"# Wireshark\u6293\u5305\u5206\u6790Modbus TCP\/RTU\u62a5\u6587\u5b8c\u5168\u6307\u5357\n\n> 2026-06-26 | 2026-06-26\n> https:\/\/www.modbus.cn\/en\/43929.html\n\n**Modbus\u8c03\u8bd5\u5de5\u5177**\n\n---\n\n## \u4e3a\u4ec0\u4e48\u7528 Wireshark \u5206\u6790 Modbus\uff1f\n\nWireshark \u662f\u5168\u7403\u6700\u6d41\u884c\u7684\u5f00\u6e90\u7f51\u7edc\u534f\u8bae\u5206\u6790\u5668\uff0c\u7531 Gerald Combs \u4e8e 1998 \u5e74\u521b\u5efa\uff0c\u73b0\u7531 Wireshark \u57fa\u91d1\u4f1a\u7ef4\u62a4\u3002\u5b98\u7f51 [www.wireshark.org](https:\/\/www.wireshark.org\/)\u3002\u5b83\u5185\u7f6e\u4e86\u5b8c\u6574\u7684 Modbus TCP \u534f\u8bae\u89e3\u6790\u5668\uff08dissector\uff09\uff0c\u53ef\u4ee5\u81ea\u52a8\u8bc6\u522b\u548c\u89e3\u6790 Modbus TCP \u62a5\u6587\u4e2d\u7684 MBAP \u5934\u3001\u529f\u80fd\u7801\u3001\u6570\u636e\u533a\u548c\u5f02\u5e38\u7801\u3002\u5bf9\u4e8e Modbus RTU \u62a5\u6587\uff0cWireshark \u4e5f\u53ef\u4ee5\u901a\u8fc7 USB \u8f6c\u4e32\u53e3\u9002\u914d\u5668\u6216\u8fdc\u7a0b\u6293\u5305\u7684\u65b9\u5f0f\u8fdb\u884c\u5206\u6790\u3002\n\n\u5728\u5de5\u4e1a\u81ea\u52a8\u5316\u7684\u8c03\u8bd5\u73b0\u573a\uff0c\u6700\u5e38\u89c1\u7684\u75db\u70b9\u5c31\u662f\"\u901a\u4fe1\u4e0d\u901a\u4f46\u4e0d\u77e5\u9053\u4e3a\u4ec0\u4e48\"\u3002Wireshark \u80fd\u8ba9\u4f60\u770b\u5230\u603b\u7ebf\u4e0a\u7684\u6bcf\u4e00\u5e27\u6570\u636e\u2014\u2014\u8bf7\u6c42\u53d1\u4e86\u4ec0\u4e48\u3001\u54cd\u5e94\u56de\u4e86\u4ec0\u4e48\u3001\u8d85\u65f6\u53d1\u751f\u5728\u54ea\u4e2a\u73af\u8282\u3001\u5f02\u5e38\u7801\u662f\u4ec0\u4e48\u2014\u2014\u628a\u770b\u4e0d\u89c1\u7684\u901a\u4fe1\u8fc7\u7a0b\u53d8\u6210\u53ef\u8ffd\u8e2a\u7684\u8bc1\u636e\u94fe\u3002\n\n## Wireshark \u5bf9 Modbus \u534f\u8bae\u7684\u652f\u6301\n\nWireshark \u7684 Modbus \u534f\u8bae\u89e3\u6790\u5668\u4f4d\u4e8e `epan\/dissectors\/packet-modbus.c`\uff0c\u80fd\u591f\u81ea\u52a8\u8bc6\u522b\u4ee5\u4e0b\u5185\u5bb9\uff1a\n\n- **Modbus\/TCP**\uff1a\u9ed8\u8ba4\u7aef\u53e3 502\uff0c\u81ea\u52a8\u8bc6\u522b MBAP \u5934\uff08Transaction ID\u3001Protocol ID\u3001Length\u3001Unit ID\uff09\u548c\u5404\u529f\u80fd\u7801\u7684 PDU\n- **\u529f\u80fd\u7801\u89e3\u6790**\uff1aFC01-FC06\u3001FC15-FC16\u3001FC23 \u7b49\u5e38\u7528\u529f\u80fd\u7801\u7684\u8bf7\u6c42\u548c\u54cd\u5e94\u683c\u5f0f\n- **\u5f02\u5e38\u7801**\uff1a\u81ea\u52a8\u6807\u6ce8\u5f02\u5e38\u54cd\u5e94\uff0c\u5e76\u663e\u793a\u5f02\u5e38\u7801\u542b\u4e49\uff0801=\u975e\u6cd5\u529f\u80fd\u300102=\u975e\u6cd5\u6570\u636e\u5730\u5740\u300103=\u975e\u6cd5\u6570\u636e\u503c\u300104=\u4ece\u7ad9\u8bbe\u5907\u6545\u969c\u7b49\uff09\n- **Modbus RTU over TCP**\uff1a\u90e8\u5206\u7f51\u5173\u5c06 RTU \u5e27\u5c01\u88c5\u5728 TCP \u4e2d\u4f20\u8f93\uff0cWireshark \u4e5f\u80fd\u89e3\u6790\n\n## \u5b89\u88c5 Wireshark\n\n### Linux\uff08Ubuntu\/Debian\uff09\n\n```\nsudo apt-get update\nsudo apt-get install wireshark\n\n# \u5141\u8bb8\u975e root \u7528\u6237\u6293\u5305\nsudo usermod -a -G wireshark $USER\n# \u6ce8\u9500\u540e\u91cd\u65b0\u767b\u5f55\u751f\u6548\n```\n\n### Windows\n\n\u4ece [\u5b98\u7f51\u4e0b\u8f7d\u9875\u9762](https:\/\/www.wireshark.org\/download.html) \u4e0b\u8f7d Windows \u5b89\u88c5\u5305\u3002\u5b89\u88c5\u65f6\u9700\u52fe\u9009 **Npcap**\uff08Windows \u6293\u5305\u9a71\u52a8\uff09\u548c **USBPcap**\uff08\u5982\u9700\u6293 USB \u8f6c\u4e32\u53e3\u6570\u636e\uff09\u3002\n\n### macOS\n\n```\n`brew install --cask wireshark`\n```\n\n## \u6293\u53d6 Modbus TCP \u62a5\u6587\n\n### Linux \u670d\u52a1\u5668\u7aef\u6293\u5305\n\n\u5982\u679c Modbus TCP \u901a\u4fe1\u53d1\u751f\u5728 Linux \u670d\u52a1\u5668\u6216\u7f51\u5173\u4e0a\uff0c\u76f4\u63a5\u7528 tcpdump \u6293\u5305\u6548\u7387\u6700\u9ad8\uff1a\n\n```\n# \u6293\u53d6\u6240\u6709\u76ee\u6807\u7aef\u53e3\u4e3a 502 \u7684 TCP \u62a5\u6587\uff08Modbus TCP \u9ed8\u8ba4\u7aef\u53e3\uff09\nsudo tcpdump -i eth0 -w modbus_capture.pcap 'tcp port 502'\n\n# \u53ea\u6293\u6307\u5b9a IP \u8bbe\u5907\u7684\u901a\u4fe1\nsudo tcpdump -i eth0 -w modbus_capture.pcap 'host 192.168.1.100 and tcp port 502'\n\n# \u6309 Ctrl+C \u505c\u6b62\u6293\u5305\n# \u5c06 .pcap \u6587\u4ef6\u4f20\u8f93\u5230\u6709 Wireshark \u7684\u7535\u8111\u4e0a\u5206\u6790\n```\n\n### Windows \u7aef\u76f4\u63a5\u6293\u5305\n\n\u6253\u5f00 Wireshark\uff0c\u9009\u62e9\u4e0e\u76ee\u6807\u8bbe\u5907\u901a\u4fe1\u7684\u7f51\u5361\uff08\u5982\u4ee5\u592a\u7f51\u5361\u6216 Wi-Fi\uff09\uff0c\u5728 Capture Filter \u4e2d\u8f93\u5165 `tcp port 502`\uff0c\u70b9\u51fb\u5f00\u59cb\u6293\u5305\u3002\u6b64\u65f6\u8fd0\u884c\u4f60\u7684 Modbus \u4e3b\u7ad9\u7a0b\u5e8f\uff08\u5982 Modbus Poll\uff09\uff0c\u5373\u53ef\u6355\u83b7\u5230\u5b8c\u6574\u7684 Modbus TCP \u901a\u4fe1\u8fc7\u7a0b\u3002\n\n## Modbus TCP \u62a5\u6587\u8be6\u89e3\n\n\u5728 Wireshark \u4e2d\u9009\u4e2d\u4e00\u6761 Modbus TCP \u62a5\u6587\uff0c\u5c55\u5f00 \"Modbus\/TCP\" \u5c42\u3002\u4e00\u4e2a\u5178\u578b\u7684\u8bfb\u4fdd\u6301\u5bc4\u5b58\u5668\u8bf7\u6c42\u62a5\u6587\u7ed3\u6784\u5982\u4e0b\uff1a\n\n\u5b57\u6bb5\u5b57\u8282\u6570\u793a\u4f8b\u503c\u8bf4\u660e\n\nTransaction ID20x0001\u4e8b\u52a1\u6807\u8bc6\u7b26\uff0c\u5ba2\u6237\u7aef\u81ea\u589e\uff0c\u670d\u52a1\u7aef\u539f\u6837\u8fd4\u56de\nProtocol ID20x0000\u534f\u8bae\u6807\u8bc6\uff0cModbus \u56fa\u5b9a\u4e3a 0\nLength20x0006\u540e\u7eed\u5b57\u8282\u6570\uff08Unit ID + PDU\uff09\nUnit ID10x01\u4ece\u7ad9\u5730\u5740\uff08Slave ID\uff09\nFunction Code10x03\u529f\u80fd\u7801\uff0803=\u8bfb\u4fdd\u6301\u5bc4\u5b58\u5668\uff09\nStarting Address20x0000\u8d77\u59cb\u5bc4\u5b58\u5668\u5730\u5740\nQuantity20x000A\u8bfb\u53d6\u6570\u91cf\uff0810\u4e2a\uff09\n\n\u5bf9\u5e94\u7684\u54cd\u5e94\u62a5\u6587\u5305\u542b\u540c\u6837\u7684 MBAP \u5934 + \u529f\u80fd\u7801 0x03 + \u5b57\u8282\u8ba1\u6570 0x14\uff0820\u5b57\u8282=10\u4e2a\u5bc4\u5b58\u5668\uff09+ \u6570\u636e\u533a\u3002\n\n## Wireshark \u663e\u793a\u8fc7\u6ee4\u5668\u6280\u5de7\n\n\u663e\u793a\u8fc7\u6ee4\u5668\uff08Display Filter\uff09\u7528\u4e8e\u5728\u5df2\u6293\u53d6\u7684\u62a5\u6587\u4e2d\u5feb\u901f\u7b5b\u9009\u76ee\u6807\u6570\u636e\u3002\u4ee5\u4e0b\u662f\u5e38\u7528\u7684 Modbus \u76f8\u5173\u8fc7\u6ee4\u5668\uff1a\n\n```\n# \u7b5b\u9009\u6240\u6709 Modbus \u534f\u8bae\u62a5\u6587\nmodbus\n\n# \u7b5b\u9009\u6307\u5b9a\u529f\u80fd\u7801\uff08\u5982 03 \u8bfb\u4fdd\u6301\u5bc4\u5b58\u5668\uff09\nmodbus.func_code == 3\n\n# \u7b5b\u9009\u5f02\u5e38\u54cd\u5e94\nmodbus.exception_code\n\n# \u7b5b\u9009\u6307\u5b9a\u4ece\u7ad9\u5730\u5740\nmodbus.unit_id == 1\n\n# \u7b5b\u9009\u5305\u542b\u5f02\u5e38\u7684\u62a5\u6587\nmodbus.exception_code != 0\n\n# \u7ec4\u5408\u8fc7\u6ee4\uff1a\u4ece\u7ad9 1 \u7684\u529f\u80fd\u7801 16\uff08\u5199\u591a\u5bc4\u5b58\u5668\uff09\nmodbus.unit_id == 1 and modbus.func_code == 16\n\n# \u6309 IP \u5730\u5740\u548c Modbus \u529f\u80fd\u7801\u8fc7\u6ee4\nip.addr == 192.168.1.100 and modbus.func_code == 3\n\n# \u53ea\u770b MBAP \u5934 Transaction ID \u4e3a 5 \u7684\u8bf7\u6c42-\u54cd\u5e94\u5bf9\nmodbus.trans_id == 5\n```\n\n## \u5b9e\u6218\u6848\u4f8b\uff1a\u7528 Wireshark \u6392\u67e5 Modbus \u901a\u4fe1\u6545\u969c\n\n### \u6848\u4f8b1\uff1a\u8bfb\u4e0d\u5230\u6570\u636e\u2014\u2014\u4ece\u7ad9\u65e0\u54cd\u5e94\n\n\u6293\u5305\u540e\u53d1\u73b0\u53ea\u6709\u8bf7\u6c42\u5e27\u6ca1\u6709\u54cd\u5e94\u5e27\uff08\u6216\u51fa\u73b0 TCP RST\/\u91cd\u4f20\uff09\uff0c\u8bf4\u660e\u4ece\u7ad9\u8bbe\u5907\u6ca1\u6709\u6b63\u786e\u54cd\u5e94\u3002\u68c0\u67e5\u65b9\u6cd5\uff1a\n\n- \u786e\u8ba4 TCP \u7aef\u53e3\uff08\u9ed8\u8ba4 502\uff09\u5728\u4ece\u7ad9\u8bbe\u5907\u4e0a\u5df2\u5f00\u653e\n- \u68c0\u67e5\u4ece\u7ad9\u5730\u5740\uff08Unit ID\uff09\u662f\u5426\u4e0e\u8bf7\u6c42\u4e2d\u7684\u4e00\u81f4\n- \u67e5\u770b\u662f\u5426\u6709 TCP \u5c42\u5f02\u5e38\uff08\u91cd\u4f20\u3001RST\uff09\uff0c\u5982\u6709\u5219\u8bf4\u660e\u7f51\u7edc\u5c42\u6709\u95ee\u9898\n\n### \u6848\u4f8b2\uff1a\u8fd4\u56de\u5f02\u5e38\u7801 02\uff08\u975e\u6cd5\u6570\u636e\u5730\u5740\uff09\n\nWireshark \u53ef\u4ee5\u770b\u5230\u8bf7\u6c42\u4e2d\u7684\u8d77\u59cb\u5730\u5740 + \u6570\u91cf\u8d85\u51fa\u4e86\u4ece\u7ad9\u7684\u5bc4\u5b58\u5668\u8303\u56f4\u3002\u5728 Wireshark \u4e2d\u53f3\u952e\u70b9\u8bf7\u6c42\u62a5\u6587 \u2192 \"Follow \u2192 TCP Stream\"\uff0c\u53ef\u4ee5\u770b\u5230\u5b8c\u6574\u7684\u8bf7\u6c42\u548c\u5f02\u5e38\u54cd\u5e94\u5bf9\u8bdd\u3002\n\n### \u6848\u4f8b3\uff1a\u6570\u636e\u503c\u5f02\u5e38\u2014\u2014\u5b57\u8282\u5e8f\u95ee\u9898\n\n\u8bfb\u53d6\u5230\u7684 32 \u4f4d\u6d6e\u70b9\u6570\u5728 Wireshark \u4e2d\u663e\u793a\u6b63\u5e38\uff0c\u4f46\u5728\u4e3b\u7ad9\u7a0b\u5e8f\u4e2d\u663e\u793a\u4e3a NaN \u6216\u6781\u5927\u503c\u3002\u8fd9\u8bf4\u660e\u901a\u4fe1\u5c42\u6ca1\u95ee\u9898\uff0c\u662f\u4e3b\u7ad9\u7a0b\u5e8f\u7684\u5b57\u8282\u5e8f\u89e3\u6790\u6709\u8bef\u3002\u53ef\u4ee5\u5728 Wireshark \u4e2d\u624b\u52a8\u8ba1\u7b97\u9a8c\u8bc1\uff1a\u53f3\u952e\u5bc4\u5b58\u5668\u6570\u636e \u2192 \"Copy \u2192 Value\" \u83b7\u53d6\u5341\u516d\u8fdb\u5236\u539f\u59cb\u503c\uff0c\u7528 IEEE 754 \u8ba1\u7b97\u5668\u5728\u7ebf\u9a8c\u8bc1\u3002\n\n## \u6293\u53d6 Modbus RTU\uff08\u4e32\u53e3\uff09\u62a5\u6587\n\nModbus RTU \u901a\u8fc7 RS-232 \u6216 RS-485 \u7269\u7406\u5c42\u4f20\u8f93\uff0c\u4e0d\u80fd\u76f4\u63a5\u7528 Wireshark \u6293\u53d6\u3002\u5e38\u89c1\u65b9\u6848\uff1a\n\n### \u65b9\u68481\uff1aUSB \u8f6c\u4e32\u53e3 + USBPcap\n\n\u5728 Windows \u4e0a\u5b89\u88c5 USBPcap\uff08Wireshark \u5b89\u88c5\u65f6\u53ef\u9009\u7ec4\u4ef6\uff09\uff0c\u53ef\u4ee5\u6293\u53d6 USB \u8f6c\u4e32\u53e3\u8bbe\u5907\u4e0a\u7684\u539f\u59cb\u6570\u636e\u3002\u4f46\u9700\u8981\u81ea\u884c\u89e3\u6790 RTU \u5e27\uff08\u5730\u5740 + \u529f\u80fd\u7801 + \u6570\u636e + CRC\uff09\u3002\n\n### \u65b9\u68482\uff1a\u4e32\u53e3\u76d1\u63a7\u8f6f\u4ef6\n\n\u63a8\u8350\u4f7f\u7528\u4e13\u95e8\u7684\u4e32\u53e3\u76d1\u63a7\u5de5\u5177\uff1a\n\n- **Serial Port Monitor**\uff08Windows \u5546\u4e1a\u8f6f\u4ef6\uff09\uff1a\u53ef\u76f4\u63a5\u76d1\u63a7\u548c\u89e3\u6790 Modbus RTU \u5e27\n- **CAS Modbus RTU Parser**\uff1a\u514d\u8d39\u5728\u7ebf\u5de5\u5177\uff0c\u7c98\u8d34\u5341\u516d\u8fdb\u5236\u5b57\u8282\u81ea\u52a8\u89e3\u6790\n- **PortMon**\uff08Windows \u514d\u8d39\uff09\uff1a\u5fae\u8f6f\u51fa\u54c1\u7684\u5e95\u5c42\u4e32\u53e3\u76d1\u63a7\u5de5\u5177\n\n### \u65b9\u68483\uff1a\u5728 RTU \u8f6c TCP \u7f51\u5173\u4e0a\u6293\u5305\n\n\u5982\u679c\u73b0\u573a\u4f7f\u7528\u4e86\u4e32\u53e3\u670d\u52a1\u5668\uff08\u5982 MOXA NPort\uff09\uff0c\u53ef\u4ee5\u5728 TCP \u4fa7\u7528 Wireshark \u6293\u5305\uff0c\u62a5\u6587\u5185\u5bb9\u5373\u4e3a RTU \u5e27\u3002\n\n## Wireshark Modbus \u5206\u6790\u8fdb\u9636\u6280\u5de7\n\n### \u7edf\u8ba1\u5206\u6790\uff1aI\/O \u56fe\u8868\n\n\u83dc\u5355 \u2192 Statistics \u2192 I\/O Graph\uff0c\u8bbe\u7f6e\u8fc7\u6ee4\u5668\u4e3a `modbus`\uff0c\u53ef\u4ee5\u89c2\u5bdf\u5230 Modbus \u901a\u4fe1\u7684\u9891\u7387\u548c\u65f6\u95f4\u5206\u5e03\u3002\u5982\u679c\u53d1\u73b0\u5468\u671f\u6027\u5c16\u5cf0\u6216\u95f4\u9699\uff0c\u53ef\u80fd\u662f\u8f6e\u8be2\u53c2\u6570\u914d\u7f6e\u4e0d\u5f53\u3002\n\n### \u67e5\u770b\u5b8c\u6574\u7684 TCP \u6d41\n\n\u53f3\u952e\u4efb\u610f Modbus TCP \u62a5\u6587 \u2192 Follow \u2192 TCP Stream\uff0c\u53ef\u4ee5\u67e5\u770b\u4e00\u6b21\u5b8c\u6574 TCP \u8fde\u63a5\u4e2d\u6240\u6709 Modbus \u8bf7\u6c42\u548c\u54cd\u5e94\u7684\u539f\u59cb\u6570\u636e\u3002\u8fd9\u662f\u6392\u67e5\"\u8bfb\u53d6\u6570\u636e\u9519\u4f4d\"\u95ee\u9898\u7684\u5229\u5668\u3002\n\n### \u5bfc\u51fa Modbus \u6570\u636e\n\nFile \u2192 Export Packet Dissections \u2192 As CSV\uff0c\u53ef\u4ee5\u5c06\u6240\u6709\u89e3\u7801\u540e\u7684 Modbus \u62a5\u6587\u5bfc\u51fa\u4e3a CSV \u683c\u5f0f\uff0c\u65b9\u4fbf\u7528 Excel \u6216 Python \u8fdb\u884c\u6279\u91cf\u5206\u6790\u3002\n\n## \u603b\u7ed3\n\nWireshark \u662f Modbus \u534f\u8bae\u8c03\u8bd5\u4e2d\u4e0d\u53ef\u66ff\u4ee3\u7684\u5de5\u5177\u3002\u5b83\u80fd\u591f\u5c06\"\u770b\u4e0d\u89c1\"\u7684\u901a\u4fe1\u8fc7\u7a0b\u53ef\u89c6\u5316\uff0c\u5e2e\u52a9\u5de5\u7a0b\u5e08\u7cbe\u51c6\u5b9a\u4f4d\u95ee\u9898\u53d1\u751f\u5728\u534f\u8bae\u6808\u7684\u54ea\u4e00\u5c42\u2014\u2014\u662f TCP \u8fde\u63a5\u5efa\u7acb\u5931\u8d25\u3001MBAP \u5934\u5b57\u6bb5\u9519\u8bef\u3001\u529f\u80fd\u7801\u4e0d\u5339\u914d\u3001\u5bc4\u5b58\u5668\u5730\u5740\u8d8a\u754c\u8fd8\u662f\u6570\u636e\u5b57\u8282\u5e8f\u89e3\u6790\u9519\u8bef\u3002\u5bf9\u4e8e\u4efb\u4f55\u4ece\u4e8b Modbus \u901a\u4fe1\u5f00\u53d1\u548c\u8c03\u8bd5\u7684\u5de5\u7a0b\u5e08\uff0c\u638c\u63e1 Wireshark \u6293\u5305\u5206\u6790\u662f\u5fc5\u5907\u6280\u80fd\u3002\n\n---\n*modbus.cn*\n"