Open / standardized
DNP3
A telemetry protocol widely used between control centres and remote substations or pump stations. It supports unsolicited reporting, time-stamped events and, optionally, Secure Authentication (DNP3-SA).
20000/TCP (commonly)Serial or TCP/UDPEncryption: Optional
How it works
A master station polls outstations for static and event data; outstations may push unsolicited responses. Objects and variations describe point data types.
Communication patternMaster → outstation integrity poll; outstation → master unsolicited event reports.
Fact sheet
Also known asIEEE 1815
TransportSerial or TCP/UDP
Ports20000/TCP (commonly)
AuthenticationOptional
PurdueLevel 2 – Level 1
EnvironmentsElectric utilities, Water utilities, Remote SCADA
DevicesRTU, IED, SCADA server, Protective relay
IndustriesElectric Power, Water / Wastewater, Oil & Gas
Why should I care?
Understanding DNP3 is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Read / integrity poll
- Select-before-operate control
- Direct operate
- Freeze counters
- Time synchronisation
Security concerns
- Secure Authentication is often not enabled in the field
- Control commands (operate) can change breaker or pump state where reachable
- Wide-area links historically ran over unencrypted leased lines or radio
What normal looks like
- Regular integrity polls
- Event-driven unsolicited responses
- Control commands only from the operational master
What deserves attention
- Operate commands from a non-master address
- New master IP polling outstations
- Time-sync commands from unexpected sources
Hunting ideas
- rogue-master-controller
- protocol-write-activity
- time-sync-manipulation
Defensive controls
- Enable DNP3-SA where supported and validated
- Encrypt wide-area links at the network layer
- Restrict master addresses at the conduit
Related ATT&CK for ICS techniques
T0855T0836T0885
Sources & further reading