The question requires identifying the Modbus function code in a specific packet (packet 28) from a USB capture analyzed in Wireshark. Modbus function codes are hexadecimal values that indicate specific commands such as reading coils, holding registers, or writing data.
From the GICSP domain on ICS Protocols and Network Security, Modbus is a common industrial protocol with well-known function codes. For example:
0x01 = Read Coils
0x02 = Read Discrete Inputs
0x03 = Read Holding Registers
0x04 = Read Input Registers
0x05 = Write Single Coil
0x06 = Write Single Register
0x08 = Diagnostics
0x09, 0x0a, 0x07 correspond to less common or vendor-specific functions.
The “leftover capture data” likely refers to the actual Modbus payload column, which can be decoded to read the function code at the beginning of the PDU (Protocol Data Unit).
Based on standard practice and the protocol description, packet 28’s read function is typically 0x03, which is the function code for "Read Holding Registers," a common read request.
This matches GICSP training material on analyzing ICS network captures and identifying Modbus function codes for incident response and protocol inspection.
