I’m analyzing a pcap file with Modbus traffic and noticed something unexpected. In the responses for Modbus functions 0x0B (Get Comm Event Log) and 0x0C (Get Comm Event Counter), there are 4 null bytes immediately following the function code, even though the Modbus specification indicates that there should be no additional data following the function code for these requests.