I have a similar challenge with a pool heat pump (there is a modbus link between the touchscreen and the main board which I need to sniff).
I’ve created a branch of the standard esphome modbus / modbus_controller modules which adds a “disable_send” feature. You can then setup a sensor which will send both the master request and the slave response that it detects on the bus.
The current version is very hacky and not documented. If there is interest I will document.
repo here: https://github.com/pcr20/esphome/tree/dev