Key parts of the trace:
1. DataLogic (DL) does an odd thing at the start. He sends out a gratuitous ARP, which essentially announces to the network that he 10.0.0.26. He then issues 4 ARP requests for the PLC in 2us. Not hurtful, but odd to burst off 4 requests without waiting for a reply.
2. Upon receiving the first response from the PLC, he opens a connection.
3. After about 1 minute, the PLC closes it due to inactivity, and DL ACKs him indicating that he at least saw the close request.
4. 15 seconds after that, DL sends a Modbus write.
5. DL immediately follows it with a connection close and a RST/ACK...doesn't wait for a response. It feels like the socket is goofed up at this point.
6. PLC says, huh? (resets the connection)
7. 6 seconds later, DL opens a new connection and successfully speaks Modbus.
Basically, he gets flustered when the server drops the line on him. He eventually recovers, but doesn't appear to retry the failed comm.