You're trying to connect to a Modbus TCP device and the connection is immediately refused, times out at the TCP level, or connects but gets no Modbus responses. This guide covers the systematic approach to diagnosing TCP-level connection issues.
Can't connect over TCP?
ModBus Pro's connection tester tells you in one click whether it's the IP, port 502, or the device refusing the connection.
Download free trial →Connection Refused vs Timeout
Connection refused (immediate rejection) means something is actively rejecting your TCP SYN packet. A firewall, the device itself, or the wrong port. Connection timeout (slow failure) means your packets aren't reaching the device at all — a routing, VLAN, or physical network problem.
Network Layer Checks
1. Ping the device
If you can't ping it, Modbus TCP won't work. Check IP address, subnet mask, gateway. Ensure you're on the same subnet or that routing is configured.
2. Check VLAN configuration
In SCADA environments, Modbus devices are often on a separate VLAN from the engineering workstation. Verify the switch port configuration and VLAN tagging.
3. Check for duplicate IPs
If two devices share the same IP, the ARP table flips between their MAC addresses and connections fail intermittently. Use arp -a to check for multiple MACs on the same IP.
Port & Firewall Issues
Modbus TCP defaults to port 502. Some devices use non-standard ports. Some firewalls block port 502 by default. Test with: telnet [device-ip] 502 — if it connects (even briefly), the TCP path is clear.
On Windows, the built-in firewall may block outbound connections to port 502. Check Windows Defender Firewall rules if you're testing from a laptop.
Maximum Connection Limits
Many Modbus TCP devices only support 2-5 simultaneous TCP connections. Common culprits:
- Your SCADA system holds a permanent connection
- A commissioning tool from last week is still connected (and the device never timed it out)
- Another engineer's laptop has Modbus Poll open
Solution: Power-cycle the device to clear all connections, or check the device's web interface (many have one) to see and kill active connections.
Unit ID Confusion
Even after TCP connects, you need the right Unit ID in the Modbus TCP header. Standalone devices usually expect Unit ID 1 or 255. Modbus TCP gateways (that bridge to RS485 devices behind them) need the actual slave address of the target device as the Unit ID. Getting this wrong results in timeouts or exception responses.
Find every Modbus TCP device on your network
ModBus Pro scans your subnet for devices listening on port 502 and helps you connect to them quickly. With 80+ built-in device register maps, getting started with common devices is fast and easy.
Download FreeFrequently asked questions
What port does Modbus TCP use?
Modbus TCP uses TCP port 502 by default. Some gateways and PLCs are configured to use a different port, so confirm the port set on the device.
Why do I get connection refused on Modbus TCP?
Connection refused means the device is reachable on the network but actively rejected the connection on that port. Usual causes are Modbus TCP not enabled on the device, the wrong port, a firewall blocking it, or the device having reached its maximum number of simultaneous connections.
How is connection refused different from a timeout?
Connection refused is an immediate no from the host, meaning the port is closed or blocked. A timeout means no response at all, which points to a wrong IP address, an offline device, or a firewall silently dropping packets.
How do I test whether port 502 is open?
From PowerShell run Test-NetConnection your-device-ip -Port 502, or use telnet your-device-ip 502. If the connection fails, the Modbus service is not listening or a firewall is blocking the port.