<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-dnp3-protocol-analysis
description: >-
  Capture and analyze DNP3 (Distributed Network Protocol 3) traffic for unauthorized
  control operations, authentication bypass, and protocol-level attacks targeting
  electric grid and water utility SCADA systems.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - dnp3
  - protocol-analysis
  - scada
  - ics
  - wireshark
  - zeek
  - electric-grid
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0855", "T0831", "T0814"]
  nist-csf: ["DE.CM-1", "DE.AE-2"]
  iec-62443: ["SR 3.5", "SR 5.2"]
  uuid: a1b2c3d4-1005-4000-a005-000000000005
---

# Performing DNP3 Protocol Analysis

## Overview

DNP3 is the dominant SCADA protocol in electric utilities and water systems, operating on
TCP/20000 or serial links. While DNP3 Secure Authentication (SA) exists, many deployments
lack it — enabling unauthorized control operations, data manipulation, and denial of
service. Industroyer/CrashOverride demonstrated weaponized DNP3 exploitation against
power grid infrastructure.

Mode: `[MODE: BLUE]` for traffic monitoring; `[MODE: RED]` for protocol abuse testing.

## Prerequisites

| Requirement | Details |
|---|---|
| Wireshark 4.0+ with DNP3 dissector | Required |
| Zeek 6.0+ with `dnp3.zeek` protocol analyzer | Required |
| Suricata 7.0+ with ICS rulesets | Required |
| Network access to DNP3 traffic (TCP/20000, UDP/20000) | Required |
| DNP3 protocol specification (IEEE 1815) | Required |

## Key Concepts

### DNP3 Function Codes

```yaml
# Master → Outstation (control)
FC 0x01: Read                      # Data acquisition
FC 0x02: Write                     # Configuration change
FC 0x03: Select                    # Select-Before-Operate (SBO)
FC 0x04: Operate                   # Execute selected operation
FC 0x05: Direct Operate            # Immediate control (bypasses SBO)
FC 0x06: Direct Operate No Ack     # Fire-and-forget (⚠️ highest risk)
FC 0x0D: Cold Restart              # Reboot outstation
FC 0x0E: Warm Restart              # Soft restart
FC 0x12: Stop Application          # Stop outstation app
FC 0x14: Enable Unsolicited        # Enable unsolicited responses
FC 0x15: Disable Unsolicited       # Suppress alarms

# Outstation → Master (response)
FC 0x81: Response                  # Normal response
FC 0x82: Unsolicited Response      # Event-driven alert
```

### Wireshark DNP3 Analysis

```bash
# Capture DNP3 traffic
tshark -i eth1 -f "tcp port 20000" -w dnp3_capture.pcap

# Display all DNP3 frames
tshark -r dnp3_capture.pcap -Y "dnp3"

# Filter control operations (write/operate/restart)
tshark -r dnp3_capture.pcap \
  -Y "dnp3.al.func == 0x02 || dnp3.al.func == 0x04 || dnp3.al.func == 0x05 || dnp3.al.func == 0x0d"

# Extract DNP3 addresses and function codes
tshark -r dnp3_capture.pcap -Y "dnp3" \
  -T fields -e frame.time -e ip.src -e ip.dst \
  -e dnp3.src -e dnp3.dst -e dnp3.al.func

# Detect Direct Operate No Ack (most dangerous — no confirmation)
tshark -r dnp3_capture.pcap -Y "dnp3.al.func == 0x06"

# Identify cold/warm restart commands
tshark -r dnp3_capture.pcap -Y "dnp3.al.func == 0x0d || dnp3.al.func == 0x0e"
```

### Zeek DNP3 Analysis

```bash
# Process PCAP with DNP3 analyzer
zeek -r dnp3_capture.pcap dnp3

# Parse DNP3 log for control operations
cat dnp3.log | zeek-cut ts id.orig_h id.resp_h fc | sort -u

# Identify dangerous operations
cat dnp3.log | zeek-cut ts id.orig_h id.resp_h fc | \
  grep -E "DIRECT_OPERATE|COLD_RESTART|WARM_RESTART|STOP_APPL"

# Profile communication pairs
cat dnp3.log | zeek-cut id.orig_h id.resp_h | sort | uniq -c | sort -rn
```

### Suricata DNP3 Rules

```yaml
# Alert on Direct Operate No Ack (highest risk)
alert tcp any any -> $ICS_NET 20000 ( \
  msg:"DNP3 - Direct Operate No Ack (FC 0x06)"; \
  flow:established,to_server; \
  dnp3_func:6; \
  sid:4003001; rev:1; \
  metadata:mitre_attack_technique T0831;)

# Alert on Cold Restart command
alert tcp any any -> $ICS_NET 20000 ( \
  msg:"DNP3 - Cold Restart Command (FC 0x0D)"; \
  flow:established,to_server; \
  dnp3_func:13; \
  sid:4003002; rev:1; \
  metadata:mitre_attack_technique T0814;)

# Alert on Disable Unsolicited (suppress alarms)
alert tcp any any -> $ICS_NET 20000 ( \
  msg:"DNP3 - Disable Unsolicited Responses"; \
  flow:established,to_server; \
  dnp3_func:21; \
  sid:4003003; rev:1;)
```

## Workflow

### Step 1: Capture and Profile

```bash
# Baseline normal DNP3 operations (7+ days)
tshark -i eth1 -f "tcp port 20000" -w dnp3_baseline.pcap -b filesize:500000
zeek -r dnp3_baseline.pcap dnp3
cat dnp3.log | zeek-cut id.orig_h id.resp_h fc | sort -u > dnp3_baseline_profile.txt
```

### Step 2: Deploy Monitoring

```bash
# Enable Suricata DNP3 rules
suricata -T -c /etc/suricata/suricata.yaml -S dnp3_rules.rules
kill -USR2 $(pidof suricata)
```

### Step 3: Check Secure Authentication

```bash
# Verify SA is enabled (look for auth objects in traffic)
tshark -r dnp3_capture.pcap -Y "dnp3.al.obj == 120.1 || dnp3.al.obj == 120.2"
# Empty output = Secure Authentication not deployed
```

## Verification

- [ ] DNP3 traffic captured and baselined
- [ ] Control operations (write/operate/restart) monitored and alerted
- [ ] Secure Authentication deployment status assessed
- [ ] Direct Operate No Ack detection rules active
- [ ] Restart command detection active
- [ ] Unsolicited response manipulation detected
- [ ] Communication pair baseline maintained

## Detection Opportunities

- Direct Operate without Select-Before-Operate → bypassing safety interlock
- Cold/Warm restart from non-master station → unauthorized outstation disruption
- Disable Unsolicited from unexpected source → alarm suppression before attack
- New DNP3 source addresses → unauthorized master or man-in-the-middle
- High-frequency polling changes → reconnaissance or DoS preparation

```yaml
title: Dnp3 Protocol Analysis Detection
id: f9536390-83d2-4618-8df2-6b653b3e46a6
status: experimental
description: Detects suspicious activity related to performing dnp3 protocol analysis techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*dnp3*"
  condition: selection
level: medium
tags:
  - attack.t0855
  - attack.t0831
  - attack.t0814
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- IEEE 1815-2012: DNP3 Standard
- Industroyer/CrashOverride Technical Analysis (ESET, Dragos)
- IEC 62351: Security for DNP3 Communications
- NIST SP 800-82 Rev 3 §5.5: SCADA Protocol Security
