Modbus RTU filter fields

The filter operates on parsed Modbus messages. Field names start with modbus.. The syntax is shared with other profiles, but trace.* and can.* fields are not available in this catalog.

Catalog

Address, function and result

Field	Type	Meaning and applicability
modbus.unitId	Integer	RTU device address in a valid record; 0 is used for a broadcast request
modbus.function	Integer	Function code without the exception bit. A 0x83 response belongs to function 0x03
modbus.request	Boolean	Request, when the role is known; includes broadcast requests
modbus.response	Boolean	Response, when the role is known
modbus.broadcast	Boolean	Valid RTU broadcast request to address 0
modbus.exception	Boolean	Valid exception response
modbus.exceptionCode	Integer	Exception code; absent in normal responses and requests
modbus.valid	Boolean	The record passed structure and CRC validation; false selects invalid records

Most parsed fields are absent in an invalid message. Therefore, modbus.valid == false and modbus.unitId == 7 cannot find every damaged message believed to belong to that device: the address may be unreliable and unavailable to the filter.

Request or response roles are not determined by RX/TX alone. In particular, identical single-item write messages cannot always be classified unambiguously during passive observation.

Range and data

Field	Type	Meaning and applicability
modbus.startAddress	Integer	Zero-based starting or target address, when included in the PDU
modbus.quantity	Integer	Requested or acknowledged item count, when included in the PDU
modbus.byteCount	Integer	Declared data byte count, when included in the PDU
modbus.data	Bytes	Function data without the device address, function code, starting address, quantity, byte count or CRC; see the table below

Shared Modbus model fields

These fields remain in the catalog, but address and function are sufficient for typical RTU traffic filtering.

Field	Type	Meaning and applicability
modbus.transport	String	rtu in this profile. The shared catalog also recognizes tcp, which is outside this section
modbus.transactionId	Integer	Shared catalog field for Modbus TCP. Always absent in RTU

Where to find ranges and data

Functions	Request	Normal response
01, 02, 03, 04 — read	startAddress, quantity; no data	byteCount, data; no startAddress or quantity
05, 06 — write one item	startAddress, two value bytes in data; no quantity	The same fields
0F, 10 — write multiple items	startAddress, quantity, byteCount, data	startAddress, quantity; no data
Exception response	—	exceptionCode; no normal response range or data

modbus.data[0] is the first function data byte, not the first RTU frame byte. In a register read response, it is the high byte of the first register. The device documentation defines the meaning and conversion of its value.

Examples

Holding register reads for address 7, including exception responses:

modbus.unitId == 7 and modbus.function == 0x03

A request to read ten registers starting at address 100:

modbus.unitId == 7 and modbus.request == true and modbus.function == 0x03 and modbus.startAddress == 100 and modbus.quantity == 10

This selects requests. A read response does not contain address 100 and is not automatically joined to the request.

Exception responses:

modbus.exception == true

Responses with exception code 0x02:

modbus.exceptionCode == 0x02

Invalid records:

modbus.valid == false

Broadcast requests:

modbus.broadcast == true

Recognized write requests:

modbus.request == true and modbus.function in (0x05, 0x06, 0x0F, 0x10)

Read responses with 0x1234 in the first register:

modbus.function == 0x03 and modbus.response == true and modbus.data[0] == 0x12 and modbus.data[1] == 0x34

The starting address in an expression is a protocol address. Do not enter labels such as 40001 without converting them according to the device documentation.

For more on matching messages, see analyzing Modbus RTU traffic.