sniff 8 RS485 MODBUS RTU


I need to listen to 8 RS485 modbus rtu networks.
I need to retrieve the frames sent by the master and the corresponding slave response. Afterwards I need to send the 2 informations (request + response) to a server that can decode the frames and find the values read by the master on the slave (that's all of function 3).

It is to do supervision on an existing network.

Do you know any suitable sniffers to do this kind of thing?

(It is possible to decode the frames in the device and send to the server only the decoded values)

Thanks in advance
Assuming this is a request for a permanent solution to supervise an existing Modbus RTU network from another device/network, ICC's Mirius gateway supports a Modbus RTU Sniffer driver, specifically designed for this purpose. The Mirius has 2 RS-485 ports. You would configure the Modbus RTU Sniffer driver on one port (defining the slave addresses, register types, and register numbers to sniff) and connect it to your existing Modbus RTU network. You can then configure the other port for any protocol you'd like, such as Modbus RTU, BACnet MS/TP, etc. to access the sniffed values of the register from a different device/network.

Details on the Mirius can be found on its product page here:

However, if you are just looking for a debug/diagnostics tool to sniff the packets on the Modbus RTU network using an analyzer such as Wireshark, the Mirius can also do this as well with it's Serial Sniffer feature that allows you to capture the Modbus RTU packets and export them to a Wireshark PCAP file. There's a tutorial video here:

There are also third-party software tools for this purpose, where you would use a computer and a USB to RS-485 adapter, such as this software:

If you have any questions about the Mirius, feel free to PM me or submit a support ticket on ICC's website.
Hello and Thanks

I's for a permanent solution (supply data to a supervision system for several years).
The current RS485 system is very old but works perfectly. I'm looking to capture the data to better exploit them in a modern analysis system used for other things.

I'm looking for mirius...
If I understand correctly, as indicated on my diagram, I need 8 MIRIUS with a specific driver allowing the MIRIUS to sniff the registers that interest me and a recorder or a gateway allowing me to read the 8 MIRIUS transformed into modbus RTU slaves (1 per sniffed RS485).
True ?


You are correct that you would need 8 Mirius gateways to sniff your 8 Modbus RTU networks.

You show an additional "gateway RTU/TCP" on your diagram, that may not be necessary. If your "Server" supports Modbus RTU, BACnet MS/TP, or any other protocol supported by the Mirius, then your server can connect directly to the Mirius gateways. However, if you server only supports Modbus/TCP or uses some other protocol all together, then you would likely need an additional gateway to convert from Modbus RTU to the protocol that your server supports.

If you would like to convert directly to Modbus/TCP from your sniffed Modbus RTU networks, then you could use our ETH-1000 gateway instead of the Mirius (8 total ETH-1000's, one per Modbus RTU network). Alternatively, instead of using 8 ETH-1000's, you could still use 8 Mirius's and add 1 ETH-1000 (this would be the "gateway rtu/tcp" in your diagram) to convert to Modbus/TCP. This would be a more complex, but more cost-effective solution than using 8 ETH-1000's. Details on the ETH-1000 can be found here:
the "server" is a computer station. I only have an IP connexion on it. A lot of IP solution but only IP solution.

ETH-100 is good but I'm already hot in budget with 8 mirius and also in difficulty with size and cabling.
initially I had in mind a single box with 8 RS485 and 1ethernet port...
The only device I know of on the market that can have 8 RS-485 ports and supports Ethernet is Red Lion's new Flex Edge DA70A, but you also need it with 3 RS-485 communication sleds added. I believe Red Lion has a Modbus RTU Monitor driver that may support the sniffing functionality you need.

I don't know what the exact price of the above is and whether or not Red Lion charges for drivers, configuration software, per-node licensing, etc., but I would wager that it comes pretty close to, if not exceeds, the cost of 8 Mirius's and an ETH-1000 (the price shown on the Mirius and ETH-1000 product pages is the only price you pay, all drivers, software, support, etc. are included free of charge).
outch !
big machine ... I also doubt that it could be cheaper, (with the 25 years of training necessary to program it :) )

I have to find a solution for the dimensions (where to place the mirius, how to wire all this in an already monstrous and very old box).
Considering the age of the box I wanted to handle the cables and the contents as little as possible. So install with short connections to avoid moving the terminal resistors or making a star network.
As you probably saw on its product page, the Mirius is approximately 90mm x 35mm x 30mm, and is about as compact as it gets. The enclosure has an integrated DIN rail clip, so perhaps you could utilize a DIN rail?

Is there a specific reason why you need to mount the Mirius inside this very old box?

Concerning wiring, I would advise against making a star network or adding the Mirius at the end of the bus without moving the termination resistor. The Mirius can be wired anywhere on the RS-485 bus, so long as you maintain a daisy-chain topology. Typically, the easiest places are at either end of the bus, but this would require you to move the termination resistor to the Mirius. Alternatively, you can cut the existing RS-485 cabling in any convenient location, strip back the conductors, then land both ends of the cabling onto the Mirius to insert the Mirius into the network.
the reason is essentially
  • do not drill the box
  • Ethernet is already in the box
  • saving of a new box in a very dirty room

The 8 RS485 are joined in this box with a very short cable length (not possible to put the MIRIUS in series) and I do not see where the resistance at the end of the line is.

I thought about making a derivation to the MIRIUS as short as possible (10 or 20cm)
The 8 RS485 are joined in this box with a very short cable length (not possible to put the MIRIUS in series) and I do not see where the resistance at the end of the line is.
The diagram you drew seems to indicate that you have 8 separate Modbus RTU networks, each with its own master. Therefore, the 8 RS-485 networks could not be joined together, otherwise communications would not work as you would have multiple masters on the same bus. Did I misunderstand what you meant by, "The 8 RS485 are joined in this box"? Are you sure you have 8 masters? Is it possible you have only 1 master and 8 RS-485 buses wired in a star topology?

If you are sure you are at the physical end of the RS-485 bus and do not see a termination resistor, then either termination is not used on the bus, some other termination device is used, or the device on the end of the bus has integrated termination enabled by a DIP switch or similar.
8 RS485 of nearly 1000m are "joined" in this box, with 8 masters. They are not interconnected but it is the only place where I have access to the 8.

the terminal resistor is probably "on the device on the end of the bus has integrated termination enabled by a DIP switch or similar " but I do not see where the resistance is exactly (to disconned it)

I was able to sniff the networks and go into detail.

Finally there are not 8 RS485 in the same location but 2 RS485 in 2 separate boxes !

here is the diagram of what I need to recover.

>I could use 1 MIRIUS in each box and a rtu to TCP gateway
>maybe I can also use two ETH-1000 directly over ethernet
>what else ?

How would you do ?

thanks a lot
If you only have 2 Modbus RTU networks, then 2 ETH-1000 gateways would be lower cost and less complicated to install and configure than 2 Mirius gateways and an ETH-1000 (RTU to TCP gateway). Therefore, I recommend using 2 ETH-1000 gateways for your application.
I was not looking for an ETH-1000 for the gateway to TCP MODBUS, but more for a gateway dedicated to this, less expensive.

I am having difficulty to obtain IP access points on the network; the solution with a gateway allows me to have a single IP.
but the solution with 2 ETH1000 remains simpler, I prefer.
Hoping that I can quickly understand the configuration of this war machine :)

I have to see where I can buy this in France, if possible.