Modbus TCP/IP & RTU-over-TCP Engineering Guide
Understand the 7-byte MBAP header on TCP port 502, when to use Modbus TCP vs. RTU-over-TCP with serial gateways, and how Unit IDs route to RS-485 slaves.
Quick Answer: Modbus TCP wraps the standard Modbus PDU inside a 7-byte MBAP header (Transaction ID, Protocol ID 0, Length, Unit ID) over TCP port 502 without a CRC-16 checksum. If you are using a transparent serial-to-Ethernet adapter that forwards raw RS-485 bytes, choose RTU-over-TCP instead so the 2-byte CRC-16 is included.
How Modbus TCP/IP Encapsulates Modbus Frames
Modbus TCP (standardized in IEC 61158) takes the exact same Protocol Data Unit (PDU: Function Code + Data) used in serial Modbus RTU, strips the 2-byte CRC-16 checksum (since TCP/Ethernet already provides 32-bit CRC + TCP checksums), and prepends a 7-byte MBAP (Modbus Application Protocol) Header over TCP port 502:
| Bytes | Field Name | Size | Example Hex | Purpose |
|---|---|---|---|---|
0–1 |
Transaction ID | 2 bytes | 00 01 |
Incremented by the client on each request; echoed back by the server so concurrent requests can be matched. |
2–3 |
Protocol ID | 2 bytes | 00 00 |
Always 0x0000 for standard Modbus TCP. |
4–5 |
Length | 2 bytes | 00 06 |
Number of following bytes in the frame (Unit ID + PDU). |
6 |
Unit Identifier | 1 byte | 01 |
Identifies the target slave behind a TCP-to-RS485 gateway (or 1 / 255 for direct TCP devices). |
7+ |
Modbus PDU | N bytes | 03 00 00 00 02 |
Function Code (03) + Start Address (00 00) + Quantity (00 02). |
Modbus TCP vs. RTU-over-TCP (Serial Device Servers)
One of the most frequent commissioning pitfalls occurs when connecting to an Ethernet-to-RS485 adapter (such as a Waveshare RS485-to-ETH, USR-TCP232-410s, or Moxa NPort):
- Transparent TCP Socket Mode (RTU-over-TCP): The converter simply forwards raw serial bytes over a TCP socket. There is no 7-byte MBAP header, and every frame must end with a 2-byte CRC-16. In ModbusBB, select transport
RTU over TCP. - Modbus TCP Gateway Mode: The gateway actively translates between Modbus TCP (MBAP header, no CRC) on the Ethernet side and Modbus RTU (with CRC-16) on the RS-485 bus. In ModbusBB, select transport
Modbus TCPand set theUnit IDto the RS-485 slave address.
Unit ID 0 vs. 1 vs. 255 in Modbus TCP
While the original Modbus TCP specification suggested 0xFF (255) or 0x00 (0) for non-bridged IP devices, real-world devices vary widely:
Unit ID = 1: Accepted by >90% of PLCs, inverters, and meters. Always try1first.Unit ID = 255 (0xFF): Required by some Schneider Electric, Advantech, and Modbus TCP server stacks when addressing the gateway itself.Unit ID = 1..247: Required when polling downstream RS-485 slaves through a Modbus TCP gateway. Use ModbusBB's Slave ID Scanner to discover active Unit IDs automatically.
Frequently Asked Questions
What port does Modbus TCP use?
Standard Modbus TCP uses TCP port 502 (and Modbus TCP Security uses port 802). Many serial-to-Ethernet converters in raw socket mode (RTU-over-TCP) default to ports like 4001, 502, 8899, or 23.
What is the difference between Modbus TCP and RTU over TCP?
Modbus TCP uses a 7-byte MBAP header at the start of the packet and no CRC checksum. RTU over TCP sends raw serial Modbus RTU frames (Slave ID + PDU + 2-byte CRC-16) directly inside a TCP stream without an MBAP header. ModbusBB 2.1 supports both transports natively.
How many simultaneous connections can a Modbus TCP device accept?
Many embedded Modbus TCP devices (meters, inverters, and compact PLCs) only accept 1 to 4 simultaneous TCP socket connections. If another SCADA master holds the socket open, new connections will be refused or reset until the idle timeout expires.
Decode Float32, Float64 & Int32 Registers Live in ModbusBB
Poll holding and input registers with per-row data types, byte-order swap (`ABCD`, `CDAB`, `BADC`, `DCBA`), linear scaling (`Ax + B`) and engineering units.