When device communication drops or slows down now and then, saving the packets to a file (.pcapng) lets you look at response times, missing replies and exception codes calmly afterwards. This guide is about recording your own equipment's traffic for monitoring, testing and troubleshooting. On a company network, get permission from whoever runs it first.
1. Where can you capture — the switch limit
Ethernet today is almost always switched. A switch forwards unicast frames only to the port where that address lives, so a laptop on the same switch running Wireshark will not see traffic between the HMI and the PLC (Wireshark wiki). It sees only its own traffic and broadcasts.
| Capture where | What you see | What you need |
|---|---|---|
| The communicating PC itself (your program ⇄ device) | That PC's traffic | Wireshark or pktmon on that PC, admin rights |
| A managed switch mirror port (SPAN) | A copy of the chosen ports' traffic | Access to the switch settings, a mirror port at least as fast as the monitored port |
| A network tap | Both directions of that cable | A tap, and a short break in the cable to insert it |
| An old (repeater) hub | Everything on the hub | A hub — full-duplex links drop to half duplex, which affects performance |
| PortDock TCP «Relay» | TCP connections you route through this PC | Point the HMI at this PC; no admin rights or driver |
A mirror port slower than the monitored port loses packets, and heavy traffic can cause capture loss too (Wireshark wiki). So a request that looks unanswered in a capture may in fact have been answered.
2. Capturing with Wireshark
- Installing Wireshark also installs its capture driver (Npcap). Installing a driver needs admin rights, and company PCs may block it by policy.
- Choose the network adapter facing the PLC and set a capture filter (before starting) such as «tcp port 502» (Modbus) or «tcp port 5000» (the MC port set in the PLC) to keep the file small.
- For traffic inside one PC (127.0.0.1), such as testing against a simulator, choose Npcap's loopback adapter (Adapter for loopback traffic capture).
- After stopping, use «File → Save As» and pick pcapng. For a big file, «File → Export Specified Packets» with a display filter (modbus, tcp.port == 5000) keeps only what you need.
3. Without installing anything — the built-in pktmon
pktmon is built into Windows from Windows 10 2004 (build 19041). Run it from an elevated prompt (PowerShell «Run as administrator»); without admin rights it stops with an «Access is denied» error about the PktMon driver.
pktmon filter add -p 502 pktmon start --capture --comp nics --pkt-size 0 (wait until the problem happens) pktmon stop pktmon etl2pcap PktMon.etl --out plc.pcapng pktmon filter remove
- filter add -p 502 keeps only packets with port 502 as source or destination. For MC use the port configured in the PLC.
- --pkt-size 0 logs whole packets. The default is the first 128 bytes, which cuts long Modbus or MC frames.
- --comp nics captures at the network adapters only. Without it pktmon captures the same packet at several points in the stack, and etl2pcap writes them all without telling them apart (Microsoft docs). Clean such a file with etl2pcap --component-id for one point, or with «Drop duplicated packets» in the PortDock pcap analyzer.
- The default log mode is circular (once 512 MB is full, the oldest data is overwritten). Narrow the filter for long captures.
4. Setting up switch mirroring
- Choose the port to monitor (the PLC's port alone shows everything to and from the PLC) and the port that receives the copy (the capture PC). The menu is called Port Mirroring, SPAN or Monitor depending on the vendor.
- A capture PC on a mirror port usually cannot use that port for normal traffic. Keep a separate cable for remote access.
- Many industrial switches are unmanaged and cannot mirror. Use a tap or the PortDock TCP relay then.
5. PortDock TCP relay — no mirror port or driver
If the HMI (or a PC program) connects to the PLC's address, change only the HMI's target to «this PC's IP:port» and run PortDock TCP in «Relay» mode: the PC passes the bytes through unchanged and logs both directions. No driver or mirror port is needed, and installing and running it needs no admin rights. For another PC or the HMI to connect to this PC, though, the Windows Firewall prompt that appears the first time the relay listens may need administrator approval; and since you change a device setting, use it on a test setup or during maintenance. With «Save as pcap» on, the relay writes only to the file you choose and sends nothing out.
6. Looking at the file
Open it in Wireshark, or drop it on the PortDock web tool «Industrial pcap Analyzer» to get Modbus TCP and MC 3E/4E request/response pairs, response times (min, median, 95%, max), missing replies and exception/end codes per connection and device. The file is processed only in that browser and never uploaded. How to read the results is in «Reading Modbus response times from a capture».
A pcap file also holds other traffic on the same network (web, file sharing …) and IP and MAC addresses. Before sending one to someone, export only the ports they need.
Wireshark is a trademark of the Wireshark Foundation; PortDock is not affiliated with Wireshark or Microsoft.
Sources
- Wireshark Wiki — CaptureSetup/Ethernet — switches, mirror ports (SPAN), hubs, taps; mirror port speed and loss
- Microsoft — Packet Monitor (Pktmon) — built in from build 19041, captures at several points
- Microsoft — pktmon start — --capture, --comp nics, --pkt-size (128 bytes by default), log modes
- Microsoft — pktmon filter add — -p port and -i IP filters
- Microsoft — pktmon etl2pcap — pcapng conversion, --component-id
Published 2026-10-31