The 3xxxx registers are addressed using the 04 “read input registers” Modbus function code.
30101 to 30200 is 100 registers. You usually tell the software how many registers it needs to read in one message, but there’s no guarantee of that.
Most Modbus/TCP devices use the slave’s IP address, not the slave node’s ID address like Modbus RTU requires, but some early vintage PLC firmware does “Modbus RTU over Ethernet”, which requires the slave node address to be configured and working.
The software ordinarily calculates the CRC bytes.
The actual Modbus message frame looks like this:
The Modbus message starts counting at zero. Your decimal registers are likely one-offset from zero.
(3)0000 = register 0001
(3)0001 = register 0002
(3)0098 = register 0099
(3)0099 = register 0100
(3)0100 = register 0101
(3)0101 = register 0102
(3)0200 = register 0201
(3)0101 = register 0102 = 0066 hex
(3)0200 = register 0201 = 00C9 hex
Quantity of 100 input registers = 0064 hex
For Slave address 02, the Modbus RTU message would be
02 04 00 66 00 64 CD 11 (CRC error)
(I can't format the bytes to line up with the windows in the query image, sorry)
(I forget which byte is the leading byte in the error check field)
I have no idea how your particular software constructs a Modbus command. You need to refer to your Modbus master documentation for that.
You can use a generic Windows Modbus master with the correct hardware connections, to test the connection and functionality of the Modbus slave, presumably the PLC. (both master and slave have to be on the same Ethernet subnet to talk to one another). This is a good way to test that the slave is setup the way you think it is.
A free Modbus Master utility is available at
http://www.icpdas-usa.com/documents/modbus/modbus_master_tool.zip
