<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing Modbus Traffic — API & Tool Reference

> Quick reference for tools, commands, and APIs used in analyzing-modbus-traffic.

## Tools

### `tshark`

Command-line Wireshark for Modbus packet capture and field extraction.

**Usage:**
```bash
tshark -i <iface> -f "tcp port 502" -w <output.pcap>
```

**Key Flags:**
  - `-Y "modbus"`: display filter for Modbus frames
  - `-T fields -e modbus.func_code`: extract specific fields
  - `-e modbus.regval_uint16`: extract register values
  - `-e modbus.unit_id`: extract slave/unit ID

---

### `zeek`

Network analysis framework with native Modbus protocol parser.

**Usage:**
```bash
zeek -r <pcap> modbus
```

**Key Outputs:**
  - `modbus.log`: parsed Modbus transactions
  - Fields: `ts`, `id.orig_h`, `id.resp_h`, `func`, `unit_id`

---

### `suricata`

IDS/IPS with ICS protocol detection rules.

**Usage:**
```bash
suricata -r <pcap> -S ics_rules.rules -l /tmp/output/
```

**Key Flags:**
  - `-S`: specify rule file with Modbus signatures
  - `--set app-layer.protocols.modbus.enabled=yes`: enable Modbus parser

---

### `modbus-cli`

Command-line Modbus client for register read/write testing.

**Usage:**
```bash
modbus-cli read <host> <address> <count> --slave <id>
```

**Key Flags:**
  - `read`: read holding registers
  - `write`: write single register (⚠️ lab only)
  - `--slave`: Modbus unit/slave ID

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Never execute write operations against production ICS without explicit authorization

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- NIST SP 800-82: Guide to OT Security
