I can see Serial Tap under Device Manager USB controllers-> IO Ninja Serial Tap, location Port_#0001.Hub_#0003
When I start a new session for ModBus Analyzer, the port list just empty.

Which session are you running? I mean, Modbus Analyzer is a layer plugin that's attached on top of some other session that provides raw data. I assume, you want to capture data via a Serial Tap -- then you have to start a Serial Tap session first:

Then you can attach Modbus Analyzer on top so that it decodes Modbus commands & replies for you.

The devmon is installed and works properly as in the KB section

devmon is for capturing local traffic generated by other apps on the same PC; it's not required for a Serial Tap.

If you have another application doing Modbus communications, you can start a Serial Monitor session (this plugin uses devmon) and see what this other app sends and receives. Then you can attach a Modbus layer on top to parse raw data and decode Modbus packets.

Correct, for capturing, elevation is required. This is by design -- capturing USB traffic is a major security threat (e.g., it allows intercepting keystrokes, mouse movements, etc). The USBPcap driver makes sure only elevated processes can open \Device\USBPcap<n> for reading by assigning a corresponding security descriptor. And there's no way to override this behavior -- the security descriptor is hardcoded.

thanks for the quick reply and indeed, it looks like I screwed up with the most BASIC instruction: rebooting after installing.

When trying everything again today, it worked like a charm. Of course.

The only thing that you might be interested in: while the enumeration and device selection work fine now even w/o elevated privileges, I need to run with elevated privileges in order to actually capture some data. W/o elevation, capture attempts lead to "access denied" messages. But that is no issue, of course, just information.

Thanks for pointing me in the right direction, I promise I will pay more attention to the instructions next time.

Cheers,
Jörg

If the USB Mon device list is empty, it most likely means that USBPcap is not properly installed (did you reboot after installing it?) The enumeration of USBPcap devices requires no elevated privileges, so you should see the list of available USB devices (together with their mapping to particular USBPcap devices) in the drop-down list no matter if you run IO Ninja elevated or not. You can try running the USB Mon session as Administrator for the sake of the experiment, but it shouldn't change much...

Can you see the list of available USBPcap devices in Wireshark by the way?