modbus-device-enumerationlisted

## When to Use - Building a register map for a Modbus segment with no existing documentation. - Cataloging unit IDs and function codes before deploying a protocol monitor. - Investigating operator reports of unexpected register writes (0x05, 0x06, 0x0F, 0x10). - Extending a Passive OT Network Discovery inventory with register-level detail. ## Prerequisites - tshark 4.x. Verify with `tshark --version`. - pymodbus 3.x. Verify with `pip show pymodbus`. - mbpoll 1.5 or newer. Verify with `mbpoll -V`. - SPAN port or network TAP on the segment. - Endpoint list from `passive-ot-network-discovery`, or an approved device list. - Credentials: none for read-only queries. Some devices reject unauthenticated reads. - Authorization: segment owner sign-off. Active reads require a maintenance window. - Upstream skills: `passive-ot-network-discovery` for the endpoint list. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Captures and inspects traffic. Sends no packets. Safe to run during normal operations. ## Workflow 1. Build `devices.txt` from the endpoint list. One IP per line. 2. Extract the passive Modbus profile from an existing capture: `tshark -r capture.pcapng -Y "modbus" -T fields -e ip.src -e modbus.unit_id -e modbus.func_code -e modbus.word_count | sort -u > modbus_profile.txt` Decision point: if a profile row shows a write function code (0x05, 0x06, 0x0F, 0x10) to an address the operator did not authorize, flag