instead of nmap i would use wireshark and filter on S7 it filters perfectly every message send and orders them by how the connection is build