I’m analyzing a pcap file with Modbus traffic and noticed something unexpected. In the responses for Modbus functions 0x0B (Get Comm Event Log) and 0x0C (Get Comm Event Counter), there are 4 null bytes immediately following the function code, even though the Modbus specification indicates that there should be no additional data following the function code for these requests.
Here is an example of the raw data:
0B 00 00 00 00 …
0C 00 00 00 00 …
According to the Modbus specification, after the function code (0x0B or 0x0C), there should not be any data bytes in these particular responses.
Has anyone encountered this before? Could this be an implementation-specific detail, or am I missing something in the specification?
Any insights or suggestions would be greatly appreciated.
Thank you!
wireshark pic
Daniel Zaripov is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.