Example

The realtime data is requested by READ_REALTIME_STUFFED_TYPE_COMMAND (32+128=160) that is a0, and modbus CRC is 38bf (but in little endian): a0 bf 38

* And of course, because of HDLC framing, HDLC_END 0x7E before and after

** from brayterm you send $7e$a0$bf$38$7e

to get the long response (>60 bytes).

v3 response is sent by the MTsendRTvar_triggerlog() function (see comm.c in the firmware zip). So payload comes from MTsendRTvar() function:

HDLC_bytestuffed_escaped_and_framed( <payload, 32>, 2byteLittleEndianModbusCRC( <payload, 32> ) )

where 32 is the RT_STUFFED_TYPE (yes, the type is always at the end of the packet, right before the CRC: there is very good reason for this, notably when the primary, secondary and other trigger events are logged and type is NOT known in advance).