TCP/IP transport
Modbus TCP message structure
Modbus TCP carries the same function-oriented PDU used by other Modbus transports, but wraps it in an MBAP header. The header provides request matching and message length for the TCP byte stream.
MBAP header and PDU
| Field | Size | Purpose |
|---|---|---|
| Transaction Identifier | 2 bytes | Client-selected value copied into the response to match a transaction. |
| Protocol Identifier | 2 bytes | Zero identifies Modbus protocol data. |
| Length | 2 bytes | Number of following bytes: Unit Identifier plus PDU. |
| Unit Identifier | 1 byte | Identifies a downstream unit when a gateway or bridge needs one; otherwise interpreted according to the server context. |
| PDU | Function-dependent | Function code followed by request or response data. |
The MBAP header is seven bytes, including the unit identifier. Unlike RTU, Modbus TCP does not append the RTU CRC field. TCP's connection and transport checks handle delivery; Modbus request validation still applies at the application layer.
TCP is a byte stream
A TCP read does not necessarily return exactly one Modbus message. A receive operation may yield part of a header, one full message, or bytes spanning multiple messages. A receiver reads the MBAP header, validates its fields and uses the Length value to determine how many further bytes belong to the message. Applications should not assume that one socket read equals one Modbus request or response.
Transaction matching
The transaction identifier allows a client to associate a response with the corresponding request. It matters when multiple transactions are outstanding on a connection. The protocol identifier is currently zero for Modbus. The Length field counts the unit identifier and PDU, not the preceding six MBAP header bytes.
The registered service uses TCP port 502 by convention. Network access should be limited to the intended clients and device segment. Modbus TCP itself does not add user authentication or message encryption.
How TCP differs from RTU
- RTU uses serial timing between frames; TCP uses the MBAP Length field within a TCP stream.
- RTU has a one-byte unit address and two-byte CRC; TCP has a seven-byte MBAP header and no RTU CRC.
- Both transports carry Modbus function codes and function-specific PDUs.
This is a protocol reference, not a statement that ModbusLab currently implements TCP transport. The current simulator and gateway use Modbus RTU serial communication. For serial framing, see Modbus RTU framing.