Modbus Frame Decoder
Paste a Modbus RTU or TCP frame in HEX to decode slave ID, function, values, CRC, MBAP header and exception codes. Registers shown as decimal, HEX and 40001.
FAQ
How does it tell RTU from TCP?
If the last two bytes match the CRC16 Modbus it reads RTU; if the protocol ID in the first 7 bytes is 0 and the length field equals the bytes that follow, it reads Modbus TCP. If neither fits it reads RTU with a bad CRC and shows the correct CRC. You can also pick the format yourself.
Why do I get both a request and a response?
A frame carries no direction, so the length and byte count decide. A function 01/02 response with byte count 3 has the same length as a request (8 bytes on RTU), and function 17 can fit both layouts too. Both readings are shown; use the frames around it to choose. A normal 05/06 response echoes the request.
What is the difference between address 0 and 40001?
The address in the frame is 0-based. 40001 is notation for «the 1st holding register (4xxxx)», sent as 00 00. Coils are 0xxxx, discrete inputs 1xxxx and input registers 3xxxx.
My coil response has extra zeros at the end
Bits are sent in whole bytes and unused bits in the last byte are padded with 0. Read only as many as you requested.
Exception codes
| Code | Name | Meaning |
|---|---|---|
| 01 | Illegal Function | The function code is not supported, or not allowed in the device's current state. |
| 02 | Illegal Data Address | The address, or the start address plus quantity, does not exist in the device. |
| 03 | Illegal Data Value | A value in the request is not allowed, including its structure such as quantity or byte count. |
| 04 | Server Device Failure | An unrecoverable error occurred while the device was performing the action. |
| 05 | Acknowledge | The request was accepted but takes a long time; poll later to see whether it finished. |
| 06 | Server Device Busy | The device is busy with a long-running command; retry later. |
| 07 | — | Not defined in Application Protocol V1.1b3. |
| 08 | Memory Parity Error | A memory parity error was found while reading or writing a file record (functions 0x14/0x15). |
| 09 | — | Not defined in Application Protocol V1.1b3. |
| 0A | Gateway Path Unavailable | The gateway could not set up a path to the target (misconfigured or overloaded). |
| 0B | Gateway Target Device Failed to Respond | The device behind the gateway did not respond. |
From chapter 7 of the Modbus Application Protocol Specification V1.1b3. Codes 07 and 09 are not defined in that edition.
References
- Modbus Application Protocol Specification V1.1b3 — function codes, request/response layouts, quantity limits, exception codes
- Modbus over Serial Line Specification and Implementation Guide V1.02 — RTU framing, addresses (0 broadcast, 1–247), CRC
- Modbus Messaging on TCP/IP Implementation Guide V1.0b — MBAP header (transaction, protocol, length, unit ID)
For a byte-by-byte walkthrough see Reading Modbus RTU frames; for addresses see Modbus address notation (0-based vs 40001).
To decode live traffic line by line while talking to a device, use PortDock Modbus Master.