Hack Your First PLC: Ep.3 – Discovering PLCs Using Wireshark

Task/Question In 6: How many coils are being read as part of the communication between 172.21.1.10 and the other device?

I would use the following filter:

"ip.src == 172.21.1.10 && ip.dst ==172.21.1.20 && tcp.port == 502 && modbus.func_code == 1"

but no idea how to get the "quantity of coils". It seems not to be the numbers of packets from the applied filter.

Regards.