Home / Debug / Modbus Tools / Modbus TCP

Modbus TCP

Build Modbus TCP request and response frames with a correct 7-byte MBAP header, and parse captured TCP frames.

TCP request generator

Transaction ID Unit ID

Function

Start addr Quantity Write value

TCP response generator

Transaction ID Unit ID Function

Data type Byte order Value

TCP parser

Parsed MBAP fields appear here...

How to use the Modbus TCP tool

Generate a TCP request

Set the transaction ID (0–65535), unit ID, function code, start address and quantity, then click Generate TCP request. The tool builds a 7-byte MBAP header followed by the function code and data. The transaction ID is echoed back by the server in its response. Example: 00 01 00 00 00 06 01 03 00 00 00 02 reads two holding registers from address 0.

MBAP header fields

The MBAP header is 7 bytes: 2-byte transaction ID, 2-byte protocol ID (must be 0x0000), 2-byte length (total bytes of unit ID + PDU) and 1-byte unit ID. Modbus TCP carries no CRC-16 — the length field verifies the frame.

Generate a response

Match the function code of your request, choose a data type and byte order, enter the decimal value, and click Generate TCP response. The response reuses the request's transaction ID and unit ID, and the MBAP length is computed from the content. Example: 00 01 00 00 00 07 01 03 04 00 01 00 02.

Parse a captured frame

Paste a TCP frame and click Parse frame. The tool decodes the transaction ID, protocol ID, length, unit ID, function code and PDU data. Verify the protocol ID is 0 and the length equals the unit ID plus the PDU byte count.

Protocol note: Traditional Modbus TCP runs over TCP port 502 and is not encrypted by default — restrict network access per the device vendor's security guidance. Function 03/04 reads at most 125 registers per request; function 16 writes at most 123.