I have a device with a proprietary Modbus client and server (2-wire over RS-485). I am trying to replace the client with my own. As such, I am trying to sniff traffic to determine the modbus register maps and so on.

I am using an FT232RL-based USB to RS-485/422 adapter. I have tested it in loopback mode (by feeding T/R+ and T/R- into RXD+/-, respectively, it works fine with Python and other software on my system.

I have attached the T/R+ and T/R- onto the bus between the two devices and I am able to sniff traffic. I see valid Modbus commmands from the client and valid responses from the server. So far so good. I can do the same with RXD+/- onto the 2-wire bus.

Now, I remove the client, attach only my USB/RS-485 adapter to the Modbus server device, and I can send well-formed commands, which the server receives correctly. I know this because I can write to registers that turn things on and off and can see the result physically.

However, when I read holding/input registers, I receive garbled data. To be clear, the same data came in as a well-formed Modbus response when I was sniffing responses to the same command.

For example, when I’m sniffing traffic, the client sends the command (in hex)

01 03 02 00 72 38 61 00

The server responds with

01 03 4C 00 7E 00 33 00 30 00 11 00 14 00 06 07 E8 00 02 00 00 01 20 00 00 00 01 00    23 00 00 00 80 00 00 00 02 14 A5 00 00 00 5E 03 FF 00 04 00 11 00 30 00 00 01 E4 00    00 00 00 00 00 07 C4 00 00 2C CA 00 02 13 13 00 0A 3F DD 00 0C 00 72 24 29 

Now, when I remove the client and send the commands using my USB/RS-485 adapter, I send:

01 03 02 00 72 38 61 00

And the response is:

00 7F 7E 14 00 FF FF C1 FF F9 F9 11 3D F5 57 FF F3 FF DF EF DB FF FF 03 F5 F5 FF FF  FF FF FF C1 FF FF FF 57 EF FF F5 FF C1 FF C1 FF C3 FF C1 FF C3 FF C1 BB 2D FF FF F5      FF FF 0F 36 9E DD ED FD 7F 09 6D 05 2B 0A BE FD 2F BF F1 AB FF D7 FD DF BE 55 84 41      BF E0 91 FB 9F FF 8F FF 3D FF FF BB 2D 7B BD FE FD FF 49 00

Anyone encounter something like this?