A sniffer for the Modbus RTU protocol.
This programs allows you to snif packets from a Modbus RTU serial comunication and save them in a .pcap file that you can open with a program like Wireshark.
Compile the program with make. The only dependency is a C compiler
and a POSIX operating system.
You can specify the options with the command line:
Usage: ./sniffer [-h] [-o out_dir] [-p port] [-s speed]
[-P parity] [-S stop_bits] [-b bits]
-o, --output output file where to save the output
-p, --serial-port serial port to use
-s, --speed serial port speed (default 9600)
-b, --bits number of bits (default 8)
-P, --parity parity to use (default 'N')
-S, --stop-bits stop bits to use (default 1)
-t, --interval time interval between packets (default 1500)
-l, --low-latency try to enable serial port low-latency mode (Linux-only)
By default the output file is stdout. This allows to pipe directly the output into other
programs, such as Wireshark.
Unlinke previous versions of the program, an output directory and files into them
are not created. If you need to do a long capture, splitting it into multiple caputure
files, you can use an external program, such as logrotate to create a copy of the output
file, and the send to this program SIGUSR1 to reopen the capture file again.
As an example, you can use the following logrotate config:
/path/to/capture.log {
size 10K
copy
dateext
dateformat "-%Y-%m-%d-%s"
missingok
postrotate
killall -USR1 sniffer
endscript
}
To capture the packets, you need a standard RS485 to TTL serial converter. I tested the capture on a Raspberry Pi model 3B+. If you also use a Raspberry, make sure to enable the hardware UART for better performance by disabling the Bluetooth interface.
Linux kernel tries to optimize load of USB transfers, that's a latency_timer which is default 16ms.
It's pretty high for modbus communication, so to get better result use the -l (--low-latency) flag to try to set
the serial port automatically to ASYNC_LOW_LATENCY (1ms). This requires root privileges, and it's supported only on Linux.
Moreover, not all serial adapters may be supported. In case it's not supported the program will print an error and continue in normal mode.