<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Performing DNP3 Protocol Analysis — API & Tool Reference

> Quick reference for tools, commands, and APIs used in performing-dnp3-protocol-analysis.

## Tools

### `tshark`

Command-line Wireshark for DNP3 packet capture and field extraction.

**Usage:**
```bash
tshark -i <iface> -f "tcp port 20000" -w <output.pcap>
```

**Key Flags:**
  - `-Y "dnp3"`: display filter for DNP3 frames
  - `-e dnp3.al.func`: extract function code
  - `-e dnp3.src`: extract DNP3 source address
  - `-e dnp3.dst`: extract DNP3 destination address

---

### `zeek`

Network analysis framework with DNP3 protocol parser.

**Usage:**
```bash
zeek -r <pcap> dnp3
```

**Key Outputs:**
  - `dnp3.log`: parsed DNP3 transactions with function codes

---

### `suricata`

IDS/IPS with DNP3 protocol keywords.

**Usage:**
```bash
suricata -r <pcap> -S dnp3_rules.rules -l /tmp/output/
```

**Key Keywords:**
  - `dnp3_func`: match DNP3 function code
  - `dnp3_obj`: match DNP3 object header
  - `dnp3_ind`: match DNP3 internal indicators

---

## Integration Notes

- DNP3 operates on TCP/20000 and UDP/20000 — monitor both
- Secure Authentication objects use group 120 — presence indicates SA deployment
- Direct Operate No Ack (FC 0x06) is highest risk — fire-and-forget with no confirmation

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- IEEE 1815-2012: DNP3 Standard
