Ask Your Question
0

How to capture DNP over TCP or IP?

asked 2020-08-25 23:21:54 +0000

Xiblade gravatar image

I was trying to capture dnp3 exchanges using wireshark but failed. Read some email and tried “decode as” and filters but did not work. How can I capture dnp3 over tcp or ip exchange using wireshark?

edit retag flag offensive close merge delete
add a comment

1 Answer

Sort by » oldest newest most voted
0

answered 2020-08-26 07:16:56 +0000

grahamb gravatar image

I capture and inspect DNP3 traffic almost daily so Wireshark in general has no issue with this.

The IANA allocated port for DNP3 traffic is 20000 and this is set as the default port in the dissector preferences.

If your traffic isn't using 20000, you can use Decode As.... to set DNP3 as the dissector for the port in use.

Is it possible your traffic is in some kind of encrypted tunnel, e.g. over a VPN or TLS connection? Can you share a capture on a public share and post a link to the capture in a comment?

edit flag offensive delete link more
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

subscribe to rss feed

Stats

Asked: 2020-08-25 23:21:54 +0000

Seen: 1,071 times

Last updated: Aug 26 '20