QModMaster Bus Monitor: Reading Raw Modbus Traffic
When Modbus misbehaves, opinions don’t help — bytes do. QModMaster’s bus monitor shows every byte sent and received in raw hex, timestamped. Learn to read it and you can distinguish “my request never left the PC” from “the device answered but the frame was corrupt” from “the device refused on purpose” in seconds. (QModMaster is free, open-source, LGPLv3 — upstream is the upstream SourceForge project.)
Opening the bus monitor
The Bus Monitor panel is docked in the main window — usually along the bottom. If it’s hidden, re-enable it from the View menu. Each line shows the direction (TX/RX), a timestamp, and the raw hex bytes of the frame.
Anatomy of a Modbus RTU frame
Here is a complete, real request — read 10 holding registers starting at protocol address 0 from slave 1 (illustrative example):
01 03 00 00 00 0A C5 CD
| Bytes | Field | Value | Meaning |
|---|---|---|---|
01 | Slave ID | 1 | which device this is for |
03 | Function code | 3 | read holding registers |
00 00 | Start address | 0 | protocol address 0 = register 40001 |
00 0A | Quantity | 10 | read ten registers |
C5 CD | CRC-16 | — | checksum, low byte first; the receiver recomputes it |
And a matching response carrying ten registers with values 100–1000:
01 03 14 00 64 00 C8 01 2C 01 90 01 F4 02 58 02 BC 03 20 03 84 03 E8 DB 70
| Bytes | Field | Meaning |
|---|---|---|
01 | Slave ID | reply from device 1 |
03 | Function code | echoes the request |
14 | Byte count | 0x14 = 20 data bytes follow (10 registers × 2) |
00 64 … 03 E8 | Data | ten 16-bit values: 100, 200, 300, …, 1000 |
DB 70 | CRC-16 | checksum over all preceding bytes |
Note the request is 8 bytes and the response is 25 — the request carries only an address and a count, while the response carries the actual data.
Three debugging patterns
Pattern 1 — Request goes out, nothing comes back
You see the TX line in the monitor but no RX. The PC side works; the fault is downstream: wiring, slave ID, baud rate, or RTS timing. Work the no-response checklist.
Pattern 2 — Reply arrives but fails CRC
RX bytes appear and QModMaster flags a CRC error. The frame was corrupted in transit — noise, baud mismatch, missing termination. See the CRC error guide.
Pattern 3 — Reply is an exception
The response function code is the request code + 0x80 — e.g. 0x83 answering an FC 03 read — followed by one code byte. Example: request 01 03 00 64 00 01, exception reply 01 83 02 C0 F1 → code 02, illegal data address. Decode it with the exception code guide.
When the monitor isn’t enough
The bus monitor shows what QModMaster’s serial driver saw — but a USB logic analyzer shows what’s electrically on the wire. When the two disagree, the adapter or its driver is lying to you. Capturing both sides is the fastest way to settle “is it the PC or the bus”.
Ready to compare the wire against the software? USB logic analyzers capture raw RS485 frames for hardware-level debugging.
Frequently asked questions
Does the bus monitor show Modbus TCP traffic too?
Yes. For TCP each line shows the MBAP header (transaction ID, protocol ID, length) followed by the unit ID and the PDU. The request/response logic is identical — there is just no CRC field to decode.
Can I copy frames out of the monitor?
Yes — select the hex text and copy it. Pasting a suspect frame into a CRC calculator (or recomputing it by hand) is the fastest way to confirm whether corruption happened on the wire or in software.
Why is the response longer than the request?
The request only carries an address and a quantity (8 bytes in the example); the response carries every register value (25 bytes for ten registers). Longer responses are normal — truncated ones are not.
The monitor shows garbled or partial bytes. What now?
Garbled bytes almost always mean a baud-rate or framing mismatch — both sides must agree on baud, parity, data bits, and stop bits. Fix the serial settings first, then look at the CRC error guide if corruption persists.
Related Guides
- QModMaster ‘No Response’ Timeout: 9 Fixes — pattern 1: silence on the bus
- Modbus CRC Errors: Causes and Fixes — pattern 2: corrupted replies
- Modbus Exception Codes 01–04 Explained — pattern 3: the device refuses
- QModMaster Tutorial: Your First Poll in 10 Minutes — from install to live data
- Download QModMaster — free, open-source (LGPLv3), Windows and Linux