Industrial pcap Analyzer

Drop a Wireshark or pktmon .pcap/.pcapng to see Modbus TCP and MC (3E/4E) request/response pairs, response times, missing replies and exception codes.

Drop a capture file here, or click to choose one.pcap · .pcapng · .cap — up to 200 MB

Download the sample (.pcapng, 10 KB)A synthetic file made for this page — with a Modbus TCP exception, a missing reply and MC end code C059. See what the results look like before you have a capture.

The file is processed only inside this browser and is not uploaded anywhere. IP addresses are shown on screen only and go into the CSV only if you choose.

Modbus TCP portscomma separated, ranges like 1502-1505MC protocol portse.g. 5000-5010 (empty = detect by shape only)No-response limit (ms)

Also detect other ports by their first bytes (MBAP header, MC subheader) Drop duplicated packets (files like pktmon's that hold the same packet several times)

FAQ

Which files can it read?

.pcap (microsecond or nanosecond, either byte order) and .pcapng (several interfaces, EPB and SPB) saved by Wireshark, tcpdump, dumpcap or pktmon (after etl2pcap). Link types: Ethernet (with VLAN tags), Linux cooked (SLL, SLL2 from tcpdump -i any), raw IP and loopback. It decodes TCP and UDP (MC only) over IPv4 and only counts IPv6. Unpack .gz files first.

What happens to traffic that is not Modbus or MC?

It is neither decoded nor shown. The result only says «N packets that are not industrial traffic». Even if the capture contains web, DNS or file sharing traffic, none of its content appears on screen or in the CSV.

How is response time measured?

From the time the last byte of the request frame was captured to the time the last byte of the response frame was captured. It is the capturing PC's view: from a mirror port or hub it is close to the time between the devices; captured on the client PC it is that PC's side. Median and 95th percentile use the nearest-rank method.

How are requests and responses paired?

Modbus TCP by transaction ID, MC 4E by serial number. MC 3E carries no number, so within a connection the oldest open request is paired first. A request older than the no-response limit counts as no response, and a reply arriving after that counts as an «unmatched response».

Does «no response» mean the device did not answer?

Not necessarily. A busy mirror port can lose packets (Wireshark wiki), and packets before or after the capture are missing. Requests the capture ended on too early to tell are counted separately as «capture ended». Check the «missing bytes» and «retransmissions» counts above the results as well.

My pktmon file has every packet several times

pktmon captures a packet at several points in the network stack and etl2pcap writes them all without telling them apart (Microsoft docs). With «Drop duplicated packets» on, packets with the same IP ID, length and sequence number seen again within 50 ms count once. Giving etl2pcap --component-id for one point gives a clean file from the start.

Guides

Tools that go with it

Modbus Frame Decoder — decode one frame field by field
MC Protocol (SLMP) Frame Decoder — decode MC frames field by field, build requests
PortDock TCP — watch HMI–PLC traffic without Wireshark — relay (monitor) mode
PortDock Modbus Slave — create slow replies and missing replies on purpose, without a device
PortDock PLC Simulator — test MC protocol without a PLC

References

Wireshark Wiki — CaptureSetup/Ethernet — switches, mirror ports and taps; packet loss on mirror ports
Microsoft — pktmon etl2pcap — pcapng conversion, the same packet from several components, --component-id
tcpdump — pcap-savefile(5) — pcap format (microsecond and nanosecond magic)
IETF — PCAP Next Generation (pcapng) Capture File Format — SHB, IDB, EPB, SPB, if_tsresol
Modbus Messaging on TCP/IP Implementation Guide V1.0b — MBAP header, transaction ID
SLMP Reference Manual SH(NA)-080956ENG — 3E/4E header, 4E serial number, end code

Wireshark is a trademark of the Wireshark Foundation; PortDock is not affiliated with Wireshark, Microsoft or Mitsubishi Electric. This tool helps with monitoring, testing and troubleshooting device communication; it has no feature for intercepting other people's traffic.