Passive Modbus RTU for sniffing sunspec power meter

I have a 2-way power meter connected to the battery control unit of my power storage and I would like to connect an RS485 bridge to read the transmitted data. Modbus master and slaves are already there and I want to just sniff the register content (which is a SunSpec register mapping) read by the master and put theses values into openhab items.

Reading about the modbus binding (which I already have running in a Modbus TCP setup) did not show me a solution on how to achieve it with this binding. Do you have any idea? Maybe @ssalonen?

  • Platform information:
    • Hardware: RaspberriyPi 4, with a “random” USB-RS485 bridge
    • openHAB version: 3
  • Issue of the topic: 2-way power meter

I do not think it is possible to sniff the register content with the binding. However, you can find many resources how to do this: sniff rs485 traffic - Google Suche. E.g. This https://github.com/j123b567/SerialPCAP

I wonder how much work it is to deduce the actual contents from this data capture
is it possible easily? As you know, modbus data is just bunch of bytes on the end with little metadata attached.

After you know the registers, it should be straight forward to configure the binding.

Edit: i realized one more thing. Multiple masters in modbus serial is not going to end up well. Do you have some other modbus master, in addition to the openhab? If so, you should be able to workaround the issues by having a gateway in between
 I think they are able to cache the data and serve multiple clients / masters.

I think my first post was misleading, sorry. I actually have a modbus master and a slave, and I want to additionally listen to the register content the existing master reads from the slave and finally have these values in openhab. So I don’t want to have a second master while on the other side I also don’t want to put a device in between the existing master and the slave for several reasons.

The “sniffing” itself could be done also by wireshark but finally the interesting addresses are known and I am looking for a permanent solution to read the traffic along and distribute it to openHAB. - Ideally with the register mapping from the sunspec support in the modbus binding :slight_smile:

The Modbus binding cannot eavesdrop on the traffic, as it stands.

You could monitor traffic with the Serial binding, and decode Modbus protocol in a rule. Throwaway master queries, get the registers you want from slave responses. Build your own RTU decoder. Remember you have access to other scripts and languages from a rule, to exploit ‘found’ decoders.

What difficulty are you trying to work around here, instead of just asking the power controller thingy?

Using the serial binding seems hard for modbus RTU, as binary data is only available in a Base64 encoded string, so I’d need to do base64 decoding and all the modbus interpretation in the rule?

The battery controller doesn’t have a nice interface and in this case I am also interested in the true raw values to see how the control of the 0-power on the grid connection is reacting


Yes. You’re going to have to do work here.

1 Like

It’s not fun if it’s not hard! But as also carry over of existing solutions tend to trigger issues I wondered whether someone has already a similar setup. Let’s see.

In reality you might find e.g. a complete monitor in Python or something that you can implement standalone, and have it pass decoded data to OH.

I think this is the second time in six years someone has asked for this.
I suspect because the Modbus binding revolves around master-slave, query-response model it would not be easy to produce a “monitor” extension for unsolicited data. And it wouldn’t be any use for TCP anyway.

For the record, one off the shelf gateway is moxa mgate mb 3270 https://www.mtl-inst.com/images/uploads/datasheets/moxa/ModBus%20Gateways.pdf (serial redirector function explained on page 9-6)

The MGateTM MB3270 has a serial redirector function that allows additional options for Modbus network integration
The serial redirector function allows the commands of a serial master to be redirected to serial slaves on another port

In addition, a serial master can operate simultaneously with TCP masters or other serial masters, without altering the Modbus architecture or software
Using the
serial redirector function, advanced MB3000 gateways can establish redundant backup control or Ethernet monitoring of Modbus networks that were originally designed for a single serial master

These type of devices are very robust, have some experience from progressional setting.

There might be cheaper alternatives as well. And as @rossko57 mentioned above, it might be possible to hack similar functionality yourself as well using python or similar.

1 Like