Sniffers, Analyzers and Serial Tools

A method that works

When a link will not come up, resist changing several things at once. Work from the bottom layer up, and prove each layer before moving on: power and wiring, then electrical signal, then settings, then protocol and addresses, then the PLC program. A cheap USB adapter and a free program can answer, in minutes, the question “is the device talking at all?”, which can otherwise take hours of guessing inside the PLC software.

Question	Tool that answers it
Is there a voltage on the line, and the right polarity?	Multimeter
Is the line idle, and are there pulses when data is sent?	Multimeter (AC/DC scale), oscilloscope
Does the device answer a simple request?	PC with a USB adapter and a master tool
What bytes are really on the wire, in both directions?	Serial sniffer, logic analyzer, oscilloscope with decode
Is the Ethernet device reachable?	Ping, ARP, port scanner
What is the PLC really sending?	Wireshark on a mirror port or a tap

USB serial adapters

Modern laptops have no serial port, so a USB adapter is the first tool to buy. Buy two or three: a USB-RS232 for programming ports and old equipment, a USB-RS485 for Modbus and drive networks, and a spare so you can build a sniffer.

Chip	Notes
FTDI FT232R / FT232H	The reference choice: stable drivers, good isolation options, programmable. Counterfeit chips exist and some driver versions refuse them
Silicon Labs CP210x	Reliable, widely used, good drivers
WCH CH340 / CH341	Cheap and common; fine for most work; the quality of the driver install varies
Prolific PL2303	Many counterfeit chips: a recent driver may refuse them (a yellow warning in Device Manager). Buy from a source you trust, or avoid

• Buy isolated for plant work. An isolated adapter protects the laptop from ground differences and surges. It costs more, but a ground loop between a laptop and a VFD panel can destroy an unisolated port.
• Check the voltage levels. A “USB-serial” cable for a microcontroller is often 3.3 V or 5 V TTL, not RS-232. Plugging it into a ±12 V RS-232 port can damage it. Make sure the adapter says RS-232, RS-422 or RS-485.
• RS-485 direction control. Good adapters switch the driver on and off automatically. A cheap one may need the software to control RTS, or it leaves the line driven and blocks the other devices.
• Terminal blocks or a DB9. Screw terminals are easier to use for A, B and ground than a DB9 with a gender changer.
• Label the COM port. Windows assigns a new port number to each adapter on each USB port; note it in Device Manager and label the adapter.

Loopback plugs, breakout boxes and null modems

Item	What it is	What it proves
Loopback plug	A DB9 with pin 2 joined to pin 3 (and RTS to CTS, DTR to DSR)	The PC port and the driver work: what you type comes back
RS-485 loopback	A and B joined to a second adapter’s A and B on the same PC	Two adapters can talk; the software is set up correctly
Breakout box	A DB9 in-line with LEDs and jumpers for each line	Which lines are active; swap TXD/RXD without a soldering iron
Null modem adapter	Crosses TXD and RXD (pins 2 and 3)	Whether a straight or crossed cable is needed
Gender changer	Male–male or female–female DB9	Makes a cable fit; says nothing about the signals

Terminal and master/slave test software

Tool	Use	Notes
PuTTY, Tera Term	Simple serial terminals	Good for text protocols and quick tests; set the port, speed and parity
RealTerm	Terminal with a hex display	Shows bytes in hex and ASCII; can send hex strings and capture to a file
Docklight	Serial tester and logger	Send scripted sequences, log both directions with time stamps; free for limited use
Modbus Poll / Modbus Slave	Modbus master and slave simulators (commercial, trial available)	Reads and writes registers; shows the raw frames and error counts
QModMaster	Free, open-source Modbus master	RTU and TCP; adequate for quick checks
mbpoll	Free command-line Modbus master	Scriptable; works on Windows, Linux and Raspberry Pi
Vendor tools	Drive and PLC software	Many drive tools show the communication status and error counts

• Be the master yourself. Disconnect the PLC from the bus (two masters on one bus corrupt each other’s frames), connect the PC, and read a known register. If the PC gets an answer, the device, wiring and settings are good.
• Be the slave. If the PLC is the master and you doubt it, connect the PC as a slave simulator with the same address and watch whether requests arrive.
• Change one setting at a time and note the result. Writing down the sequence keeps you from going around in circles.

Sniffing a serial link

A sniffer listens to a conversation between two devices without taking part. On a serial link there are three approaches.

Method	How	Good for	Limits
RS-485 (party line)	Connect a USB-RS485 adapter to the A/B pair and set it to receive only	Modbus RTU: master and slaves share the same wires, so one adapter sees both directions	Add it with a short stub; do not add a third terminator; the adapter must not drive the line
RS-232 tap with two adapters	A Y-cable or breakout: the PC’s RXD pins listen to the PLC’s TXD and the device’s TXD on separate COM ports	Any RS-232 link	Two ports, two logs to merge by time stamp; do not connect the PC’s transmit pins
Software port monitor	Watch a COM port that a program on the PC is already using	Debugging what the PC software is sending	Only sees the PC’s own traffic
Logic analyzer	Clip leads on the TX/RX lines or the 5 V/3.3 V UART side; decode UART or Modbus	Timing, gaps, and signals the PC adapter cannot capture	Needs logic-level signals; use an RS-485 receiver or a differential probe
Oscilloscope with serial decode	Probe the line; the scope decodes UART	Seeing signal quality at the same time as the bytes	Differential signals need two channels or a differential probe

• Receive only. A tap must never transmit on the line. On RS-232 leave the sniffer’s TXD unconnected; on RS-485 turn off its driver (receive only).
• Time stamps. With two adapters, log with time stamps so the two directions can be put in order.
• Same settings. The sniffer must use the same baud rate and parity as the link, or it shows garbage even when the link is fine.
• Capture to a file. A log you can search and send to the manufacturer is worth more than a moving screen.

Meter and oscilloscope checks

With a multimeter

Measurement	Expected	What a wrong reading means
Idle voltage A to B (power on, no traffic)	About +0.2 to +5 V with bias; B positive of A on most devices	About 0 V means no bias, and a noisy line; a negative reading means A and B are swapped on the meter or on the bus
Resistance across A and B (power off)	About 60 Ω with two 120 Ω terminators	About 120 Ω: only one terminator; very high: none; very low: a short or too many terminators
Voltage during traffic (DC scale, averaging)	The reading flickers slightly	A steady reading means no traffic; frozen at a rail means a device is holding the line
RS-232 idle (TXD to ground)	About −5 to −12 V when idle	About 0 V: port off or unconnected; +V: wrong polarity or an RS-485 port
Ground difference (between the two devices’ grounds)	Under a few volts	More than a few volts: the common-mode range is exceeded; add a ground wire or isolation
Shield continuity	Continuous end to end, grounded at one point	Broken shield or grounded at both ends in a noisy plant

With an oscilloscope

• Bit time. At 9 600 baud one bit is 104 µs. Measure the shortest pulse; if it is half or double, the baud rate is wrong by that factor.
• Idle level. The line should sit at a clean idle (mark) level between frames. A mid-level line is floating: add bias.
• Edges. Rounded, slow edges mean too much capacitance (a long cable or no matching termination); ringing after each edge means reflections (a missing or doubled terminator, or a long stub).
• Amplitude. RS-485 should show at least ±1.5 V differentially at the receiver. Much lower means a loaded line or a bad driver.
• Gaps. A Modbus RTU frame must have no gap longer than 1.5 character times inside the frame, and at least 3.5 character times between frames. At 9 600 baud, that is 1.6 ms and 3.6 ms.
• Collision. Two devices transmitting at the same time show a distorted waveform with a doubled amplitude and some bits wrong: look for two masters, or a slave answering to the wrong address.

Reading a Modbus capture

Frame	Bytes (hex)	Meaning
Request	01 03 00 00 00 02 C4 0B	Slave 01, function 03 (read holding registers), start address 0000, quantity 0002, CRC (low byte first)
Response	01 03 04 00 0A 01 02 5A 60	Slave 01, function 03, byte count 04, register 0 = 000A (10), register 1 = 0102 (258), CRC
Exception	01 83 02 C0 F1	Slave 01, function 03 + 80 = 83 (an error), exception code 02 (illegal data address), CRC

Exception code	Name	Usual cause
01	Illegal function	The device does not support that function code (reading with 04 when it needs 03, or writing a read-only value)
02	Illegal data address	The register does not exist: an off-by-one error or the wrong register map
03	Illegal data value	Quantity too large, or the value is outside the allowed range
04	Slave device failure	The device had an internal error while carrying out the request
05–06	Acknowledge / busy	The device is busy; try again later
0A–0B	Gateway path unavailable / target failed to respond	A gateway could not reach the device behind it

• Request seen, no response. The device did not hear the request (wrong address, baud, polarity) or chose not to answer (CRC error, parity error). Check the settings and the A/B wires.
• Response with an exception. The link works; the problem is the request. Compare the address and function with the register map.
• Response with a bad CRC. Noise, wrong termination, or a data-rate mismatch.
• Garbled bytes with the right pattern. If 01 03 arrives as 80 or FE, the baud rate or bit order is off; if bytes are always doubled or shifted, parity or stop bits are different.
• Two requests and no gap. A master that sends the next request before the slave replied has a timeout that is too short.
• Responses from several devices at once. Two devices share an address.

Symptoms and likely causes

Symptom	Likely causes	First check
No bytes at all	Cable open, wrong port, master not polling, A/B not connected	Meter on the line during a poll; loopback test of the PC
Request seen, no response	Wrong address, baud or parity; A/B swapped; slave powered off	Compare settings; swap A and B; try another address
Garbage characters	Baud rate or data bits mismatch; 7/8 bit; wrong voltage levels	Set the PC to match the device and scan the bauds
Works for a while, then stops	Ground loop, noise from a drive, loose terminal, intermittent connector	Look for errors with a scope when it fails; check shields and routing
Works with a short cable, not a long one	Missing termination or bias; too high a baud rate	Terminate both ends, add bias, lower the baud rate
One device fails, the others work	Wrong address, long stub, bad connector, faulty transceiver	Test it alone with the PC
Random CRC errors	Electrical noise, reflections, bad grounding	Scope for ringing; separate the cable from power wiring; use shielded pair
Values wrong but communication fine	Off-by-one address, scaling, word order, signed against unsigned	Compare to the device display; check the register map
Everything stops when one device is plugged in	A failed driver holding the line, or two masters	Unplug devices one by one until it recovers
PLC shows a fault, PC works	PLC port settings or program, timeout too short, wrong protocol selected	Compare the PLC port settings with those that worked on the PC

Sniffing Ethernet with Wireshark

Wireshark is a free packet analyzer that understands most industrial protocols. Select the network adapter, start the capture, send some data, stop, and read the packets. A capture can be saved and sent to a manufacturer’s support team.

Protocol	Display filter	What to look for
Modbus TCP	modbus or tcp.port == 502	Requests and responses by transaction ID; exception responses; no reply
EtherNet/IP and CIP	enip || cip	List Identity replies, connection set-up (Forward Open), and cyclic I/O packets on UDP 2222
Siemens S7	s7comm or tcp.port == 102	Read and write requests; set-up communication; errors when PUT/GET is disabled
PROFINET	pn_dcp or pn_io	DCP identify requests and replies show device names; cyclic data
OPC UA	opcua	Hello, open secure channel, session set-up; security errors
Everything to one device	ip.addr == 192.168.1.10	Whether it answers at all
Problems	tcp.analysis.flags	Retransmissions, resets, zero windows
Resets and refused connections	tcp.flags.reset == 1	The server closed the connection or has no service on that port
ARP trouble	arp	Requests with no replies mean the device is not on the network or has a different address; duplicate IP warnings

• Start with ARP and ping. If the PLC does not answer ARP, nothing above it will work. If it answers ARP and ping but not the protocol, look at the port, the protocol settings and any firewall.
• Look at the handshake. A TCP connection starts with SYN, SYN/ACK, ACK. A SYN with no reply means no route or a firewall; a reset after SYN means nothing is listening on the port.
• Time. Set the time column to “since previous displayed packet” to find delays, such as a slow response to a request.
• Wireshark does not need the PLC’s permission, but capturing on a plant network can be restricted. Get approval before connecting a laptop.

Getting the traffic: mirror ports and taps

On a switched network, a laptop plugged into a spare port sees only broadcast traffic and its own. To see another device’s conversation you must have the traffic copied to you.

Method	How it works	Notes
Mirror (SPAN) port	A managed switch copies the traffic of one or more ports to a chosen port	Needs a managed switch and permission to change it; can drop packets on a busy link
Network tap	A small inline device passes the traffic and copies it to a monitor port	Passive; does not change the switch; the device breaks the link for a moment when installed
Hub	An old repeater hub shares everything with every port	Rarely used; limited to 10 Mbit/s; not for modern networks
Capture on the PC itself	Wireshark on the engineering laptop sees its own traffic	Enough when the laptop is one of the two ends
Packet capture in the device	Some PLCs and switches can capture internally	Check the manufacturer’s tools

Other network tools

Tool	Use
ping	Is the device reachable? Run a continuous ping while wiggling a cable to find an intermittent connection
arp -a	Shows the IP and MAC address pairs the PC knows; a duplicate IP appears as the same MAC for two devices, or a MAC that changes
IP scanner (Advanced IP Scanner, Angry IP Scanner, nmap)	Finds the devices on a subnet; use carefully on a live plant network
Vendor discovery tools	RSLinx/Studio 5000 browse, TIA Portal accessible devices, PRONETA, BOOTP/DHCP tool: find a device with an unknown address
Cable tester	Checks each pair of an RJ45 cable; some measure length
Managed switch diagnostics	Port counters (CRC errors, collisions, speed and duplex) show a bad cable or a mismatch
Speed and duplex	A port forced to 100 full next to one on auto negotiates down to half duplex and produces errors

Cautions

• Get permission. Plugging a laptop into a production network or opening a control panel needs approval, and some sites forbid it.
• Never transmit when sniffing. A serial tap that drives the line, or a laptop that sends traffic to a PLC network, can stop a machine.
• Reading is safer than writing. Do not write to registers or tags on a running machine unless you know what they do.
• Isolate. Use an isolated adapter and take care with panel voltages; follow the lockout and arc-flash rules of the plant.
• Remove your test gear. Take out taps, temporary terminators and jumpers when finished, and restore the settings you changed.
• Secure the data. Captures can contain passwords and process data: store and share them with care.

Related

• Industrial Communication: the overview of this guide.
• Connecting PLCs, Drives and HMIs: the set-up that these tools verify.
• Troubleshooting Industrial Networks: the method these tools serve, with symptom tables and case studies.
• Industrial Communication: the protocols in detail.

FAQ

What is the cheapest way to see what is on an RS-485 line?

A USB-RS485 adapter (a few dollars to a few tens) in receive-only mode, plus a terminal or Docklight in hex mode. Set the same baud rate and parity, and the master’s requests and the slaves’ responses both appear.

Can I sniff Modbus RTU while the PLC is connected?

Yes, on an RS-485 bus: attach the adapter in parallel with a short stub. Do not add termination or bias, and do not let the adapter transmit.

Why does Wireshark not show any packets from my PLC?

On a switched network you only see traffic addressed to your own PC. Use a mirror port or a tap, or capture on the PLC’s own engineering computer.

What does a CRC error mean?

The receiver computed a different check value from the one in the frame, so at least one bit changed in transit. It is usually noise or a mismatched baud rate; the device discards the frame and the master sees a timeout.

Do I need a logic analyzer?

Not for most jobs. A USB adapter and a meter solve most serial problems; a scope or logic analyzer helps with timing, noise and signal-quality questions.

References

• Modbus Organization, MODBUS over Serial Line Specification and Implementation Guide V1.02 (frame format, timing, CRC, exception codes).
• TIA/EIA-485-A and TIA/EIA-232-F (electrical characteristics).
• Wireshark Foundation, Wireshark User’s Guide and display filter reference.
• Rockwell Automation, EtherNet/IP Network Troubleshooting notes; PROFIBUS & PROFINET International, PROFINET Commissioning Guideline.

Last reviewed: October 2026. Speeds, lengths, node counts and menu names are typical: confirm against the specification and the manufacturer’s documentation for the devices you use.