PLCBytes
Modbus tools

Modbus Frame Decoder

Paste the hex bytes of a Modbus RTU, TCP or ASCII frame. The decoder splits them into fields, checks the CRC, pairs requests with responses and explains exception codes.

Frames

Example

RTU with CRC, TCP with MBAP header, or ASCII starting with a colon. Put several frames on separate lines. Wireshark hex streams, Wireshark hex dumps and Modbus Poll logs work as they are.

Examples

Decoded frames

Runs entirely in your browser. Nothing you enter is sent to a server.

How Modbus frames are built

Modbus RTU

PartBytes
Device address (unit ID)1
Function code1
Data0–252
CRC, low byte first2

Modbus TCP

PartBytes
Transaction ID2
Protocol ID, always 02
Length: unit ID + PDU2
Device address (unit ID)1
Function code1
Data0–252

Modbus ASCII

PartBytes
:1
Device address (unit ID)2
Function code2
Data0–504
LRC2
CR LF2

The part from the function code to the end of the data is called the PDU and is the same in all three variants. Register values are sent high byte first; only the RTU CRC goes low byte first.

How the decoder reads a frame

First it looks for the envelope. An RTU frame ends with a CRC that matches the bytes before it. A TCP frame starts with a 7-byte MBAP header whose length field matches the rest. An ASCII frame starts with a colon. Inside the envelope, the function code says how the rest is built. A request and a response of the same function have a different structure, so the decoder can tell them apart, and it pairs each response with the request before it.

A response to a read carries only the values, not the start address. Paste the request together with the response and the decoder shows the real register numbers. One click opens the values in the register decoder, which finds floats, 32-bit values and the byte order.

Common mistakes

Questions from practice

What is in the Modbus TCP MBAP header?

Seven bytes: transaction ID (2), protocol ID (2, always 0), length (2) and unit ID (1). The length counts the bytes after it, so the unit ID plus the PDU. 00 01 00 00 00 06 11 means transaction 1, Modbus protocol, 6 bytes follow, unit 17.

How do I copy a Modbus frame from Wireshark?

Right-click the Modbus/TCP line in the packet details and copy it as a hex stream, or copy the bytes of the whole packet. Both work: the decoder recognises the Ethernet, IPv4 and TCP headers and skips them. A hex dump with offsets and an ASCII column works too.

Why does a decoded response show no register numbers?

A read response contains a byte count and the values, nothing else. Which registers they came from is only in the request. Paste the request on the line above the response and the decoder pairs them, numbers the registers and passes the start address on to the register decoder.

What is the difference between Modbus TCP and RTU over TCP?

Modbus TCP puts the 7-byte MBAP header in front of the PDU and has no CRC. RTU over TCP sends the unchanged serial frame, device address and CRC included, through a TCP connection. A client set to the wrong variant gets no answer. The decoder handles both: a frame with a valid CRC is shown as RTU, however it was transported.

What does exception code 0B mean?

Gateway Target Device Failed to Respond: the Modbus TCP gateway received the request and sent it to the serial line, but the device behind it did not answer in time. Check that the unit ID matches the serial device address, then the gateway's baud rate and parity and the RS-485 wiring. Code 0A means the gateway did not even know where to send the request.

Related tools