Monitoring via Modbus

Router monitoring via Modbus TCP Linux guide applies to RUT950 and RUT955 routers.

Summary

Modbus is a serial communications protocol originally published by Modicon (now Schneider Electric) in 1979 for use with its programmable logic controllers (PLCs). Modbus has become a de facto standard communication protocol and is now a commonly available means of connecting industrial electronic devices. The main reasons for the use of Modbus in the industrial environment are:

developed with industrial applications in mind,
openly published and royalty-free,
easy to deploy and maintain,
moves raw bits or words without placing many restrictions on vendors.

Modbus enables communication among many devices connected to the same network, for example, a system that measures temperature and humidity and communicates the results to a computer. Modbus is often used to connect a supervisory computer with a remote terminal unit (RTU) in supervisory control and data acquisition (SCADA) systems. Many of the data types are named from its use in driving relays: a single-bit physical output is called a coil, and a single-bit physical input is called a discrete input or a contact.

This chapter is a guide on how to use Modbus TCP to monitor RUT950 and RUT955 routers using a Linux Operating System.

Configuring the router

In order to start using Modbus TCP, we must first configure the router. Modbus TCP configuration from the router's side is very simple. All you need to do is log in to the router's WebUI, go to Services → Mobdus, Enable the Modbus TCP service, enter a Port number through which the Modbus TCP communication will take place and Allow remote access if you wish to connect to the router remotely (from WAN).

Installing the necessary software

Next you'll need software capable of communicating via Modbus TCP. The software that we'll be using for this guide is called modbus-cli. To get it you'll first have to install ruby. To do so, open the Terminal app and enter these commands.

$ sudo apt-get install ruby
$ sudo gem instal modbus-cli

Getting router parameters

Modbus TCP can be used to both get and set certain router parameters. First lets do an overview of how to get parameters via Modbus TCP.

List of parameters

Router parameters are held within registers. Each register contains 2 bytes of information. For simplification the number of registers for storing numbers is 2, while the number of registers for storing text information is 16. The register numbers and corresponding system values are described below:


Required value	Representation	Register number	Number of registers
System uptime	32 bit unsigned integer	1	2
GSM signal strength (dBm)	32 bit integer	3	2
System temperature in 0.1 degrees Celcius	32 bit integer	5	2
System hostname	Text	7	16
GSM operator name	Text	23	16
Router serial number	Text	39	16
Router MAC address	Text	55	16
Router name	Text	71	16
Current SIM card	Text	87	16
Network registration	Text	103	16
Network type	Text	119	16
Digital input 1	32 bit integer	135	2
Digital input	32 bit integer	137	2
Current WAN IP address	32 bit unsigned integer	139	2
Analog input	32 bit integer	141	2

modbus read

To obtain parameters from the system, the modbus read command is used. The syntax for this command is:

$ modbus read [OPTIONS] HOST_NAME REGISTER_NUMBER NUMBER_OF_REGISTERS

OPTIONS can describe things like data type, port number, type of addressing, etc.

HOST_NAME is the router's hostname or IP address (WAN IP, if you are connecting remotely).

REGISTER_NUMBER specifies the register that you wish to read.

NUMBER_OF_REGISTERS specifies how many registers should be read starting from the register specified in REGISTER_NUMBER.

Note: all of this information and more can be viewed by entering this command: modbus read -h or modbus read --help.

For example, lets use this command to get the router's uptime value in seconds. If you look back at the table above, you will see that the uptime value is stored in two registers starting from the first register, therefore:

$ modbus read -w -p 12345 192.168.1.1 %MW001 2

-w specifies the data type. In this case, unsigned 16 bit integers.

-p specifies the port number.

192.168.1.1 - the router's LAN IP address.

%MW001 specifies the register number.

2 - specifies how many registers should be read.

As you can see from the example above, the router returns the values stored in two registers: the first one and the second one. The values returned are presented in decimal form.

Interpreting the response

The values are returned in decimal and, if you add -D to the command, hexadecimal forms. Sometimes the answer is self-explanatory as in the example above. But, since a register only hold 2 bytes (16 bits) of information, the value stored in a register can't be higher than 65535 (2¹⁶ -1). So what happens if the router's uptime is higher than that? Lets examine another example where the router's uptime is higher than 65535:

When the value climbs over 65535 the counter resets and the value held by the first register increases by 1. So one way to interpret the results would be to multiply the value in the first register by 65536 (2¹⁶) and add it to the value of the second register: %MW1 * 65536 + %MW2. Which, following from the example above, would be: 1 * 65536 + 3067 = 68603 s or 19 hours 3 minutes 23 seconds.

However, while this works when calculating uptime values, it will not work for all parameters. The correct way to calculate the final values would be to first convert them to binary. As mentioned earlier in this chapter, a register holds 16 bits of information, which can be represented by a 16-digit long binary number. Following from the example above, the first register's value of 1 converted to binary would be 0000 0000 0000 0001 and the second register's value of 3067 would be 0000 1011 1111 1011. You can easily convert numbers from one numeral system to another using any online conversion tool:

The zeros at the beginning are added to represent the fact that the numbers are expressed in a 16-bit format. The next step is to add the two values, but not in the traditional sense. Instead, the value of the second register should act as an extension of the value of the first register or, to put it more simply, the values should be added up as if they were strings, i.e., 0000 0000 0000 0001 + 0000 1011 1111 1011 = 0000 0000 0000 0001 0000 1011 1111 1011. What happens here is that in this sum the first register's value of 1 shouldn't be considered as 1, but instead as 65536 (2¹⁶) , which is the value of the 17th digit of a 32-bit long binary number. If you convert this value back to decimal, you will see that we get the same answer:

WAN IP address

Lets examine a different, more complex example by issuing a request for the router's WAN IP address. If you look at the table above, you will see that the WAN IP address value is contained within the 139th and 140th registers. Therefore, we should specify the 139th address and read 2 registers from that address:

$ modbus read -w -p 12345 192.168.1.1 %MW139 2

An IPv4 address is divided into 4 segments. Each segment contains 8 bits (or 1 byte) of information:

So in order to get the WAN IP address from the response received, we'll need to convert the values of both registers to binary and split them into 8-bit segments. Lets do that with the values from the last example:

%MW139 2692 and %MW140 30404, which converted to binary would be: 2692 → 0000 1010 1000 0100 ; 30404 → 0111 0110 1100 0100.

As discussed earlier, we'll need to separate the two numbers into 8-bit segments to get the IP address:

Signal strength

Yet another different example is Signal strength values, because they are negative. Lets examine an example of this to see how the values should be interpreted:

To change the sing of a binary number you must invert it add 1 to it. In the case of signal strength, you don't need both register values to do so, only the second one (register 4), which is, in our example, 65477. When converted to binary it's: 65447 → 1111 1111 1100 0101. Next, we'll to invert it and add 1:

The value we got is 0000 0000 0011 1011. When converted to decimal it becomes 59, so the final value is - 59

Text

Some values like Hostname, Router name, Network type are represented as text in their original form, but are stored in registers as numbers. You can interpret these values the same way as all discussed before (by converting them to binary and then to text), but a simpler way would be to get them in hexadecimal form and then convert them to text. To do so, we'll have to add the -D parameter to the command. Lets do it by asking for the router's Hostname:

$ modbus read -D -w -p 12345 192.168.1.1 %MW007 16

Ignore the first 9 segments and the last segments that contain only zeroes (highlighted in red). Copy the response (highlighted in green) and paste it into a hexadecimal to text (ASCII) converter:

Setting router values

The Modbus daemon also supports the setting of some system parameters. To accomplish this task the modbus write command is used. System related parameters and how to use them are described below. The register number specifies from which register to start writing the required values. All commands, except “Change APN”, accepts only one input parameter. For the APN the number of input registers may vary. The very first byte of APN command denotes the number of SIM card for which to set the APN. This byte should be set to 1 (in order to change APN for SIM card number 1) or to 2 (in order to change APN for SIM card number 2).


Value to set	Description	Register number	Register value
Digital output 1 (on/off)	Change the state of the digital output number 1	201	1/0
Digital output 2 (on/off)	Change the state of the digital output number 2	202	1/0
Switch WiFi (on/off)	Allows to switch WiFi on or off	210	1/0
Switch mobile data connection (on/off)	Turns mobile data connection on or off	211	1/0
Switch SIM card (SIM1, SIM2, SIM1->SIM2 and SIM2->SIM1)	Allows to change SIM card in use, 3 possible options are supported	212	0/1/2
Change APN	Allows to change APN	213	APN code
Reboot	Reboots the router	220	1