I have got a TCP/IP connection and I was using Wireshark to look how the connection works. Then I saw that the Modbus sends a query and a response what i was expecting but the after the response I see a ack message. First I thought it was from something else but if I send again a query and response it did it again
I allow find something on this website: http://modbus.control.com/thread/1236749105
This is exactly the same, but I do not really get the answers. Modbus is I guess always query and response. Why now query and response and a extra ack?
If you're looking at ModbusTCP on Wireshark, know that the TCP/IP connection includes the acknowledgement of the TCP frame. On a ModbusTCP system you may actually see the TCP layer acknowledge the ack from ModbusTCP.
You didn't say how you set up your span port or where you're running wireshark. It's entirely possible that you're seeing only one side of the conversation. I could make up quite a few scenarios for what you see, but since you didn't describe any of this, I can't really tell you which one of these possible scenarios are likely.
Spend some time studying TCP and how port spanning or monitoring works on your switches. This is not a trivial thing to understand, but it is essential if you want to understand what Wireshark is telling you.