 | 1 | initial version |
I capture and inspect DNP3 traffic almost daily so Wireshark in general has no issue with this.
The IANA allocated port for DNP3 traffic is 20000 and this is set as the default port in the dissector preferences.
If your traffic isn't using 20000, you can use Decode As.... to set DNP3 as the dissector for the port in use.
Is it possible your traffic is in some kind of encrypted tunnel, e.g. over a VPN or TLS connection? Can you share a capture on a public share and post a link to the capture in a comment?
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
