Wireshark DNP3: Capture, Filter, Troubleshoot

DNP3 (Distributed Network Protocol 3.0) is the dominant SCADA protocol in North America for electric utilities, water systems, and oil and gas. It runs over TCP or UDP on port 20000.

This article is part of the broader DNP3 series. If you're new to this protocol family, start with DNP3 Protocol: How It Works, Objects, and Function Codes.

Wireshark fully decodes DNP3 — data link layer, transport layer, and application layer. You can see every function code, object group, data point index, quality flag, and timestamp in plain text.

But DNP3 is more complex than Modbus. It has multi-fragment responses, unsolicited messages, class-based event polling, and CRC checks at the data link layer. Knowing which Wireshark filters to use and what to look for makes the difference between solving a problem in minutes and staring at packets for hours.

This guide covers capture setup, verified display filters, how to read decoded DNP3 packets, and how to diagnose the most common DNP3 communication problems.

Practical tool: Use our DNP3 to parse raw packets and inspect field-level details while you read.

In This Guide

• 1. How DNP3 Appears in Wireshark
• 2. How to Capture DNP3 Traffic
• 3. Decoding DNP3 on Non-Standard Ports
• 4. Display Filters for DNP3
• 5. How to Read a Decoded DNP3 Packet
• 6. What a Healthy DNP3 Conversation Looks Like
• 7. Diagnosing No Response from an Outstation
• 8. Diagnosing Unsolicited Response Problems
• 9. Diagnosing Data Quality Issues
• 10. Diagnosing CRC Errors
• 11. Diagnosing Slow Polls and Timeouts
• 12. Filtering by Point Index and Data Type
• 13. Useful Wireshark Columns for DNP3 Analysis
• 14. Common DNP3 Problems and What They Look Like in Wireshark
• Summary

1. How DNP3 Appears in Wireshark

Wireshark decodes DNP3 as three layers:

The Info column shows a summary like:

READ - Request, Class 1, 2, 3, 0
RESPONSE - Solicited, Class 1, 2, 3, 0
UNSOLICITED RESPONSE - Class 1 Events

2. How to Capture DNP3 Traffic

Capture Filter

tcp port 20000

Or if DNP3 runs over UDP:

udp port 20000

Where to Capture

3. Decoding DNP3 on Non-Standard Ports

Wireshark decodes DNP3 automatically on port 20000. Many real-world installations use different ports (e.g., 4999, 5000, 19999, or vendor-specific ports).

If your DNP3 traffic appears as raw TCP data:

Fix: Use "Decode As"

1. Right-click a packet on the non-standard port
2. Select Decode As...
3. Set: Field = TCP port, Value = your port, Current = DNP 3.0
4. Click OK

Fix: Change Preferences

1. Go to Edit → Preferences → Protocols → DNP 3.0
2. Change the TCP Port and/or UDP Port values
3. Click OK

4. Display Filters for DNP3

All filter field names verified against the official Wireshark DNP3 Display Filter Reference (222 fields, versions 1.0.0 to 4.6.4).

Basic Filters

Address Filters

Function Code Filters

Application Layer Filters

Data Type Filters

Quality Flag Filters

CRC Filter

Combination Examples

All unsolicited responses from a specific outstation:

dnp3.al.func == 130 && dnp3.src == 5

All responses with Restart IIN bit set:

dnp3.al.iin.rst == 1

Analog input events with Comm Fail quality:

dnp3.al.aiq.b2 == 1

Filter by a specific point index:

dnp3.al.index == 42 && dnp3.al.ana.float

Slow responses (> 2 seconds between packets):

dnp3 && frame.time_delta > 2

5. How to Read a Decoded DNP3 Packet

Click on a DNP3 packet and expand the three layers:

Data Link Layer

DNP 3.0 Data Link Layer
    Start Bytes: 0x0564
    Length: 15
    Control: 0xc0 (DIR, PRM, FCV=0, FCB=0, Func: Unconfirmed User Data)
    Destination: 3
    Source: 1
    Header CRC: 0xABCD [correct]

• Source/Destination = DNP3 addresses (not IP addresses)
• DIR = direction (1 = master → outstation, 0 = outstation → master)
• PRM = primary message (1 = from initiator)

Transport Layer

DNP 3.0 Transport Layer
    FIR: 1, FIN: 1, Sequence: 0

• FIR = first fragment. FIN = last fragment. Both 1 = single-fragment message.
• If FIR=1 and FIN=0, the message is multi-fragment — look for the next fragment.

Application Layer

DNP 3.0 Application Layer
    Application Control: FIR, FIN, Sequence 0
    Function Code: RESPONSE (129)
    Internal Indications: Class 1 Events
    Object: Binary Input - Packed Format (Obj: 01, Var: 01)
        Index: 0, Value: 1
        Index: 1, Value: 0
    Object: Analog Input - 16-Bit (Obj: 30, Var: 01)
        Index: 0, Quality: Online, Value: 2301
        Index: 1, Quality: Online, Value: 1456

6. What a Healthy DNP3 Conversation Looks Like

A typical DNP3 TCP poll cycle:

Key signs of healthy communication:

• Every READ has a matching RESPONSE
• IIN bits show no errors (no Restart, no Object Unknown, no Comm Fail)
• All quality flags show Online
• Responses arrive within 100–500 ms
• No TCP retransmissions

7. Diagnosing No Response from an Outstation

Filter: dnp3 && ip.addr == <outstation IP>

8. Diagnosing Unsolicited Response Problems

DNP3 outstations can send unsolicited responses when events occur, without waiting for a poll.

Filter: dnp3.al.func == 130

9. Diagnosing Data Quality Issues

Every DNP3 data point has quality flags. Bad quality means the value is unreliable.

Filter: dnp3.al.biq.b0 == 0 (binary inputs not online) or dnp3.al.aiq.b2 == 1 (analog inputs with Comm Fail)

10. Diagnosing CRC Errors

DNP3 uses CRC-16 checksums at the data link layer. Wireshark verifies every CRC.

Filter: dnp.hdr.CRC.status or dnp.data_chunk.CRC.status

If CRCs fail, the data link frame is corrupted. This usually means:

• Noise on the communication link (especially serial-to-Ethernet converters)
• Bad cable or connector
• Electrical interference near communication cables
• Baud rate mismatch (if converted from serial)

11. Diagnosing Slow Polls and Timeouts

Filter: dnp3 && frame.time_delta > 2

12. Filtering by Point Index and Data Type

To track a specific point:

dnp3.al.index == 42

This shows all packets containing point index 42 — any object type. To narrow it down:

dnp3.al.index == 42 && dnp3.al.ana.float

This shows only packets where analog input index 42 appears with a float value.

Other useful combinations:

13. Useful Wireshark Columns for DNP3 Analysis

14. Common DNP3 Problems and What They Look Like in Wireshark

Summary

Wireshark decodes every layer of DNP3 — data link CRC, transport fragments, and full application layer with function codes, object groups, point values, quality flags, and timestamps.

The key things to remember:

• DNP3 runs on TCP/UDP port 20000. Use Decode As if your system uses a different port.
• Use dnp3 as the main display filter
• Use dnp3.al.func to filter by function code (1=Read, 129=Response, 130=Unsolicited)
• Use dnp3.src and dnp3.dst to filter by DNP3 address (not IP address)
• Use dnp3.al.iin.rst to find devices that have restarted
• Use dnp3.al.index to track a specific data point across the capture
• Use dnp3.al.biq.b2 or dnp3.al.aiq.b2 to find points with Comm Fail quality
• Check CRC status with dnp.hdr.CRC.status and dnp.data_chunk.CRC.status

ℹ

💡 Tip: Use the free DNP3 Frame Decoder Tool to decode any DNP3 frame byte by byte — including data link CRC, transport header, function codes, and object headers.

DNP3 Related reads in the same family:

• DNP3 Protocol: How It Works, Objects, and Function Codes
• How to Configure DNP3 Communication Between Master and Outstation
• DNP3 vs IEC 60870-5-104: Which Protocol Is Better for SCADA?