Ask Your Question

There used to be an option to enable heuristic detection for dnp3 packets. It seems to be missing as of 3.4.9. Has it been removed?

asked 2021-11-02 14:56:15 +0000

dtardogno gravatar image

DNP option to disable port mapping and enable heuristic detection (0x0564 in first two bytes of payload), seems to be missing. Has it been removed?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2021-11-02 15:15:20 +0000

grahamb gravatar image

The preferences were removed over 6 years ago, see change 9610.

As per that change, heuristic dissectors are now enabled via the Analyze -> Enabled Protocols dialog, search for DNP3 and then use the checkboxes for dnp3_tcp or dnp3_udp as required.

Arguably the description could indicate this is for heuristic dissection.

edit flag offensive delete link more


Is there a way to do this programmatically, from a plugin, or from a startup config file?

dtardogno gravatar imagedtardogno ( 2021-11-02 17:43:32 +0000 )edit

The setting is preserved in the profile in the file heuristic_protos, e.g. with both DNP3 options checked among the entries in the file are


or from the command line with --enable-heuristic <short_name> e.g. dnp3_tcp.

grahamb gravatar imagegrahamb ( 2021-11-02 18:30:47 +0000 )edit

image description

Chuckc gravatar imageChuckc ( 2021-11-02 21:27:33 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-11-02 14:55:57 +0000

Seen: 375 times

Last updated: Nov 02 '21