Today is...
Tuesday, September 25, 2018
Welcome to the Modbus Community, about
the world's leading automation protocol.
Modbus TCP/IP after Response an Extra ACK Message
I have got a Modbus TCP/IP connection but i get 3 messages instead of just a query and response.

hello all,

I have got a TCP/IP connection and I was using Wireshark to look how the connection works. Then I saw that the Modbus sends a query and a response what i was expecting but the after the response I see a ack message. First I thought it was from something else but if I send again a query and response it did it again

I allow find something on this website:

This is exactly the same, but I do not really get the answers. Modbus is I guess always query and response. Why now query and response and a extra ack?

By Jake Brodsky on 26 October, 2017 - 11:15 am

If you're looking at ModbusTCP on Wireshark, know that the TCP/IP connection includes the acknowledgement of the TCP frame. On a ModbusTCP system you may actually see the TCP layer acknowledge the ack from ModbusTCP.

You didn't say how you set up your span port or where you're running wireshark. It's entirely possible that you're seeing only one side of the conversation. I could make up quite a few scenarios for what you see, but since you didn't describe any of this, I can't really tell you which one of these possible scenarios are likely.

Spend some time studying TCP and how port spanning or monitoring works on your switches. This is not a trivial thing to understand, but it is essential if you want to understand what Wireshark is telling you.