SerialMon — Protocol Analyzer · v4.0

Accelerate SCADA commissioning.

Test faster. Energize with confidence.

The commissioning engineer's multitool. Monitor, simulate, and debug industrial protocols — from first packet to final sign-off.

Download Free Trial

Trusted by engineers at

Field-Proven. Engineer-Approved.

Watch SerialMon in action

Listen in passively on the communication. You see everything in plain text, no guessing… You can also act as master or slave.

9 protocols supported

7 day free trial

3 connection modes

FAT/SAT test documentation built in

Release notes

What's New in v4.0

Secure IEC 60870-5-104

TLS and Secure Authentication as master, slave and passive monitor, with certificate tools, key management and user roles.

Anomaly Detectionbeta

Flags suspicious and non-conforming traffic as it happens, with severity levels, filters and muting.

Address Tracking Grid

Every signal as a tile colored by its quality. Snapshots, favorites and change highlighting show what has changed.

Event Panel & Timeline

New events in large text, detachable to a second screen. A timeline shows the traffic second by second.

File Transfer

Browse and download files from IEC 60870-5-101 and IEC 60870-5-104 stations, or serve files in IED mode.

Built for Long Sessions

Faster capture, grids and charts with lower memory use over days of monitoring, a choice of how much history to keep and a memory safety valve.

More Ways to Connect

UDP, IPv6 and named connection profiles, a tool that identifies the protocol on a serial line, and compressed PCAP imports.

Built in the substation. Trusted worldwide.

Why engineers choose SerialMon

Save Time

Cut commissioning time in half. See parsed protocol data instantly — no more manual telegram decoding.

Real-time protocol parsing
Instant signal tracking
Quick troubleshooting

Save Money

Reduce Errors

Eliminate guesswork with automatic protocol validation and clear error messages.

Protocol conformance checks
Invalid message warnings
Complete audit trail

Verified

Deliver Confidence

Sign off with certainty. Track every tested signal and document your FAT/SAT.

Mark signals as Accepted
Export test documentation
Complete signal history

FAT OK

Protocol Coverage

One tool. Every protocol.

Nine telecontrol protocols. One tool for master, slave, and monitoring roles — over serial and TCP/IP.

Protocol	Interface	Monitoring	Simulation
IEC 60870-5-101	RS-232/422/485	✓	✓ master/slave
IEC 60870-5-102	RS-232/422/485	✓	✓ master/slave
IEC 60870-5-103	RS-232/422/485	✓	✓ master/slave
IEC 60870-5-104	TCP/IP, TLS	✓	✓ master/slave
ABB RP570/571	RS-232/422/485	✓	✓ master/slave
ABB SPA-bus	RS-485	✓	✓ master/slave
ABB SPA/TCP	TCP/IP	✓	✓ master/slave
NMEA 0183 / GNSS	RS-232/485	✓	—
Time (RFC 868)	Serial, TCP/UDP	✓	✓ client/server

Features

Master, slave & monitor modes
Event list & alarm list
Signal tracking with full history
FAT/SAT export from the tracking window
TLS & Secure Authentication for IEC 60870-5-104
RS-232/422/485 & TCP/IP
PC clock synchronized over NTP
Windows 10/11

Applications

RTU commissioning
FAT/SAT verification
Field troubleshooting
OT equipment verification (RTUs, IEDs & SCADA/HMI)

Nine protocols. One licence. No add-on modules.

Built by engineers, for engineers. See how SerialMon simplifies your commissioning work.

See SerialMon in action

1Raw bytes
2Parsed telegram
3Timestamp
4Direction RX/TX
5Traffic timeline

Raw packets are shown alongside the parsed telegrams. Switch between them instantly.

Packet builder ABB RP570 — Send custom telegrams. SerialMon helps you fill in the parameters.

Packet builder IEC 60870-5-104 — Every byte of the telegram is labeled as you build it.

Address tracker IEC 60870-5-104 — SerialMon keeps track of all signals. Load in your own signal list.

Address tracker ABB RP570 — Open a saved capture and every object gets its own value history.

Alarm list — Overview of all active alarms. Keep open while testing to your SCADA system.

Connection — Multiple ways of connecting to your equipment supported.

Grid view of all signals — Grid view: every signal as a tile, colored by its quality.

Event list — Every value change is logged as an event, with your own signal names.

Customers

Trusted by industry leaders worldwide

Get started

Ready to accelerate your commissioning?

Join thousands of engineers who trust SerialMon for their SCADA projects.

Try SerialMon

7 days full access

All protocols included
No credit card required
Windows 10/11

TLS, Secure Authentication and anomaly detection need a purchased license.

Download Free Trial

Get a Quote

Volume licensing available

All protocols included
1 year of updates
Priority e-mail support

Try it on the next job. You will quickly see that you save time and money. And less stress.

Frequently Asked Questions

Common questions about SerialMon

What is anomaly detection?

Anomaly detection (beta) watches the traffic for suspicious or non-conforming messages, such as malformed frames, timer violations or failed authentication, and lists each finding with its severity in the Anomalies window. It needs a purchased license.

What time synchronization protocols are supported?

For serial clocks, SerialMon decodes Meinberg Standard, Meinberg Capture, Hopf 6021, Trimble TSIP, Trimble TAIP, Uni Erlangen, Uni Erlangen PZF5xx, SAT, Computime, Wharton, RCC8000 Type 2 and the ABB SPA-bus time broadcast. It also acts as an RFC 868 time client or server over TCP or UDP, and decodes NMEA 0183 from GNSS receivers.

What is SerialMon?

SerialMon is a multiprotocol sniffer/analyzer for serial & network communication. It's designed for troubleshooting gateway/RTU communication, signal testing to control centers, and verifying communication protocols in industrial automation systems.

How do I scale analog measurements?

In Address Tracker, select a signal and go to the User-defined tab. Check 'Scale' and set min/max values. For ABB RP570, configure AVM scaling range (±2000, ±2047, or -2048 to +2047) in Protocol settings.

What file formats does SerialMon support?

SerialMon can save/load .MON and .MONX files (native formats), import/export .PCAP and .PCAPNG files (Wireshark compatible), and import various signal list formats including CSV, XLS, XLSX, and XML files.

What are Intelligent Signals?

Intelligent signals have enhanced functionality in IED mode - they can be automated with different patterns (sinus wave, random, moving values, etc.), linked to commands, and modified with convenient controls. They're created automatically during monitoring or manually in Address Tracker.

Does SerialMon support secure IEC 60870-5-104?

Yes. SerialMon supports TLS and Secure Authentication for IEC 60870-5-104 as master, slave and passive monitor, with certificate tools, key management and user roles. TLS and Secure Authentication need a purchased license.

What are the system requirements?

SerialMon requires 64-bit Windows 10 (version 1607 or later) or Windows 11, on a processor with x86-64-v2 support (SSE4.2 and POPCNT). It also runs on Windows 11 on ARM through x64 emulation, except Serial Software monitoring, which needs an x64 processor. An occasional Internet connection is needed for license activation. Network monitoring needs Npcap; on Windows 10 the setup installs WinPcap, which also works.

How do I export data for analysis in other tools?

Export to PCAP/PCAPNG for Wireshark analysis, save Events/Alarms to CSV files, export signal lists with user-defined names, or use the native MON/MONX formats. Address Tracker data can be exported for documentation purposes.

What statistics does SerialMon provide?

Statistics window shows packet counts and bytes categorized by direction, packet type, or slave address. Charts display bytes or packets per second/minute over time. Categories vary by protocol - perfect for analyzing communication patterns.

Can I send custom telegrams?

Yes! Use the Packet Builder (Tools → Packet builder) to construct custom packets for supported protocols. You can queue multiple packets and send them in sequence, perfect for select/execute command pairs in Control Center or IED modes.

How do Events and Alarms work?

Events list all signal value changes chronologically. Alarms track binary signals that go to '1' and remain in the list until acknowledged. Both features are great for end-to-end signal testing and verifying communication to control centers.