This engineering brief examines the MODBUS TCP network traffic in an industrial automation network. The objective is to show the workbench setup required to capture the MODBUS frames using Wireshark. This is followed by a brief analysis of the PLC to bus coupler MODBUS traffic. The target Schneider bus coupler is shown in Figure 1.
Key Takeaways
- Port mirroring exposes PLC traffic between a Crouzet PLC and a Schneider bus coupler.
- Captured register values can be traced to physical outputs.
- TCP connection handling and recovery deserve investigation.
This article is part of the DigiKey Field Guide for Industrial Automation
Location: Understand It → Network Fundamentals
Difficulty: 
Technician — difficulty levels explained
Author: Aaron Dahlen | MSEE | Senior Applications Engineer, DigiKey
Last update: 20 Oct 2026
Figure 1: Image of the MODBUS-enabled Schneider TM3 bus coupler with digital output expansion card.
Featured Equipment
The equipment in this list shows the flexibility of MODBUS. It includes a MODBUS capable PLC and a bus coupler from different OEMs. It also includes a managed Ethernet switch.
- Crouzet MXD12SD1ET PLC
- Schneider TM3BCEIP bus coupler
- Schneider TM3DQ16T output module
- Siemens XB208 network switch
Tech Tip: The Siemens switch is not strictly considered a MODBUS product. It is more appropriately called a managed switch that happens to have PROFINET capabilities. For this lab, the XB208’s importance lies in its ability to perform port mirroring.
Initial Setup
We begin with a functional MODBUS system. We will focus on the IP addresses:
- Bus Coupler: 192.168.1.40
- PLC: 192.168.1.41
The associated configurations for the bus coupler and the PLC are shown in Figures 2 and 3. Notice that Figures 1, 2, and 3 are all showing the same bit sequence for the digital output. In hex, this is expressed as 0x0208 which is 520 in decimal.
Figure 2: Web interface to the Schneider TM3 showing the status of the digital output card.
Figure 3: Debug window of the Crouzet Millenium PLC showing the MODBUS interface.
Port Mirroring
The Siemens XB208 was chosen as it performs port mirroring. Recall that a switch is a Layer 2 (OSI aata link) device that economizes network traffic by sending packets to the addressed node. By default, this traffic is hidden from the other ports leaving Wireshark with little to analyze beyond the broadcast messages.
The solution is to select a managed switch with port mirroring capability as shown in Figure 4. In this case I have mirrored the TM3 (port 2) to the XB208’s port 8. My PC is then connected to port 8 so that Wireshark can analyze the data. Note that the actual port for the TM3 is set in the Figure 4 Port tab. For this experiment, XB208 is set for Ingress Mirroring and Egress Mirroring.
Figure 4: Status of the Layer 2 mirroring within the Siemens XB208 switch.
Traffic Analysis
Figure 5 shows the consecutive Wireshark captured packets for a single data exchange between the Crouzet PLC and the Schneider bus coupler. In this example we see 11 packets:
-
Establish a TCP connection
- 751 from PLC: Request (SYN)
- 752 from bus coupler: Accept (SYN, ACK)
- 753 from PLC: Acknowledge (ACK)
-
MODBUS Write
- 754 from PLC: Write Multiple Registers request (Query). Note that I have configured the Crouzet PLC to write to two registers starting at address 3501.
- 755 from bus coupler: MODBUS response confirming the write (Response)
-
PLC closure request
- 756 from PLC: Request (FIN, ACK)
- 757 from bus coupler: Acknowledge (ACK)
-
Bus coupler closure request
- 758 from bus coupler: Request (FIN, ACK)
- 759 from the switch: MRP test frame (MRP_Test)
- 760 from PLC: Acknowledge (ACK)
-
TCP Reset
- 761 from bus coupler: TCP reset (RST)
Closer inspection of packet 754 shows the payload used to set the digital output. In this case we see the command to write to multiple registers. Specifically, to write the decimal value of 520 (Hex 0x0208) to register 3501 which is located at the 192.168.1.40 address.
Modbus
0... .... = Exception: No
.001 0000 = Function Code: Write Multiple Registers (16)
Reference Number: 3501
Word Count: 2
Byte Count: 4
Register 3501 (UINT16): 520
[Register Number: 3501]
Register Value (UINT16): 520
Register 3502 (UINT16): 0
[Register Number: 3502]
Register Value (UINT16): 0
Register Value (UINT16): 0
Figure 5: Wireshark traffic between the Crouzet PLC and the Schneider bus coupler.
Next Step
The MODBUS standard is available here. We can use this document as a guide for advanced MODBUS experiments. For example, MODBUS Messaging on TCP/IP Implementation Guide V1.0b contains implementation rules in section 4.2. In this quote we see that it is recommended that the TCP connection remain open:
It is recommended to keep the TCP connection opened with a remote device and not to open and close it for each MODBUS/TCP transaction, Remark: However the MODBUS client must be capable of accepting a close request from the server and closing the connection. The connection can be reopened when required.
As an experiment, explore the MODBUS implementation on different PLCs with various settings. More importantly, see how the system responds to intermittent network failures. We can use Wireshark to analyze timings, errors, opening, and then closing of the TCP connection for each transaction; do so within the bounds of your application.
In my opinion, reliability and the ability to detect and then gracefully recover from network failures may be more important than minimizing network traffic. Finally, don’t stop! Explore the alternatives. For example, why select MODBUS RTU, MODBUS TCP, or even PROFINET?
About this Author
Aaron Dahlen, LCDR USCG (Ret.), is a Senior Applications Engineer at DigiKey in Thief River Falls. His background in electronics and industrial automation was shaped by a 27-year military career as both technician and engineer, followed by over a decade of teaching.
Dahlen holds an MSEE from Minnesota State University, Mankato. He has taught in an ABET-accredited electrical engineering program, served as coordinator of an electronic engineering technology program, and instructed military technicians in component-level repair.
Today, he has returned to his home in northern Minnesota, completing a decades-long journey that began with a search for capacitors. Read his story here.