, COL_INFO,
313 "%8s: trans: %5u; unit: %3u, func: %3u/%3u: %s. %s",
314 pkt_type_str, transaction_id, unit_id,
315 function_code, subfunction_code, func_string, err_str);
318 col_add_fstr(pinfo->cinfo, COL_INFO,
319 "%8s: trans: %5u; unit: %3u, func: %3u/%3u: %s",
320 pkt_type_str, transaction_id, unit_id,
321 function_code, subfunction_code, func_string);
326 /* if a tree exists, perform operations to add fields to it */
329 mi = proto_tree_add_protocol_format(tree, proto_mbtcp, tvb, offset,
330 len+6, "Modbus/TCP");
331 mbtcp_tree = proto_item_add_subtree(mi, ett_mbtcp);
333 /* Add items to protocol tree specific to Modbus/TCP */
334 proto_tree_add_uint(mbtcp_tree, hf_mbtcp_transid, tvb, offset, 2, transaction_id);
335 proto_tree_add_uint(mbtcp_tree, hf_mbtcp_protid, tvb, offset + 2, 2, protocol_id);
336 proto_tree_add_uint(mbtcp_tree, hf_mbtcp_len, tvb, offset + 4, 2, len);
337 proto_tree_add_uint(mbtcp_tree, hf_mbtcp_unitid, tvb, offset + 6, 1, unit_id);
339 /* dissect the Modbus PDU */
340 next_tvb = tvb_new_subset( tvb, offset+7, len-1, len-1);
342 /* keep packet context */
343 p_save_proto_data = p_get_proto_data( pinfo->fd, proto_mbtcp );
344 p_remove_proto_data(pinfo->fd, proto_mbtcp);
345 p_add_proto_data(pinfo->fd, proto_mbtcp, GINT_TO_POINTER(packet_type));
347 /* Show the undissected payload */
348 if( tvb_length_remaining(tvb, offset) > 0 )
349 call_dissector(modbus_handle, next_tvb, pinfo, tree);
351 p_remove_proto_data(pinfo->fd, proto_mbtcp);
352 p_add_proto_data(pinfo->fd, proto_mbtcp, p_save_proto_data);
357 get_mbtcp_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
362 * Get the length of the data from the encapsulation header.
364 plen = tvb_get_ntohs(tvb, offset + 4);
367 * That length doesn't include the encapsulation header itself;
374 dissect_mbtcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
376 /* Make sure there's at least enough data to determine its a Modbus packet */
377 if (!tvb_bytes_exist(tvb, 0, 8))
380 /* check that it actually looks like Modbus/TCP */
381 /* protocol id == 0 */
382 if(tvb_get_ntohs(tvb, 2) != 0 ){
385 /* length is at least 2 (unit_id + function_code) */
386 if(tvb_get_ntohs(tvb, 4) < 2 ){
390 /* build up protocol tree and iterate over multiple packets */
391 tcp_dissect_pdus(tvb, pinfo, tree, mbtcp_desegment, 6,
392 get_mbtcp_pdu_len, dissect_mbtcp_pdu);
394 return tvb_length(tvb);
398 dissect_mbudp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
400 /* Make sure there's at least enough data to determine its a Modbus packet */
401 if (!tvb_bytes_exist(tvb, 0, 8))
404 /* check that it actually looks like Modbus/UDP */
405 /* protocol id == 0 */
406 if(tvb_get_ntohs(tvb, 2) != 0 ){
409 /* length is at least 2 (unit_id + function_code) */
410 if(tvb_get_ntohs(tvb, 4) < 2 ){
414 /* dissect the PDU */
415 dissect_mbtcp_pdu(tvb, pinfo, tree);
417 return tvb_length(tvb);
420 /* Code to allow special handling of mbtcp data */
422 dissect_mbtcp_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint8 function_code, gint payload_start, gint payload_len)
427 reported_len = tvb_reported_length_remaining(tvb, payload_start);
429 if ( payload_start < 0 || ( payload_len + payload_start ) == 0 )
432 if ( payload_len != reported_len ) {
433 proto_tree_add_bytes_format(tree, hf_modbus_data, tvb, payload_start, payload_len, NULL, "Data");
437 next_tvb = tvb_new_subset(tvb, payload_start, payload_len, reported_len);
439 switch ( function_code ) {
441 if ( ! dissector_try_string(mbtcp_dissector_table, "data", next_tvb, pinfo, tree) )
442 proto_tree_add_bytes_format(tree, hf_modbus_data, tvb, payload_start, payload_len, NULL, "Data");
447 /* Code to actually dissect the packets */
449 dissect_modbus(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
451 proto_tree *modbus_tree, *group_tree, *event_tree,
452 *event_item_tree, *device_objects_tree,
453 *device_objects_item_tree;
454 proto_item *mi, *mf, *me, *mei, *doe, *doie;
455 int offset, group_offset, packet_type, temp_data;
456 const char *func_string = "";
457 gint payload_start, payload_len, event_index,
458 i, byte_cnt, len, num_objects, object_index,
460 guint32 group_byte_cnt, group_word_cnt;
461 guint8 function_code, exception_code, mei_code, event_code, object_type;
462 guint16 diagnostic_code;
465 /* Don't need to do anything if there's no tree */
467 return tvb_length(tvb);
469 len = tvb_length_remaining(tvb, 0);
470 function_code = tvb_get_guint8(tvb, 0) & 0x7F;
472 /* Find exception - last bit set in function code */
473 if (tvb_get_guint8(tvb, 0) & 0x80 ) {
474 exception_code = tvb_get_guint8(tvb, 1);
480 /* "Request" or "Response" */
481 packet_type = GPOINTER_TO_INT(p_get_proto_data( pinfo->fd, proto_mbtcp ));
483 /* Make entries in Info column on summary display */
486 /* Add items to protocol tree specific to Modbus generic */
487 mf = proto_tree_add_text(tree, tvb, offset, len, "Modbus");
488 modbus_tree = proto_item_add_subtree(mf, ett_modbus_hdr);
489 mi = proto_tree_add_uint(modbus_tree, hf_mbtcp_functioncode, tvb, offset, 1,
492 /** detail payload as a function of exception/function code */
493 func_string = val_to_str(function_code, function_code_vals, "Unknown function");
495 payload_start = offset + 1;
496 payload_len = len - 1;
497 if (exception_code != 0) {
498 proto_item_set_text(mi, "function %u: %s. Exception: %s",
501 val_to_str(exception_code,
503 "Unknown exception code (%u)"));
504 proto_tree_add_uint(modbus_tree, hf_modbus_exceptioncode, tvb, payload_start, 1,
508 proto_item_set_text(mi, "function %u: %s", function_code,
510 switch (function_code) {
513 case READ_INPUT_DISCRETES:
514 if (packet_type == QUERY_PACKET) {
515 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
516 proto_tree_add_item(modbus_tree, hf_modbus_bitcnt, tvb, payload_start + 2, 2, ENC_BIG_ENDIAN);
518 else if (packet_type == RESPONSE_PACKET) {
519 byte_cnt = (guint32)tvb_get_guint8(tvb, payload_start);
520 proto_tree_add_uint(modbus_tree, hf_modbus_bytecnt, tvb, payload_start, 1, byte_cnt);
521 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start + 1, byte_cnt);
526 case READ_INPUT_REGS:
527 if (packet_type == QUERY_PACKET) {
528 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
529 proto_tree_add_item(modbus_tree, hf_modbus_wordcnt, tvb, payload_start + 2, 2, ENC_BIG_ENDIAN);
531 else if (packet_type == RESPONSE_PACKET) {
532 byte_cnt = (guint32)tvb_get_guint8(tvb, payload_start);
533 proto_tree_add_uint(modbus_tree, hf_modbus_bytecnt, tvb, payload_start, 1, byte_cnt);
534 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start + 1, byte_cnt);
539 if (packet_type == QUERY_PACKET) {
540 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
541 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start + 2, 1);
542 proto_tree_add_text(modbus_tree, tvb, payload_start + 3, 1, "Padding");
544 else if (packet_type == RESPONSE_PACKET) {
545 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
546 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start + 2, 1);
547 proto_tree_add_text(modbus_tree, tvb, payload_start + 3, 1, "Padding");
551 case WRITE_SINGLE_REG:
552 if (packet_type == QUERY_PACKET) {
553 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
554 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start + 2, 2);
556 else if (packet_type == RESPONSE_PACKET) {
557 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
558 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start + 2, 2);
562 case READ_EXCEPT_STAT:
563 if (packet_type == RESPONSE_PACKET)
564 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start, 1);
568 if ((packet_type == QUERY_PACKET) || (packet_type == RESPONSE_PACKET)) {
569 diagnostic_code = tvb_get_ntohs(tvb, payload_start);
570 proto_tree_add_uint(modbus_tree, hf_modbus_diag_sf, tvb, payload_start, 2, diagnostic_code);
571 switch(diagnostic_code)
573 case RETURN_QUERY_DATA:
574 if (packet_type == QUERY_PACKET) {
576 proto_tree_add_text(modbus_tree, tvb, payload_start+2, payload_len-2, "Request Data");
578 else if (packet_type == RESPONSE_PACKET) {
580 proto_tree_add_text(modbus_tree, tvb, payload_start+2, payload_len-2, "Echo Data");
583 case RESTART_COMMUNICATION_OPTION:
584 temp_data = tvb_get_ntohs(tvb, payload_start+2);
585 if (temp_data == 0) {
586 proto_tree_add_text(modbus_tree, tvb, payload_start+2, 2, "Leave Log");
588 else if (temp_data == 0xFF) {
589 proto_tree_add_text(modbus_tree, tvb, payload_start+2, 2, "Clear Log");
592 proto_tree_add_text(modbus_tree, tvb, payload_start+2, 2, "Unknown");
595 case RETURN_DIAGNOSTIC_REGISTER:
596 if (packet_type == QUERY_PACKET) {
598 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start+2, payload_len-2);
600 else if (packet_type == RESPONSE_PACKET) {
601 temp_data = tvb_get_ntohs(tvb, payload_start+2);
602 proto_tree_add_text( modbus_tree, tvb, payload_start+2, 2, "Diagnostic Register Contents 0x%04x", temp_data );
605 case CHANGE_ASCII_INPUT_DELIMITER:
606 temp_data = tvb_get_guint8(tvb, payload_start+2);
607 proto_tree_add_text( modbus_tree, tvb, payload_start+2, 1, "CHAR 0x%02x", temp_data );
609 case RETURN_BUS_MESSAGE_COUNT:
610 if (packet_type == QUERY_PACKET) {
612 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start+2, payload_len-2);
614 else if (packet_type == RESPONSE_PACKET) {
615 temp_data = tvb_get_ntohs(tvb, payload_start+2);
616 proto_tree_add_text( modbus_tree, tvb, payload_start+2, 2, "Total Message Count %d", temp_data );
619 case RETURN_BUS_COMM_ERROR_COUNT:
620 if (packet_type == QUERY_PACKET) {
622 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start+2, payload_len-2);
624 else if (packet_type == RESPONSE_PACKET) {
625 temp_data = tvb_get_ntohs(tvb, payload_start+2);
626 proto_tree_add_text( modbus_tree, tvb, payload_start+2, 2, "CRC Error Count %d", temp_data );
629 case RETURN_BUS_EXCEPTION_ERROR_COUNT:
630 if (packet_type == QUERY_PACKET) {
632 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start+2, payload_len-2);
634 else if (packet_type == RESPONSE_PACKET) {
635 temp_data = tvb_get_ntohs(tvb, payload_start+2);
636 proto_tree_add_text( modbus_tree, tvb, payload_start+2, 2, "Exception Error Count %d", temp_data );
639 case RETURN_SLAVE_MESSAGE_COUNT:
640 if (packet_type == QUERY_PACKET) {
642 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start+2, payload_len-2);
644 else if (packet_type == RESPONSE_PACKET) {
645 temp_data = tvb_get_ntohs(tvb, payload_start+2);
646 proto_tree_add_text( modbus_tree, tvb, payload_start+2, 2, "Slave Message Count %d", temp_data );
649 case RETURN_SLAVE_NO_RESPONSE_COUNT:
650 if (packet_type == QUERY_PACKET) {
652 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start+2, payload_len-2);
654 else if (packet_type == RESPONSE_PACKET) {
655 temp_data = tvb_get_ntohs(tvb, payload_start+2);
656 proto_tree_add_text( modbus_tree, tvb, payload_start+2, 2, "Slave No Response Count %d", temp_data );
659 case RETURN_SLAVE_NAK_COUNT:
660 if (packet_type == QUERY_PACKET) {
662 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start+2, payload_len-2);
664 else if (packet_type == RESPONSE_PACKET) {
665 temp_data = tvb_get_ntohs(tvb, payload_start+2);
666 proto_tree_add_text( modbus_tree, tvb, payload_start+2, 2, "Slave NAK Count %d", temp_data );
669 case RETURN_SLAVE_BUSY_COUNT:
670 if (packet_type == QUERY_PACKET) {
672 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start+2, payload_len-2);
674 else if (packet_type == RESPONSE_PACKET) {
675 temp_data = tvb_get_ntohs(tvb, payload_start+2);
676 proto_tree_add_text( modbus_tree, tvb, payload_start+2, 2, "Slave Device Busy Count %d", temp_data );
679 case RETURN_BUS_CHAR_OVERRUN_COUNT:
680 if (packet_type == QUERY_PACKET) {
682 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start+2, payload_len-2);
684 else if (packet_type == RESPONSE_PACKET) {
685 temp_data = tvb_get_ntohs(tvb, payload_start+2);
686 proto_tree_add_text( modbus_tree, tvb, payload_start+2, 2, "Slave Character Overrun Count %d", temp_data );
689 case CLEAR_OVERRUN_COUNTER_AND_FLAG:
690 case FORCE_LISTEN_ONLY_MODE:
691 case CLEAR_COUNTERS_AND_DIAG_REG:
694 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start+2, payload_len-2);
700 case GET_COMM_EVENT_CTRS:
701 if (packet_type == RESPONSE_PACKET) {
702 proto_tree_add_item(modbus_tree, hf_modbus_status, tvb, payload_start, 2, ENC_BIG_ENDIAN);
703 proto_tree_add_item(modbus_tree, hf_modbus_event_count, tvb, payload_start+2, 2, ENC_BIG_ENDIAN);
707 case GET_COMM_EVENT_LOG:
708 if (packet_type == RESPONSE_PACKET) {
709 byte_cnt = (guint32)tvb_get_guint8(tvb, payload_start);
710 proto_tree_add_uint(modbus_tree, hf_modbus_bytecnt, tvb, payload_start, 1, byte_cnt);
711 proto_tree_add_item(modbus_tree, hf_modbus_status, tvb, payload_start+1, 2, ENC_BIG_ENDIAN);
712 proto_tree_add_item(modbus_tree, hf_modbus_event_count, tvb, payload_start+3, 2, ENC_BIG_ENDIAN);
713 proto_tree_add_item(modbus_tree, hf_modbus_message_count, tvb, payload_start+5, 2, ENC_BIG_ENDIAN);
714 if (byte_cnt-6 > 0) {
717 me = proto_tree_add_text(modbus_tree, tvb, payload_start+7, byte_cnt, "Events");
718 event_tree = proto_item_add_subtree(me, ett_events);
719 while (byte_cnt > 0) {
720 event_code = tvb_get_guint8(tvb, payload_start+7+event_index);
721 if (event_code == 0) {
722 proto_tree_add_text(event_tree, tvb, payload_start+7+event_index, 1, "Initiated Communication Restart");
724 else if (event_code == 4) {
725 proto_tree_add_text(event_tree, tvb, payload_start+7+event_index, 1, "Entered Listen Only Mode");
727 else if (event_code & REMOTE_DEVICE_RECV_EVENT_MASK) {
728 mei = proto_tree_add_text(event_tree, tvb, payload_start+7+event_index, 1, "Receive Event: 0x%02X", event_code);
729 event_item_tree = proto_item_add_subtree(mei, ett_events_recv);
731 /* add subtrees to describe each event bit */
732 proto_tree_add_item(event_item_tree, hf_modbus_event_recv_comm_err,
733 tvb, payload_start+7+event_index, 1, ENC_LITTLE_ENDIAN );
734 proto_tree_add_item(event_item_tree, hf_modbus_event_recv_char_over,
735 tvb, payload_start+7+event_index, 1, ENC_LITTLE_ENDIAN );
736 proto_tree_add_item(event_item_tree, hf_modbus_event_recv_lo_mode,
737 tvb, payload_start+7+event_index, 1, ENC_LITTLE_ENDIAN );
738 proto_tree_add_item(event_item_tree, hf_modbus_event_recv_broadcast,
739 tvb, payload_start+7+event_index, 1, ENC_LITTLE_ENDIAN );
741 else if ((event_code & REMOTE_DEVICE_SEND_EVENT_MASK) == REMOTE_DEVICE_SEND_EVENT_VALUE) {
742 mei = proto_tree_add_text(event_tree, tvb, payload_start+7+event_index, 1, "Send Event: 0x%02X", event_code);
743 event_item_tree = proto_item_add_subtree(mei, ett_events_send);
745 /* add subtrees to describe each event bit */
746 proto_tree_add_item(event_item_tree, hf_modbus_event_send_read_ex,
747 tvb, payload_start+7+event_index, 1, ENC_LITTLE_ENDIAN );
748 proto_tree_add_item(event_item_tree, hf_modbus_event_send_slave_abort_ex,
749 tvb, payload_start+7+event_index, 1, ENC_LITTLE_ENDIAN );
750 proto_tree_add_item(event_item_tree, hf_modbus_event_send_slave_busy_ex,
751 tvb, payload_start+7+event_index, 1, ENC_LITTLE_ENDIAN );
752 proto_tree_add_item(event_item_tree, hf_modbus_event_send_slave_nak_ex,
753 tvb, payload_start+7+event_index, 1, ENC_LITTLE_ENDIAN );
754 proto_tree_add_item(event_item_tree, hf_modbus_event_send_write_timeout,
755 tvb, payload_start+7+event_index, 1, ENC_LITTLE_ENDIAN );
756 proto_tree_add_item(event_item_tree, hf_modbus_event_send_lo_mode,
757 tvb, payload_start+7+event_index, 1, ENC_LITTLE_ENDIAN );
760 proto_tree_add_text(event_tree, tvb, payload_start+7+event_index, 1, "Unknown Event");
770 case WRITE_MULT_COILS:
771 if (packet_type == QUERY_PACKET) {
772 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
773 proto_tree_add_item(modbus_tree, hf_modbus_bitcnt, tvb, payload_start + 2, 2, ENC_BIG_ENDIAN);
774 byte_cnt = (guint32)tvb_get_guint8(tvb, payload_start + 4);
775 proto_tree_add_uint(modbus_tree, hf_modbus_bytecnt, tvb, payload_start + 4, 1,
777 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start + 5, byte_cnt);
779 else if (packet_type == RESPONSE_PACKET) {
780 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
781 proto_tree_add_item(modbus_tree, hf_modbus_bitcnt, tvb, payload_start + 2, 2, ENC_BIG_ENDIAN);
785 case WRITE_MULT_REGS:
786 if (packet_type == QUERY_PACKET) {
787 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
788 proto_tree_add_item(modbus_tree, hf_modbus_wordcnt, tvb, payload_start + 2, 2, ENC_BIG_ENDIAN);
789 byte_cnt = (guint32)tvb_get_guint8(tvb, payload_start + 4);
790 proto_tree_add_uint(modbus_tree, hf_modbus_bytecnt, tvb, payload_start + 4, 1,
792 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start + 5, byte_cnt);
794 else if (packet_type == RESPONSE_PACKET) {
795 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
796 proto_tree_add_item(modbus_tree, hf_modbus_wordcnt, tvb, payload_start + 2, 2, ENC_BIG_ENDIAN);
800 case READ_FILE_RECORD:
801 if (packet_type == QUERY_PACKET) {
802 byte_cnt = (guint32)tvb_get_guint8(tvb, payload_start);
803 proto_tree_add_uint(modbus_tree, hf_modbus_bytecnt, tvb, payload_start, 1,
806 /* add subtrees to describe each group of packet */
807 group_offset = payload_start + 1;
808 for (i = 0; i < byte_cnt / 7; i++) {
809 mi = proto_tree_add_text( modbus_tree, tvb, group_offset, 7,
811 group_tree = proto_item_add_subtree(mi, ett_group_hdr);
812 proto_tree_add_item(group_tree, hf_modbus_reftype, tvb, group_offset, 1, ENC_BIG_ENDIAN);
813 proto_tree_add_item(group_tree, hf_modbus_lreference, tvb, group_offset + 1, 4, ENC_BIG_ENDIAN);
814 proto_tree_add_item(group_tree, hf_modbus_wordcnt, tvb, group_offset + 5, 2, ENC_BIG_ENDIAN);
818 else if (packet_type == RESPONSE_PACKET) {
819 byte_cnt = (guint32)tvb_get_guint8(tvb, payload_start);
820 proto_tree_add_uint(modbus_tree, hf_modbus_bytecnt, tvb, payload_start, 1,
823 /* add subtrees to describe each group of packet */
824 group_offset = payload_start + 1;
826 while (byte_cnt > 0) {
827 group_byte_cnt = (guint32)tvb_get_guint8(tvb, group_offset);
828 mi = proto_tree_add_text( modbus_tree, tvb, group_offset, group_byte_cnt + 1,
830 group_tree = proto_item_add_subtree(mi, ett_group_hdr);
831 proto_tree_add_uint(group_tree, hf_modbus_bytecnt, tvb, group_offset, 1,
833 proto_tree_add_item(group_tree, hf_modbus_reftype, tvb, group_offset + 1, 1, ENC_BIG_ENDIAN);
834 dissect_mbtcp_data(tvb, pinfo, group_tree, function_code, group_offset + 2, group_byte_cnt - 1);
835 group_offset += (group_byte_cnt + 1);
836 byte_cnt -= (group_byte_cnt + 1);
842 case WRITE_FILE_RECORD:
843 if ((packet_type == QUERY_PACKET) || (packet_type == RESPONSE_PACKET)) {
844 byte_cnt = (guint32)tvb_get_guint8(tvb, payload_start);
845 proto_tree_add_uint(modbus_tree, hf_modbus_bytecnt, tvb, payload_start, 1,
848 /* add subtrees to describe each group of packet */
849 group_offset = payload_start + 1;
851 while (byte_cnt > 0) {
852 group_word_cnt = tvb_get_ntohs(tvb, group_offset + 5);
853 group_byte_cnt = (2 * group_word_cnt) + 7;
854 mi = proto_tree_add_text( modbus_tree, tvb, group_offset,
855 group_byte_cnt, "Group %u", i);
856 group_tree = proto_item_add_subtree(mi, ett_group_hdr);
857 proto_tree_add_item(group_tree, hf_modbus_reftype, tvb, group_offset, 1, ENC_BIG_ENDIAN);
858 proto_tree_add_item(group_tree, hf_modbus_lreference, tvb, group_offset + 1, 4, ENC_BIG_ENDIAN);
859 proto_tree_add_uint(group_tree, hf_modbus_wordcnt, tvb, group_offset + 5, 2,
861 dissect_mbtcp_data(tvb, pinfo, group_tree, function_code, group_offset + 7, group_byte_cnt - 7);
862 group_offset += group_byte_cnt;
863 byte_cnt -= group_byte_cnt;
870 if ((packet_type == QUERY_PACKET) || (packet_type == RESPONSE_PACKET)) {
871 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
872 proto_tree_add_item(modbus_tree, hf_modbus_andmask, tvb, payload_start + 2, 2, ENC_BIG_ENDIAN);
873 proto_tree_add_item(modbus_tree, hf_modbus_ormask, tvb, payload_start + 4, 2, ENC_BIG_ENDIAN);
878 if (packet_type == QUERY_PACKET) {
879 proto_tree_add_item(modbus_tree, hf_modbus_readref, tvb, payload_start, 2, ENC_BIG_ENDIAN);
880 proto_tree_add_item(modbus_tree, hf_modbus_readwordcnt, tvb, payload_start + 2, 2, ENC_BIG_ENDIAN);
881 proto_tree_add_item(modbus_tree, hf_modbus_writeref, tvb, payload_start + 4, 2, ENC_BIG_ENDIAN);
882 proto_tree_add_item(modbus_tree, hf_modbus_writewordcnt, tvb, payload_start + 6, 2, ENC_BIG_ENDIAN);
883 byte_cnt = (guint32)tvb_get_guint8(tvb, payload_start + 8);
884 proto_tree_add_uint(modbus_tree, hf_modbus_bytecnt, tvb, payload_start + 8, 1,
886 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start + 9, byte_cnt);
888 else if (packet_type == RESPONSE_PACKET) {
889 byte_cnt = (guint32)tvb_get_guint8(tvb, payload_start);
890 proto_tree_add_uint(modbus_tree, hf_modbus_bytecnt, tvb, payload_start, 1,
892 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start + 1, byte_cnt);
896 case READ_FIFO_QUEUE:
897 if (packet_type == QUERY_PACKET)
898 proto_tree_add_item(modbus_tree, hf_modbus_reference, tvb, payload_start, 2, ENC_BIG_ENDIAN);
899 else if (packet_type == RESPONSE_PACKET) {
900 byte_cnt = (guint32)tvb_get_ntohs(tvb, payload_start);
901 proto_tree_add_uint(modbus_tree, hf_modbus_lbytecnt, tvb, payload_start, 2,
903 proto_tree_add_item(modbus_tree, hf_modbus_wordcnt, tvb, payload_start + 2, 2, ENC_BIG_ENDIAN);
904 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start + 4, byte_cnt - 2);
908 case ENCAP_INTERFACE_TRANSP:
909 if (packet_type == QUERY_PACKET) {
910 proto_tree_add_item(modbus_tree, hf_modbus_mei, tvb, payload_start, 1, ENC_BIG_ENDIAN);
911 mei_code = tvb_get_guint8(tvb, payload_start);
915 proto_tree_add_item(modbus_tree, hf_modbus_read_device_id, tvb, payload_start+1, 1, ENC_BIG_ENDIAN);
916 proto_tree_add_item(modbus_tree, hf_modbus_object_id, tvb, payload_start+2, 1, ENC_BIG_ENDIAN);
919 case CANOPEN_REQ_RESP:
920 /* CANopen protocol not part of the Modbus/TCP specification */
923 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start, payload_len-1);
927 else if (packet_type == RESPONSE_PACKET) {
928 proto_tree_add_item(modbus_tree, hf_modbus_mei, tvb, payload_start, 1, ENC_BIG_ENDIAN);
929 mei_code = tvb_get_guint8(tvb, payload_start);
933 proto_tree_add_item(modbus_tree, hf_modbus_read_device_id, tvb, payload_start+1, 1, ENC_BIG_ENDIAN);
934 proto_tree_add_item(modbus_tree, hf_modbus_conformity_level, tvb, payload_start+2, 1, ENC_BIG_ENDIAN);
935 proto_tree_add_item(modbus_tree, hf_modbus_more_follows, tvb, payload_start+3, 1, ENC_BIG_ENDIAN);
936 proto_tree_add_item(modbus_tree, hf_modbus_next_object_id, tvb, payload_start+4, 1, ENC_BIG_ENDIAN);
937 num_objects = tvb_get_guint8(tvb, payload_start+5);
938 proto_tree_add_uint(modbus_tree, hf_modbus_num_objects, tvb, payload_start+5, 1, num_objects);
939 doe = proto_tree_add_text(modbus_tree, tvb, payload_start+6, payload_len-6, "Objects");
942 for (i = 1; i <= num_objects; i++)
944 device_objects_tree = proto_item_add_subtree(doe, ett_device_id_objects);
946 /* add each "object item" as its own subtree */
948 /* compute length of object */
949 object_type = tvb_get_guint8(tvb, payload_start+6+object_index);
950 object_len = tvb_get_guint8(tvb, payload_start+6+object_index+1);
952 doie = proto_tree_add_text(device_objects_tree, tvb, payload_start+6+object_index, 2+object_len, "Object #%d", i);
953 device_objects_item_tree = proto_item_add_subtree(doie, ett_device_id_object_items);
955 proto_tree_add_item(device_objects_item_tree, hf_modbus_object_id, tvb, payload_start+6+object_index, 1, ENC_BIG_ENDIAN);
958 proto_tree_add_uint(device_objects_item_tree, hf_modbus_list_object_len, tvb, payload_start+6+object_index, 1, object_len);
963 object_str = tvb_get_string(tvb, payload_start+6+object_index, object_len);
964 proto_tree_add_string(device_objects_item_tree, hf_modbus_object_str_value, tvb, payload_start+6+object_index, object_len, object_str);
970 proto_tree_add_text(device_objects_item_tree, tvb, payload_start+6+object_index, object_len, "Object Value");
972 object_index += object_len;
976 case CANOPEN_REQ_RESP:
977 /* CANopen protocol not part of the Modbus/TCP specification */
980 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start, payload_len-1);
986 case REPORT_SLAVE_ID:
989 dissect_mbtcp_data(tvb, pinfo, modbus_tree, function_code, payload_start, payload_len);
994 return tvb_length(tvb);
998 /* Register the protocol with Wireshark */
1001 proto_register_modbus(void)
1004 /* Setup list of header fields See Section 1.6.1 for details*/
1005 static hf_register_info hf[] = {
1006 /* Modbus/TCP header fields */
1007 { &hf_mbtcp_transid,
1008 { "transaction identifier", "mbtcp.trans_id",
1009 FT_UINT16, BASE_DEC, NULL, 0x0,
1013 { "protocol identifier", "mbtcp.prot_id",
1014 FT_UINT16, BASE_DEC, NULL, 0x0,
1018 { "length", "mbtcp.len",
1019 FT_UINT16, BASE_DEC, NULL, 0x0,
1022 /* Modbus header fields */
1024 { "unit identifier", "mbtcp.modbus.unit_id",
1025 FT_UINT8, BASE_DEC, NULL, 0x0,
1028 { &hf_mbtcp_functioncode,
1029 { "function code", "mbtcp.modbus.func_code",
1030 FT_UINT8, BASE_DEC, VALS(function_code_vals), 0x0,
1033 { &hf_modbus_reference,
1034 { "reference number", "mbtcp.modbus.reference_num",
1035 FT_UINT16, BASE_DEC, NULL, 0x0,
1038 { &hf_modbus_lreference,
1039 { "reference number (32 bit)", "mbtcp.modbus.reference_num_32",
1040 FT_UINT32, BASE_DEC, NULL, 0x0,
1043 { &hf_modbus_reftype,
1044 { "reference type", "mbtcp.modbus.reference_type",
1045 FT_UINT8, BASE_DEC, NULL, 0x0,
1048 { &hf_modbus_readref,
1049 { "read reference number", "mbtcp.modbus.read_reference_num",
1050 FT_UINT16, BASE_DEC, NULL, 0x0,
1053 { &hf_modbus_writeref,
1054 { "write reference number", "mbtcp.modbus.write_reference_num",
1055 FT_UINT16, BASE_DEC, NULL, 0x0,
1058 { &hf_modbus_wordcnt,
1059 { "word count", "mbtcp.modbus.word_cnt",
1060 FT_UINT16, BASE_DEC, NULL, 0x0,
1063 { &hf_modbus_readwordcnt,
1064 { "read word count", "mbtcp.modbus.read_word_cnt",
1065 FT_UINT16, BASE_DEC, NULL, 0x0,
1068 { &hf_modbus_writewordcnt,
1069 { "write word count", "mbtcp.modbus.write_word_cnt",
1070 FT_UINT16, BASE_DEC, NULL, 0x0,
1073 { &hf_modbus_bitcnt,
1074 { "bit count", "mbtcp.modbus.bit_cnt",
1075 FT_UINT16, BASE_DEC, NULL, 0x0,
1078 { &hf_modbus_bytecnt,
1079 { "byte count", "mbtcp.modbus.byte_cnt",
1080 FT_UINT8, BASE_DEC, NULL, 0x0,
1083 { &hf_modbus_lbytecnt,
1084 { "byte count (16-bit)", "mbtcp.modbus.byte_cnt_16",
1085 FT_UINT8, BASE_DEC, NULL, 0x0,
1088 { &hf_modbus_exceptioncode,
1089 { "exception code", "mbtcp.modbus.exception_code",
1090 FT_UINT8, BASE_DEC, VALS(exception_code_vals), 0x0,
1093 { &hf_modbus_diag_sf,
1094 { "diagnostic code", "mbtcp.modbus.diagnostic_code",
1095 FT_UINT16, BASE_DEC, VALS(diagnostic_code_vals), 0x0,
1098 { &hf_modbus_status,
1099 { "status", "mbtcp.modbus.ev_status",
1100 FT_UINT16, BASE_HEX, NULL, 0x0,
1103 { &hf_modbus_event_count,
1104 { "event count", "mbtcp.modbus.ev_count",
1105 FT_UINT16, BASE_DEC, NULL, 0x0,
1108 { &hf_modbus_message_count,
1109 { "message count", "mbtcp.modbus.ev_msg_count",
1110 FT_UINT16, BASE_DEC, NULL, 0x0,
1113 { &hf_modbus_event_recv_comm_err,
1114 { "Communication Error", "mbtcp.modbus.ev_recv_comm_err",
1115 FT_UINT8, BASE_DEC, NULL, 0x02,
1118 { &hf_modbus_event_recv_char_over,
1119 { "Character Overrun", "mbtcp.modbus.ev_recv_char_over",
1120 FT_UINT8, BASE_DEC, NULL, 0x10,
1123 { &hf_modbus_event_recv_lo_mode,
1124 { "Currently in Listen Only Mode", "mbtcp.modbus.ev_recv_lo_mode",
1125 FT_UINT8, BASE_DEC, NULL, 0x20,
1128 { &hf_modbus_event_recv_broadcast,
1129 { "Broadcast Received", "mbtcp.modbus.ev_recv_broadcast",
1130 FT_UINT8, BASE_DEC, NULL, 0x40,
1133 { &hf_modbus_event_send_read_ex,
1134 { "Read Exception Sent", "mbtcp.modbus.ev_send_read_ex",
1135 FT_UINT8, BASE_DEC, NULL, 0x01,
1138 { &hf_modbus_event_send_slave_abort_ex,
1139 { "Slave Abort Exception Sent", "mbtcp.modbus.ev_send_slave_abort_ex",
1140 FT_UINT8, BASE_DEC, NULL, 0x02,
1143 { &hf_modbus_event_send_slave_busy_ex,
1144 { "Slave Busy Exception Sent", "mbtcp.modbus.ev_send_slave_busy_ex",
1145 FT_UINT8, BASE_DEC, NULL, 0x04,
1148 { &hf_modbus_event_send_slave_nak_ex,
1149 { "Slave Program NAK Exception Sent", "mbtcp.modbus.ev_send_slave_nak_ex",
1150 FT_UINT8, BASE_DEC, NULL, 0x08,
1153 { &hf_modbus_event_send_write_timeout,
1154 { "Write Timeout Error Occurred", "mbtcp.modbus.ev_send_write_timeout",
1155 FT_UINT8, BASE_DEC, NULL, 0x10,
1158 { &hf_modbus_event_send_lo_mode,
1159 { "Currently in Listen Only Mode", "mbtcp.modbus.ev_send_lo_mode",
1160 FT_UINT8, BASE_DEC, NULL, 0x20,
1163 { &hf_modbus_andmask,
1164 { "AND mask", "mbtcp.modbus.and_mask",
1165 FT_UINT16, BASE_HEX, NULL, 0x0,
1168 { &hf_modbus_ormask,
1169 { "OR mask", "mbtcp.modbus.or_mask",
1170 FT_UINT16, BASE_HEX, NULL, 0x0,
1174 { "Data", "mbtcp.modbus.data",
1175 FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }
1178 { "MEI type", "mbtcp.modbus.mei",
1179 FT_UINT8, BASE_DEC, VALS(encap_interface_code_vals), 0x0,
1182 { &hf_modbus_read_device_id,
1183 { "Read Device ID", "mbtcp.modbus.read_device_id",
1184 FT_UINT8, BASE_DEC, VALS(read_device_id_vals), 0x0,
1187 { &hf_modbus_object_id,
1188 { "Object ID", "mbtcp.modbus.object_id",
1189 FT_UINT8, BASE_DEC, VALS(object_id_vals), 0x0,
1192 { &hf_modbus_num_objects,
1193 { "Number of Objects", "mbtcp.modbus.num_objects",
1194 FT_UINT8, BASE_DEC, NULL, 0x0,
1197 { &hf_modbus_list_object_len,
1198 { "Object length", "mbtcp.modbus.objects_len",
1199 FT_UINT8, BASE_DEC, NULL, 0x0,
1202 { &hf_modbus_conformity_level,
1203 { "Conformity Level", "mbtcp.modbus.conformity_level",
1204 FT_UINT8, BASE_HEX, VALS(conformity_level_vals), 0x0,
1207 { &hf_modbus_more_follows,
1208 { "More Follows", "mbtcp.modbus.more_follows",
1209 FT_UINT8, BASE_HEX, NULL, 0x0,
1212 { &hf_modbus_next_object_id,
1213 { "Next Object ID", "mbtcp.modbus.next_object_id",
1214 FT_UINT8, BASE_DEC, NULL, 0x0,
1217 { &hf_modbus_object_str_value,
1218 { "Object String Value", "mbtcp.modbus.object_str_value",
1219 FT_STRING, BASE_NONE, NULL, 0x0,
1224 /* Setup protocol subtree array */
1225 static gint *ett[] = {
1232 &ett_device_id_objects,
1233 &ett_device_id_object_items
1236 /* Register the protocol name and description */
1237 proto_mbtcp = proto_register_protocol("Modbus/TCP", "Modbus/TCP", "mbtcp");
1238 proto_modbus = proto_register_protocol("Modbus", "Modbus", "modbus");
1240 /* Registering protocol to be called by another dissector */
1241 new_register_dissector("mbtcp", dissect_mbtcp, proto_mbtcp);
1242 new_register_dissector("modbus", dissect_modbus, proto_modbus);
1244 /* Registering subdissectors table */
1245 mbtcp_dissector_table = register_dissector_table("mbtcp.modbus.data", "Modbus/TCP Data", FT_STRING, BASE_NONE);
1246 modbus_dissector_table = register_dissector_table("mbtcp.prot_id", "protocol identifier", FT_UINT16, BASE_DEC);
1248 /* Required function calls to register the header fields and subtrees used */
1249 proto_register_field_array(proto_mbtcp, hf, array_length(hf));
1250 proto_register_subtree_array(ett, array_length(ett));
1254 /* If this dissector uses sub-dissector registration add a registration routine.
1255 This format is required because a script is used to find these routines and
1256 create the code that calls these routines.
1259 proto_reg_handoff_mbtcp(void)
1261 dissector_handle_t mbtcp_handle, mbudp_handle;
1263 mbtcp_handle = new_create_dissector_handle(dissect_mbtcp, proto_mbtcp);
1264 dissector_add_uint("tcp.port", PORT_MBTCP, mbtcp_handle);
1266 mbudp_handle = new_create_dissector_handle(dissect_mbudp, proto_mbtcp);
1267 dissector_add_uint("udp.port", PORT_MBTCP, mbudp_handle);
1269 modbus_handle = new_create_dissector_handle(dissect_modbus, proto_modbus);
1270 dissector_add_uint("mbtcp.prot_id", MODBUS_PROTOCOL_ID, modbus_handle);