Modbus TCP - Modbus over Ethernet

Modbus TCP carries the familiar Modbus register model over Ethernet and TCP/IP. The application meaning is almost the same as Modbus RTU: function codes, coils, holding registers, input registers, and device-specific register maps. The wrapper changes from a serial RTU frame to a TCP message with an MBAP header.

If you understand Modbus RTU, you already understand the most important part of Modbus TCP: what a register read or write means.

Learning Objectives

By the end of this lesson, you should be able to:

Explain what changes when Modbus moves from RTU to TCP.
Decode the Modbus TCP MBAP header.
Describe how the Unit ID is used by RTU-to-TCP gateways.
Compare Modbus TCP with Modbus RTU for speed, wiring, topology, and security.
Troubleshoot port, connection, gateway, register, and byte-order problems.

Same Application Model, Different Transport

flowchart TD subgraph RTU["Modbus RTU"] R1["Modbus function codes\nRegisters and coils"] --> R2["UART byte stream\nTiming gaps"] R2 --> R3["RS-485 physical bus"] end subgraph TCP["Modbus TCP"] T1["Modbus function codes\nSame registers and coils"] --> T2["TCP connection\nOrdered byte stream"] T2 --> T3["IP and Ethernet\nSwitched network"] end

Modbus TCP removes the RTU CRC and silent-gap frame timing. TCP provides ordered byte delivery, and the MBAP header provides a length field so the receiver knows where the message ends.

TCP Port 502

Modbus TCP normally uses TCP port 502. A client, such as SCADA or a PLC, opens a TCP connection to a server, such as a meter, drive, gateway, or controller.

sequenceDiagram participant C as Client SCADA participant S as Server Power Meter C->>S: TCP connect to port 502 S-->>C: Connection accepted C->>S: TxID 1, Unit 1, FC 03, read register 0 count 2 S-->>C: TxID 1, FC 03, four data bytes C->>S: TxID 2, Unit 1, FC 06, write register 10 S-->>C: TxID 2, echoed write response

The connection can stay open for repeated polling. Some devices allow multiple clients. Others limit the number of simultaneous connections and reject or drop extra clients.

MBAP Header

Modbus TCP prefixes the Modbus Protocol Data Unit with a 7-byte MBAP header.

+----------------+-------------+--------+---------+----------+------+
| Transaction ID | Protocol ID | Length | Unit ID | Function | Data |
| 2 bytes        | 2 bytes     | 2 bytes| 1 byte  | 1 byte   | ...  |
+----------------+-------------+--------+---------+----------+------+

Field	Size	Purpose
Transaction ID	2 bytes	Matches each response to its request
Protocol ID	2 bytes	Always `0x0000` for Modbus
Length	2 bytes	Number of bytes after this field
Unit ID	1 byte	Target slave behind a gateway, or server unit identifier
Function code	1 byte	Same codes as Modbus RTU
Data	Variable	Register address, count, values, or exception code

Example read request:

00 01 00 00 00 06 01 03 00 00 00 02

Bytes	Meaning
`00 01`	Transaction ID 1
`00 00`	Modbus protocol
`00 06`	Six bytes follow
`01`	Unit ID 1
`03`	Read holding registers
`00 00`	Start address 0
`00 02`	Read 2 registers

There is no RTU CRC at the end of a Modbus TCP message.

Gateways Between TCP and RTU

Many Ethernet control systems still need data from RS-485 field devices. A Modbus gateway accepts Modbus TCP requests and converts them into Modbus RTU requests.

flowchart LR C["SCADA or PLC\nModbus TCP client"] -->|"TCP port 502"| G["Modbus gateway"] G -->|"RS-485 Modbus RTU\nUnit ID selects slave"| M1["Slave 1 meter"] G --> M2["Slave 2 drive"] G --> M3["Slave 3 controller"]

In this case the Unit ID matters. It tells the gateway which RTU slave address to poll. If the server is a native Ethernet device with no serial slaves behind it, the Unit ID may be ignored or fixed by the vendor.

Multiple Clients and Polling Load

Unlike a single-master RTU bus, Ethernet allows multiple Modbus TCP clients to connect to the same server. That does not mean unlimited safe polling.

Risk	Practical effect
Too many TCP clients	Device refuses connections or drops old sessions
Polling too fast	Embedded server CPU becomes overloaded
Gateway bottleneck	Many TCP requests queue behind a slow RTU bus
Duplicate writers	Two clients fight over the same command register

Coordinate polling intervals and write ownership in SCADA, PLC, and historian systems.

Modbus TCP vs Modbus RTU

Feature	Modbus RTU	Modbus TCP
Physical layer	RS-485 or RS-232	Ethernet, fiber, WiFi, routed IP
Framing	Address, function, data, CRC	MBAP header plus function and data
Error checking	CRC in frame	Ethernet and TCP checksums
End of frame	3.5 character silence	Length field
Master/client count	Usually one master	Multiple clients possible
Addressing	Slave address on bus	IP address plus Unit ID
Security	None by default	None by default unless secured externally
Best use	Simple serial field buses	SCADA, gateways, plant Ethernet

Modbus TCP is not automatically secure because it uses Ethernet. Standard Modbus TCP is plaintext and has no authentication.

Practical Checks

Confirm the device IP address, subnet mask, gateway, and TCP port.
Check whether port 502 is blocked by a firewall or NAT device.
Verify the Unit ID, especially when polling through a gateway.
Confirm register base, scale, signed format, and word order just as you would for RTU.
Limit polling rate when a gateway must serialize requests onto a slow RS-485 bus.
Ensure only one controller writes command registers unless the system has arbitration.
Segment Modbus TCP networks and use VPN, firewall rules, or secure gateways where remote access is required.

Common Mistakes

Assuming the Unit ID is irrelevant when a gateway is involved.
Forgetting that Modbus TCP still uses device-specific register maps.
Polling a serial gateway like a fast native Ethernet device.
Leaving port 502 exposed outside the control network.
Expecting TLS, authentication, or user permissions from basic Modbus TCP.
Reading a 32-bit value with the wrong word order.

Summary

Modbus TCP keeps the Modbus function-code and register model but replaces serial RTU framing with a TCP/IP message and MBAP header. It is useful for Ethernet-connected SCADA, PLCs, gateways, meters, and drives. Good Modbus TCP troubleshooting starts with IP reachability and port 502, then checks Unit ID, register mapping, data format, gateway timing, and network security.

Mind Map

mindmap root((Modbus TCP)) Core concept Modbus over TCP Same registers MBAP header Applications SCADA polling Ethernet meters RTU gateways Plant historians Fields TxID matches response Protocol ID zero Length frames message Unit ID selects slave Design rules Use port 502 Check gateway Unit ID Control write ownership Segment network Practical checks Ping and TCP connect Register scale Word order Gateway queue Common mistakes Ignoring Unit ID Overpolling gateway Exposed plaintext Wrong register base