Modbus TCP

What changes and what does not

The part of the message that carries meaning, the function code, the register address, the quantity, and the data, is unchanged. What changes is the envelope around it.

The MBAP header

Seven bytes precede every Modbus TCP request and response.

Transaction identifier (2 bytes)

Echoed by the server so a client can match a response to its request. This is what allows several outstanding transactions at once.

Protocol identifier (2 bytes)

Zero for Modbus.

Length (2 bytes)

Byte count of what follows. This replaces the silent-interval framing of RTU.

Unit identifier (1 byte)

Identifies the target when a gateway sits in front of serial devices. For a native Ethernet device it is frequently 255 or 1, and some devices ignore it entirely.

What Ethernet actually buys you

• Speed. Reading several hundred registers is effectively instantaneous rather than a measurable delay.
• Concurrency. A PLC and a SCADA system can poll the same device at the same time without a gateway arbitrating.
• Distance and infrastructure. It uses the network you already have, including fiber between buildings.
• Better diagnostics. Switch port counters, packet captures, and connection state are all available, none of which exist on a serial bus.

What it does not fix

1. 01Register addressing ambiguity. The 40001 versus offset-0 problem is identical.
2. 02Word and byte order for 32-bit values. Identical, and just as undocumented.
3. 03Device slowness. A device with a slow internal scan is slow regardless of transport.
4. 04Security. Modbus TCP has no authentication or encryption, and now it is reachable from anything routable to it, which is strictly worse.

Diagnosing it

1. 1

   Prove IP connectivity

   Ping the device. If it does not answer, this is a network problem, not a Modbus problem, and everything below is wasted effort until it is fixed.

2. 2

   Prove the port is open

   Attempt a TCP connection to port 502. A refused connection means the service is not running or is on a different port. A timeout usually means a firewall or a routing problem.

3. 3

   Read with an independent tool

   Use a Modbus client utility from a laptop. If it reads correctly and the PLC does not, the problem is in the controller configuration, not the device.

4. 4

   Check the unit identifier

   Particularly with a gateway. Try the serial slave address, then 1, then 255.

5. 5

   Capture packets if it is still unclear

   A capture on port 502 shows the exact request, the exact response, and any exception code. This turns speculation into fact faster than any other step.

6. 6

   Watch connection count

   Some devices support only a small number of simultaneous TCP connections. A client that opens a new connection per poll and never closes cleanly will exhaust them, and the symptom is a device that works for hours and then refuses everything.